GDPR in recruitment:
how long to keep a CV, and what to tell candidates

The GDPR sets no fixed period for keeping a CV: it must be limited to what the purpose requires. In France, the CNIL recommends 2 years after the last contact for a rejected candidate, with their consent or after informing them. Everywhere in the EU, you must also inform candidates, answer their requests within a month and keep a human decision in screening.

This article covers each point for a recruitment agency or an HR team. The GDPR applies across the European Union; the retention periods quoted come from the CNIL, the French data protection authority. If you recruit in another country, check your own authority's guidance.

Article checked on 11 November 2026, against the CNIL's retention guidelines for human resources (updated 20 May 2026) and its recruitment guide.

How long to keep a CV: the CNIL's periods

The GDPR only says that data is kept no longer than necessary. The CNIL, in France, turns this into three uses of a candidate file, each with its period: the live recruitment, the talent pool for future contact, and the evidence archive in case of a dispute. They are recommendations, except the evidence archive, which comes from the French Labour Code.

Sources (in French): the CNIL's retention guidelines for human resources, which explicitly cover the CV databases of recruitment agencies, and the CNIL's recruitment guide.

Consent or legitimate interest

To keep a rejected candidate in a talent pool, the CNIL recommends asking for their consent. It also accepts the recruiter's legitimate interest, on one condition: the candidate is expressly informed and can object easily, without having to give a reason. In both cases, the period stays capped at 2 years after the last contact.

When the period ends, you can renew it: ask the candidate whether they agree to you keeping their profile, for 2 more years at most. Without an answer, the file leaves the pool. In practice, count from the last exchange with the candidate (a call, an interview, a reply to a message), not from the last time someone opened their profile.

The evidence archive is not a talent pool

The French 5-year period exists so you can defend yourself if a candidate challenges a rejection. Those files leave the active database: nobody searches them, nobody contacts them. Keeping them in the pool on the grounds of evidence amounts to keeping for 5 years what the CNIL caps at 2.

What to tell candidates, and when

The GDPR requires you to tell every candidate what you do with their data, at a time that depends on where it came from. An application sent by the person falls under Article 13: the information comes before or at the time of collection. A profile found elsewhere falls under Article 14: you inform them one month later at the latest.

Both articles are in the text of the GDPR on EUR-Lex (Chapter III, rights of the data subject).

Direct applications (Article 13)

A candidate who applies on your careers site or answers a job ad must find the information before sending their file. The CNIL accepts a two-level approach: the essentials next to the form or the ad, with a link to the full policy, then the detail in the acknowledgement of the application.

Sourced candidates (Article 14)

A headhunter who saves a LinkedIn profile into their talent pool must inform that person: it is the example the CNIL gives in its guide. The information goes out within a reasonable period, one month after saving at the latest, or in the first message if you contact them earlier.

The CNIL makes an exception for simple viewing: browsing hundreds of profiles without saving them does not require informing each person, provided you publish your privacy notice, for instance on your page on the network. As soon as the profile enters your database, the exception no longer applies.

What the information contains

The list comes from Articles 13 and 14 of the GDPR. An agency writes it once and reuses it in every message:

1. Who processes the data: the agency's name and how to reach its data contact or DPO.
2. Why, and on what legal basis: recruiting for a position, or keeping the profile for future openings.
3. Who receives it: for an agency, the clients the profile is presented to.
4. How long it is kept.
5. Their rights (access, rectification, erasure, objection) and the right to complain to a data protection authority.
6. For a sourced profile, the source of the data (the network, the CV database) and its categories.
7. Any automated screening that can decide for them.

Candidates' rights: access, erasure, objection

A candidate can ask for a copy of their data (Article 15), its correction (Article 16), its erasure (Article 17), or object to being kept in a talent pool based on legitimate interest (Article 21). You answer within one month, extendable by two months for a complex request if you tell them (Article 12).

Access covers the whole file, not only the CV: interview notes, write-ups, exchanges with your clients about them. A note you would not dare show the candidate should not be written.

Erasure has a limit: Article 17 lets you keep what is needed to establish, exercise or defend legal claims. That is the basis of the evidence archive. The rest goes: the profile, the notes and the documents.

Objection must be easy. For a talent pool based on legitimate interest, the candidate does not have to explain why they no longer want to hear about openings.

Automated screening and Article 22: a person decides

Article 22 of the GDPR prohibits, in principle, a decision based solely on automated processing when it significantly affects the person. Removing a candidate from a recruitment process is such a decision, according to the CNIL. The exceptions (contract, law, explicit consent) are narrow; those based on contract and consent give the candidate the right to human intervention.

The CNIL guide distinguishes two cases. A tool that ranks hundreds of applications while the recruiter only reads the first ones can amount to an automated decision: the others are rejected by the software alone. A tool that helps the recruiter rate and comment on a profile, when the recruiter decides, is not one.

In practice: a person reads the profiles a tool places at the bottom of the list, and every rejection is explained by the requirements of the job. For AI tools, the EU AI Act adds its own obligations, set out in our article on the AI Act and recruitment.

In Marvin

Marvin helps you apply these rules day to day, from the retention period to informing candidates. It does not set your policy for you and does not replace your DPO's advice: the settings below apply the choices you have made.

• A retention period you set. An administrator chooses the period without activity after which a candidate reaches the end of retention (24 months by default, adjustable from 6 to 120 months) and sees the affected profiles before switching it on.
• Candidates are asked before they leave your pool. When the period ends, they receive an email asking whether they agree to you keeping their profile. They answer from a link, without an account: their consent is recorded on the profile, and a refusal is applied. A profile linked to an active process, an assignment or an invoice is never removed by this setting.
• Sourced profiles are informed. Once retention is switched on, profiles saved afterwards without an application receive an information email with a button to object.
• A consent checkbox on the application form. You write the checkbox on your careers site and can make it mandatory; the footer links to your privacy policy.
• The history of each profile keeps the team's actions, with their author and time: useful when answering an access request.

Data is hosted in France, with Scaleway in Paris. The data processing agreement (DPA, GDPR Article 28) and the list of sub-processors, AI providers included, are part of the Trust Pack. Details are on our security and Trust Pack page, and our AI commitments on the responsible AI page.

Five steps for a compliant talent pool

Do them once, then keep them up. Each matches a rule quoted above and can be shown on paper if a candidate or a regulator asks. To choose the tool that supports them, see our checklist for compliant recruitment software.

1. Write the privacy notice once, in two levels, and place it on the careers site, in the acknowledgement and in the first message to sourced profiles.
2. Set the talent pool period (2 years after the last contact in France, unless you document a reason) and configure it in your tool.
3. Separate the evidence archive from the pool: archived files never come up in a search.
4. Name who answers candidate requests, with the one-month deadline in mind.
5. Keep a person in screening: review the profiles a tool sets aside, and be able to explain every rejection.

FAQ