TL;DR
Data on rejected applicants is deleted within four weeks of the end of the procedure. With active consent this may extend to one year. The period covers the whole file: CV, cover letter, interview notes, assessment results and the email exchange. For those who are hired a different regime begins, and there the copy of the identity document has its own period of five years from the end of the calendar year in which employment ended.
Four weeks, and everything that falls under it
The Dutch supervisory authority works on a maximum of four weeks after the application procedure closes. It is the shortest period any European authority applies on this point, and it is not optional: when a rejected candidate complains, it is the first thing checked, because it can be established without any investigation at all.
What usually goes wrong is not the period but its scope. It covers all the data from the procedure: the CV, the covering letter, the interview notes, the outcome of an assessment and the correspondence with the candidate. An organisation that removes the CV from the system and leaves the interview notes in a shared folder has not complied — and those notes are often the most sensitive documents in the whole file.
The talent pool is a second processing operation
Keeping a candidate for future vacancies is possible for up to one year, but only where the candidate has given active consent. Active means asked and answered. A pre-ticked box at the foot of the application form is not consent, and a candidate who never responded to the request is not in the talent pool but in a database without a basis.
The pool is also a different processing operation from the recruitment itself: different purpose, different basis, different period. Putting it in the same line of the record makes the four weeks disappear without anyone having decided to make them disappear.
- The period runs from the END OF THE PROCEDURE, not from the rejection of the individual candidate: a selection that drags on for two months keeps the first rejected applicants in the file for all that time.
- For those who are hired the documents pass into the personnel file, but not all of them: what was lawfully collected during selection and is not needed for the employment relationship should be sorted out and not carried over.
- The copy of the identity document, by contrast, must be kept for at least five years after the end of the calendar year in which employment ended. It is the only part of the file with a longer period of its own than the rest.
- Copying an identity document by a party that is NOT the employer — a recruitment agency during the search phase, for instance — is a different matter and is generally not permitted.
The personnel file is not a single block
Putting one retention period on the whole file is always wrong, and wrong in two directions at once. Payroll administration must be kept seven years under Art. 52 of the Dutch tax code. The identity document copy five years from the end of the year employment ended. For the rest the authority points to two years after departure as a guideline. Seven years on everything keeps the appraisal record five years too long; two years on everything destroys payroll data five years too early.
The practical consequence for the record of processing activities: there is no such row as “personnel file”. There are three rows, with three periods and three legal bases, and merging them produces a record that looks complete and is two thirds wrong.
Looking for a workspace for your DPO work?
DPO Workspace is built by a certified DPO. 30-day free trial.
Start free
