GDPR Data processing modelRecruitment

Organisation: PrivateFunction: Human resourcesOrganisation: Public

This processing model relates to the processing of applications and management of interviews as well as the constitution of a CV-library

Purposes (3)

A purpose is the objective pursued by the setting up of your file. It indicates what the processing of personal data will be used for, its purpose. This purpose must be clear and understandable

Recruitment litigation management

Legitimate interest

Application processing (CV and cover letter) and interview management

Contract

Pre-contractual measures

Creating a CV library

Legitimate interest

The CV is kept to remind unsuccessful candidates if a new position becomes available. The data subject has the option of objecting to the data being kept.

Data categories (2)

Personal data is any information relating to an identified or identifiable natural person. A natural person can be identified either directly (eg surname and first name) or indirectly (eg phone number, social security number, email or postal address, but also voice or image)

Application

Data needed to manage applications

Data details

Previous jobsrequired

Professional Experiencerequired

Professional skills related to the position to be filledrequired

Communication of the outcome of the applicationrequired

Telephone numberrequired

Curiculum Vitaerequired

Candidate Evaluation Gridrequired

Name and surnamerequired

Postal Addressrequired

Email addressrequired

Data conservation rules

Active base:

Data collected during the recruitment process should in principle be deleted as soon as it becomes clear that the application will not be retained by the employer or will be withdrawn by the applicant.

UK GDPR Art. 5(1)(e); Information Commission (ICO) guidance on storage limitation: unless there is a clear business reason, recruitment records of unsuccessful applicants should not be kept beyond the period in which a claim arising from the recruitment process may be brought.

Intermediate archiving:

Data may be kept in intermediate archiving until the time limit for a recruitment-related discrimination claim has passed: 6 months from the decision (Equality Act 2010, s.123, as amended with effect from 1 October 2026; previously 3 months), plus a margin for early conciliation and late notification. The controller should set the exact period (for example 9 months) and document it.

Equality Act 2010, s.123 (time limits for employment tribunal claims); UK GDPR Art. 5(1)(e).

Destruction

Resume library

Data needed to manage the CV-library

Data details

Professional Experiencerequired

Curiculum Vitaerequired

Data conservation rules

Active base:

After informing the candidate, and unless they object (or with their agreement), the application of an unsuccessful candidate may be kept for a later vacancy. No statutory period applies: the controller should set a period justified by its recruitment needs and document it. A short period, such as 6 to 12 months from the last contact, is easier to justify (the Information Commission (ICO) keeps its own talent pool for 6 months).

Intermediate archiving:

Destruction

Data subject (1)

A data subject is any person whose data is collected, retained or processed by the data processing. e.g. In a recruitement process, any candidate for a position proposed in recruitement management process

Candidates

Created at:07/08/2023

Updated on:10/05/2026

Nb using:33