Published October 22, 2026.
Most recruiting agencies have a retention policy somewhere. It may be a paragraph in an employee handbook, a clause in a client contract, or a sentence in a privacy notice. The operational problem is that the policy rarely maps to the places where candidate data actually lives: the ATS, shared drives, recruiter inboxes, sourcing tools, spreadsheets, and personal notes.
A retention schedule is useful only when it names the record type, the system of record, the retention period, the owner, and the disposal method. This guide describes how to build that map without pretending to give legal advice.
Table of contents
- Inventory the records before setting periods
- Separate the legal basis from the business preference
- Assign a system of record for each category
- Write retention rules that an operator can apply
- Limit access during the retention period
- Dispose of records with evidence
- Handle candidate requests and disputes
- Review the schedule annually
- Sources
Inventory the records before setting periods
Start with what exists, not with what should exist. Walk through a candidate's lifecycle and list every place data is created or copied:
- sourcing profile and outreach messages
- application and resume
- screening notes and interview scorecards
- assessment or work sample
- reference check notes
- offer and contract documents
- identity and work authorization documents
- background check results
- email and calendar threads
- spreadsheets used for tracking or reporting
- chat messages with client or candidate details
For each, record the system, the owner, who can access it, and whether it is a copy of another record. Copies are the main reason retention fails. A candidate record is deleted from the ATS while the resume remains in a recruiter's downloads folder.
Separate the legal basis from the business preference
Retention periods come from several sources, and they do not all say the same thing:
- employment record requirements, such as the EEOC's recordkeeping guidance in the United States
- tax, payroll, and contract requirements
- client contract terms
- privacy-law obligations in the candidate's jurisdiction
- the agency's own business need, such as reconsidering a candidate for a future role
The longest applicable requirement does not automatically apply to every record. A payroll record and a sourcing profile have different purposes. Write the basis next to each period so a reviewer can see why it exists.
Where the legal position is unclear, get advice from the agency's counsel rather than inventing a number. This article does not provide legal advice and cannot substitute for jurisdiction-specific review.
Assign a system of record for each category
A single authoritative location reduces duplicates. For each category, name:
| Category | System of record | Owner | Access |
|---|---|---|---|
| Candidate profile and resume | ATS | Recruiting operations | Recruiters, compliance |
| Screening and interview notes | ATS | Recruiter | Hiring team |
| Offer documents | HR or contract system | HR operations | HR, recruiter |
| Identity documents | Compliance system | Compliance | Compliance only |
| Background check | Approved vendor portal | Compliance | Compliance |
| Client submissions | ATS or client portal | Account owner | Recruiter, client |
| Email threads | Mail system | Individual | Individual, with retention rule |
If a category has two systems of record, pick one. The other becomes a copy with its own deletion rule. Do not leave the choice to whoever happens to use the tool.
Write retention rules that an operator can apply
A rule should be executable without a legal interpretation. For example:
- Delete unsuccessful candidate sourcing profiles 24 months after the last activity unless the candidate has asked to be considered for future roles or a client contract requires longer retention.
- Retain hiring records for the period required by applicable law and the client contract, whichever is longer, then dispose of them on the schedule.
- Delete interview notes from personal devices within 30 days of uploading them to the ATS.
- Remove temporary tracking spreadsheets within 30 days of the requisition close.
These are examples of form, not recommendations for a specific period. The agency should set its own periods with counsel and document the rationale.
Limit access during the retention period
Retention is not only about deletion. It is also about who can see the record while it exists. Apply least privilege:
- recruiters see the candidates on their requisitions
- compliance sees identity and background records
- finance sees payment data
- client users see only submitted candidates
- former employees lose access on their last day
Review access when someone changes roles. A coordinator who moves to a different team should not keep access to the old client's candidate files.
The NIST Privacy Framework provides a useful structure for identifying, governing, controlling, and communicating data handling; it is a risk-management framework, not a retention statute.
Dispose of records with evidence
Deletion should produce a record: what was deleted, from which system, when, by whom, and under which rule. For physical documents, use the approved shredding method. For electronic records, follow the system's deletion process and confirm that backups expire on the documented schedule.
The FTC's guidance on disposing of consumer report information is a useful reference for the principle that disposal must be effective, not merely nominal. Deleting a file from a shared folder while a copy remains in a sync service is not disposal.
Do not delete records that are subject to a legal hold, an open dispute, or a pending investigation. Route those to the owner who can confirm the hold.
Handle candidate requests and disputes
Candidates may ask what data the agency holds, request correction, or ask for deletion. These requests need a documented process:
- Log the request and the date.
- Verify the requester's identity using the approved method.
- Identify the records and any legal or contractual retention obligation.
- Respond within the required window.
- Record the outcome and any records that could not be deleted.
Do not let a deletion request erase a record that must be retained for a legal or contractual reason. Explain the retention basis if the applicable law requires it.
Review the schedule annually
Retention rules age. Laws change, client contracts renew, and systems are replaced. Review the schedule once a year and after any material change:
- new ATS or sourcing tool
- new jurisdiction or client
- new type of candidate document
- a data incident or complaint
- a change in the agency's privacy notice
Record the review date, the reviewer, and the changes. A schedule that is never reviewed is a document, not a control.
Sources
Frequently Asked Questions
How long should we keep candidate resumes?
There is no single universal period. The answer depends on jurisdiction, the purpose of the record, client contracts, and the agency's policy. Document the basis and apply it consistently.
Can we keep a candidate in the database for future roles?
Only if the candidate has been informed and the agency has a lawful basis to do so, and only for as long as the policy allows. A sourcing profile is still personal data.
What should happen to records when a client contract ends?
Follow the contract's data-return and deletion clauses, the agency's retention schedule, and applicable law. Record what was returned, deleted, or retained, and why.