Research question
How much candidate information should a recruiting operation collect and retain when it needs enough evidence to run hiring decisions, satisfy applicable recordkeeping duties, and avoid accumulating uncontrolled copies?
No single federal source supplies a universal candidate-record deletion period for every employer and jurisdiction. This review therefore combines the NIST Privacy Framework, NIST security and privacy controls, the EEOC's recordkeeping overview, and Federal Trade Commission guidance for protecting personal information. The result is an operating model, not legal advice or a prescribed retention schedule.
Begin with purpose, not storage capacity
Recruiting systems can collect resumes, contact details, interview notes, assessment results, source information, demographic records, accommodation communications, background-check documents, and onboarding handoffs. The fact that a system can store a field does not establish a reason to collect it.
Data minimization begins by naming the purpose of each item. A phone number may support candidate communication. A scorecard may document an approved selection procedure. A voluntary demographic response may support required reporting or analysis under restricted access. These purposes differ, so the records should not automatically share access rules or retention logic.
The NIST Privacy Framework organizes privacy risk management around identifying, governing, controlling, communicating, and protecting data processing. It does not impose a recruiting-specific checklist. Its value is the sequence: understand the processing before choosing controls. A team cannot reliably delete or restrict information that it has never inventoried.
Map the record across the hiring flow
Candidate data often spreads during ordinary work. A resume moves from an applicant tracking system to email. Interview notes appear in personal documents. A scheduling tool retains contact details. An assessment platform stores scores. A new-hire handoff creates another profile.
An inventory should identify the authoritative system, copies, owner, purpose, access group, trigger for retention, and final disposition. It should include integrations and exports, not just the applicant tracking system. A duplicate is still candidate data even when it lives in a spreadsheet created for convenience.
| Record class | Recruiting purpose | Governance question |
|---|---|---|
| Application and resume | Evaluate qualifications and maintain process history | Which version is authoritative? |
| Interview scorecard | Record job-related evidence | Who can edit after submission? |
| Scheduling data | Coordinate candidate and interviewer availability | Does it need to remain after the event? |
| Voluntary demographic data | Authorized reporting or monitoring | Is access separated from decision makers? |
| Accommodation communication | Run an authorized accommodation process | Is it isolated from routine selection notes? |
| Background report | Complete an approved check and required notices | Who may view or retain the report? |
This map also clarifies service-provider boundaries. A recruiting operations partner may need access to source queues and scheduling records, but not every record used by HR, counsel, or a background-reporting process. Least access should follow the assigned work.
Retention has more than one clock
The EEOC explains that covered employers must keep certain personnel or employment records for specified periods, with different requirements in some circumstances. Other federal, state, local, contractual, and litigation-related rules may apply. A deletion policy that ignores those obligations is not minimization; it is incomplete governance.
At the same time, indefinite retention is not a neutral default. The FTC's guide for protecting personal information advises businesses to take stock, scale down, lock information, dispose of what is no longer needed, and plan ahead. Holding unnecessary data increases the material that must be secured and reviewed.
A schedule should identify the event that starts each retention period. Possible triggers include application closure, final disposition, report receipt, offer acceptance, or employment termination. The correct trigger depends on the record and applicable requirement. Legal holds and active disputes need a controlled exception that pauses normal disposal without rewriting the base schedule.
Separate decision evidence from incidental notes
Interviewers sometimes record appearance, family references, health information volunteered in conversation, or impressions unrelated to the approved criteria. Retaining more prose does not create better evidence. The scorecard should prompt for job-related observations and discourage unrelated detail.
This is both an editorial and system-design problem. Anchored fields can guide interviewers toward the evidence the decision needs. Free-text areas should have a stated purpose and access boundary. Training should explain that notes may become part of an employment record and must not become a private channel for unapproved criteria.
Demographic and accommodation information need particular care. The recruiting workflow should route those records to authorized owners and keep them out of ordinary decision views where appropriate. Operations staff should follow the approved route rather than interpreting sensitive information themselves.
Disposal must reach the copies
Deleting an applicant profile while leaving exports, inbox attachments, and vendor copies does not complete the disposition. NIST SP 800-53 includes controls concerned with data minimization, retention, disposal, access enforcement, and audit. Organizations select controls based on their context; the publication is not a claim that every recruiting system must implement every control.
A practical disposal record should show the rule applied, affected systems, exception status, date, and accountable owner. Automated deletion can reduce manual work, but only after the organization tests its scope and exception handling. A system error that erases active records is not a privacy success.
Access reviews belong beside retention. A record that must be kept does not need to be visible to every recruiter for the entire period. Role changes, completed requisitions, and ended vendor assignments should remove access promptly under the organization's policy.
Data Sources and Methodology
We used NIST sources to identify risk-management and control concepts, the EEOC page to establish that employment recordkeeping duties can constrain deletion, and the FTC guide to frame collection, security, and disposal as a connected lifecycle. We then applied those concepts to common recruiting record classes. We also checked the NIST Privacy Framework quick-start guides, the FTC guidance on disposing of consumer report information, the FTC data security guide, the EEOC page on applicant demographic information, and the federal personnel-record regulation.
We did not determine a retention period for any employer, evaluate a specific applicant tracking system, or analyze international privacy law. We also did not claim that NIST frameworks create legal duties for all private employers. The proposed inventory fields are an analytical model.
Limitations
The correct schedule varies with employer coverage, record type, jurisdiction, contracts, pending matters, and internal policy. Public guidance can change, and specialized records may fall under requirements not discussed here. Employers should obtain qualified legal and privacy advice before adopting or changing a schedule.
Minimization also involves judgment. A record that appears unnecessary to one team may support an authorized audit or defense. That is why purposes and owners need approval. Recruiting operations can maintain the inventory and execute approved dispositions, but it should not decide legal holds or erase records outside policy.
Evidence-led conclusion
The sound question is not how long to keep "candidate data" as one category. It is which record supports which purpose, where copies exist, who needs access, what event starts the applicable clock, and what disposition is authorized. An inventory linked to a retention schedule gives recruiting teams enough structure to reduce uncontrolled data without discarding required hiring evidence.
Sources
- NIST Privacy Framework, National Institute of Standards and Technology.
- NIST Privacy Framework 1.0, National Institute of Standards and Technology.
- Security and Privacy Controls for Information Systems and Organizations, NIST Special Publication 800-53 Revision 5.
- Recordkeeping Requirements, U.S. Equal Employment Opportunity Commission.
- Protecting Personal Information: A Guide for Business, Federal Trade Commission.