How long may I retain application and personnel data?

Retention period follows from the purpose, not from a fixed list

How long recruitment or personnel data may be retained depends on the purpose for which it was collected — there is no fixed period that applies to every situation. For recruitment data, that purpose is the recruitment process itself: once it is concluded, whether with an appointment or a rejection, the reason to retain that candidate's data ceases. Retention then remains possible only as long as there is another, concrete purpose for it, for example because the candidate has indicated they wish to remain on the candidate list for a future vacancy.

For personnel data, it is different, because the purpose — the employment relationship — continues as long as the employment contract runs. Data necessary to conduct that relationship may therefore be retained as long as the relationship exists. After the end of employment, that purpose ceases for part of the data, but not for all of it: other legislation outside the GDPR may impose its own retention obligation on certain parts of the personnel file, independent of what the GDPR itself requires. Which data precisely and how long that obligation runs is not set out in the GDPR but in that other legislation.

This follows from the principle of storage limitation

This approach stems from Article 5 of the GDPR, where the principle of storage limitation is established: personal data must not be kept longer than necessary for the purposes for which it was collected. That principle applies directly and equally in every Member State, because the GDPR is a regulation. What differs is who oversees it: in the Netherlands that is the Dutch Authority for Data Protection, as also follows from the Implementation Act General Regulation on Data Protection, while in Germany the supervisory authority of the state where the establishment is located is competent.