For application data from candidates who were not hired, there is no fixed retention period in the GDPR itself. The regulation only prescribes the principle of storage limitation: you may not retain data longer than necessary for the purpose for which you collected it. The Dutch Data Protection Authority specifies this for recruitment and selection practice with a guideline of four weeks after completion of the procedure, with the possibility to extend this to a maximum of one year if the candidate consents to this.
In practice, this means you delete the CV, cover letter, interview records and any test results of a rejected candidate within those four weeks as standard, unless you have explicitly and separately requested consent to retain the data longer, for example for a next vacancy.
Why this period is not in the law itself
The GDPR does not specify a concrete number of weeks or months for most types of data. The legislator chose an open standard: do not retain longer than necessary, and if you can no longer justify the purpose, the data must be deleted or anonymised. For specific situations, such as application procedures, supervisory authorities have therefore published practical guidelines that recommend a concrete period. This is not a legal obligation in the sense of an article with a number in it, but it is the standard by which the Dutch Data Protection Authority tests whether a retention period is reasonable.
This distinction is important for how you document it internally: you cannot refer to 'the statutory four-week period', because that is not stated as such in the GDPR. You can refer to the supervisory authority's guideline and explain why you use that period as a starting point.
Consent for a longer period
If you want to retain a candidate's CV longer, for example because the profiles match well and a similar vacancy may open soon, explicit consent from the candidate is the common route. You request that consent separately, away from the application itself, and the candidate must be able to withdraw it just as easily as give it. Without that consent, there is no legal basis for retaining data from a rejected candidate longer, and this also applies when you simply leave the data in a drawer or digital folder 'for later'.
It is advisable to link the consent request to a concrete period, for example one year, rather than an open end. A candidate who gives consent then knows when their data will automatically disappear.
What you document about this
This retention period should not only be in your head, but also in your processing register: which application data you process, for what purpose, how long you retain it and on the basis of which legal basis any extension takes place. This also makes it easier for you to delete data structurally rather than leaving data lying around 'because there was no reason yet to remove it'. In the knowledge base on retention periods per type of data you will find, in addition to application data, the periods that apply to other personnel files and administrative data.
It is wise not to separate this arrangement from the rest of your HR processes. Whoever manages the application procedure is usually also the person who must ensure that CVs of rejected candidates actually disappear from email boxes, shared folders and the ATS system, not just from the first system someone thinks of.
Other personnel data follow different periods
The deadline for application data from rejected candidates is separate from the retention periods that apply once someone is actually hired. Employee salary data, contracts and tax documents fall under different rules, often with a statutory retention obligation under tax legislation rather than the GDPR. Anyone wanting to see these side by side will find in the frequently asked questions about personnel data an overview of the most common situations.
Whether a specific retention deadline applies in your situation, which consent text you should use best and how you secure this internally, is ultimately something you should discuss with a lawyer or, if you have doubts about how the law applies, with the Dutch Data Protection Authority. What we offer is structure: a place where this deadline automatically runs in your register, instead of you having to keep track of it yourself. More on how the link between register and deadline works can be read via the explanation of how the system works.
If you want to know whether your current way of retaining application data aligns with how other SMBs handle this, take the free quick-scan or browse through the topics in the knowledge base. Both can be consulted without an account and will give you a first picture of where you stand in just a few minutes.