Quick answer: Under GDPR and RODO there is no single legal number of months printed for every CV. Article 5 says keep data only as long as needed for the purpose. For unsuccessful applicants, I recommend at most 6 months after the process ends for small teams. That is my opinion for how we run hiring, not “the law.” Poland’s courts may allow longer storage for claim defence. Talent pool storage is a different clock and needs consent.
This post is educational. It is not legal advice. Talk to counsel for your country and your case.
What do GDPR and RODO actually require on retention?
They require purpose first, then a justified period, then deletion when that purpose ends.
Article 5 GDPR sets storage limitation: keep personal data in identifiable form no longer than necessary for the purposes of processing. You document the period and you can show why it fits. The UK ICO storage limitation guide says the same idea in plain English: do not keep unsuccessful recruitment records longer than you need for the claim window unless you have a clear business reason.
RODO is simply the Polish name for GDPR (Regulation (EU) 2016/679). Same regulation. Polish employers also follow Labour Code rules for hired employee files.
ByteLaw’s note on the informational duty is practical here: say how long you will process candidate data, with a concrete term or clear criteria, in the job ad or the online application form.
Why are there two clocks for job applications?
Because claim defence and talent pooling are different purposes with different lawful bases.
| Purpose | Typical basis | What you may do | Clock |
|---|---|---|---|
| Closed vacancy, possible discrimination defence | Often legitimate interest (Art. 6(1)(f)) | Store limited records for defence; do not reuse them to pitch new jobs | Poland: NSA 2024 may allow storage up to about the limitation period (often discussed as up to ~3 years). UK practice often sits in months. My small team preference: at most 6 months. |
| Talent pool for future roles | Consent (Art. 6(1)(a)) | Contact for new roles only if they consented | Period stated in the consent text. Nosowski (ByteLaw adjacent) often treats future recruitment consent as usually no longer than about one year. |
| Live application for one job | Steps toward a contract / legal duties as applicable | Run that vacancy | Until that process ends, then switch purpose or delete |
Michał Nosowski on Wśród Danych still starts from a strict default: delete unsuccessful candidates promptly after the process ends, then discusses the NSA path for defence retention, and keeps talent pool on separate consent.
The NSA judgment of 20 Feb 2024 (III OSK 2700/22) is the Polish landmark people cite for defence retention of unsuccessful applicants. Reporting in Gazeta Prawna explains that employers may store (not freely reuse) that data for potential discrimination claims for up to about three years. May is the key word. It is not a soft duty to keep every CV for three years. I still prefer ≤6 months for small teams when we have no live dispute.
What schedule do I recommend for a small employer?
A short written schedule you can put in your privacy notice.
| Record type | My suggested range for small teams | Notes |
|---|---|---|
| Unsuccessful applicant (this vacancy) | At most 6 months after the process ends | Our opinion. Delete or anonymise earlier if you do not need the defence window. PL law may allow longer for defence only. |
| Talent pool | Only with consent at apply; period as stated (often months, often ≤1 year in practice) | No consent means not in the pool. |
| Hired employee file (Poland) | Employment plus 10 years after for post 2019 hires (typical statutory path) | Follow gov.pl / Labour Code rules for your cohort. |
| Vacancy deleted in Canvider | Purge related data after 30 days | Product rule. |
| Discover People sourced previews in Canvider | About 48 hours | Product rule. |
If you hire across the UK and Poland, write both clocks into the notice. Do not pretend one number covers every purpose.
When you later migrate tools, retention still travels with you. See how to switch ATS without losing candidate data for what exports cleanly and what does not. GDPR sits beside AI screening rules too; we cover that in EU AI Act and AI hiring tools.
What does Canvider do with candidate retention?
We keep the two clocks separate in product behaviour.
- Without future opportunities consent at apply, the person is not kept in Talent Pool. That does not mean we auto delete the application.
- Delete Candidate is the full wipe.
- A vacancy marked Deleted purges related data after 30 days.
- Discover People sourced previews last about 48 hours.
- A customer asked us not to insert data into non GDPR services. Canvider does not send candidate data to non GDPR services.
If you want a short checklist: write periods in the ad or form (ByteLaw’s point), separate talent pool consent from the application itself, delete from email and shared drives too, and get local counsel when a claim appears.
Shorter retention with clear purposes builds candidate trust. It also keeps your hiring stack honest.
Frequently asked questions
How long should I keep unsuccessful job applications under GDPR?
GDPR does not print one fixed number of months. Article 5 says keep personal data only as long as needed for the purpose. For small teams, my practical recommendation is at most 6 months after the recruitment process ends for unsuccessful applicants, then delete or anonymise unless a live dispute needs longer. This is not legal advice.
Is RODO different from GDPR for candidate CVs?
No. RODO is the Polish name for the same EU GDPR rules. Polish employers also follow Labour Code rules, and Polish case law (NSA 2024) may allow longer storage of unsuccessful applicant data purely to defend discrimination claims, often discussed up to about 3 years. I still prefer a shorter 6 month schedule for small teams when the purpose allows it.
Can I keep rejected candidates in a talent pool without consent?
No. A talent pool for future jobs needs separate consent under Article 6(1)(a). Keeping records to defend a closed vacancy claim is a different purpose and often rests on legitimate interest, not a free pass to email people about new roles. Mixing those two clocks is a common HR mistake.
Does Canvider auto delete applications when someone does not consent to future opportunities?
No. Without future opportunities consent at apply, the person is not kept in the Talent Pool. That is not the same as wiping the application. Full wipe is Delete Candidate. A vacancy marked Deleted purges related data after 30 days.