Compliance & Blind Hiring

ICO Guidance on CV Data Retention for UK Recruitment

Understand the ICO rules on how long UK recruitment agencies can keep candidate CVs and handle data retention policies. Get the guide.

By Xabi Errotabehere, founder, Distill · Updated 18 July 2026

Recruitment agencies routinely collect and store candidate CVs. But how long can you keep them under UK data protection law? Understanding the Information Commissioner's Office (ICO) guidance on CV data retention is essential to reduce compliance risks and avoid unnecessary liability. This article breaks down what the ICO actually says about retaining candidate data, including dealing with right-to-erasure requests and writing practical retention policies.

What the ICO actually says (plain English)

The ICO expects recruitment agencies to hold personal data, including CVs, only as long as necessary for the purpose collected. For recruitment, that typically means keeping CVs while actively considering candidates or for a reasonable period afterwards to handle potential disputes or future opportunities.

The key points from the ICO's recruitment guidance are:

  • Personal data should be deleted or anonymised once it is no longer needed.
  • Retaining CVs indefinitely "just in case" isn't compliant.
  • Agencies should have a clear, documented retention policy explaining how long they keep CVs and why.
  • Candidates should be informed upfront about retention periods in privacy notices.
  • The lawful basis for holding CVs usually relies on consent or legitimate interests, but the retention period must reflect that legal basis.
  • The ICO highlights that retention periods may vary depending on whether the candidate was successful, unsuccessful, or if the agency intends to keep CVs for future vacancies.

The ICO doesn't specify exact time frames but urges agencies to justify their retention periods based on operational needs and legal requirements.

The 6-year myth — and what the correct period is

A common misconception is that recruitment agencies must keep CVs for six years to comply with employment law or in case of legal claims. This "6-year rule" often comes from the limitation period for contract claims under the Limitation Act 1980.

The ICO makes clear that six years isn't a retention requirement for CVs. Holding personal data for six years without a clear reason is likely excessive under UK GDPR principles.

The correct approach is:

  • Keep CVs for as long as necessary to process the application and any recruitment-related queries.
  • If the candidate is hired, retain their personnel records according to employment law (which may include longer periods).
  • If the candidate is unsuccessful, keep their CV only as long as you have a legitimate business reason, such as considering them for future roles or defending discrimination claims.
  • Typically, agencies keep unsuccessful candidate CVs for 6 to 12 months. Some may extend this to 2 years if they want to consider candidates for future roles, but this must be justified.
  • After this period, CVs should be deleted or anonymised.

Holding CVs for six years "just in case" of future claims isn't supported by the ICO and risks breaching data minimisation requirements.

Right-to-erasure requests: your obligations

Under the UK GDPR, candidates have the right to request deletion of their personal data, including CVs, in certain circumstances. This is known as the right to erasure or "right to be forgotten."

Your obligations here include:

  • Assess whether the retention of the CV is still necessary for the original purpose.
  • If there's no overriding lawful reason to keep the CV (such as a legal claim or ongoing recruitment process), you should delete it promptly.
  • Inform the candidate if you can't comply with their request because of a legal obligation or legitimate interest.
  • Document all erasure requests and your responses for accountability.
  • Update your privacy notice to explain candidates' rights clearly.

Note that the right to erasure isn't absolute. For example, you may refuse if you need to retain data for compliance with employment law or to defend legal claims.

How to write a candidate data retention policy

A clear retention policy is essential to demonstrate compliance and guide your team. It should be practical and reflect your agency's processes.

Key elements to include:

  • Purpose: State why you collect and retain CVs (e.g., recruitment, future vacancies, legal defence).
  • Retention periods: Specify how long you keep CVs for different categories (successful candidates, unsuccessful candidates, speculative applications).
  • Legal basis: Identify your lawful basis for processing (typically legitimate interests or consent).
  • Right to erasure: Outline how candidates can request deletion and how you'll respond.
  • Review process: Explain how often you review stored CVs and delete those no longer needed.
  • Data minimisation: Confirm you only keep the minimum data necessary.
  • Responsibility: Assign who in your team manages retention and deletion.

Your policy should be easy to understand and available to candidates on request or via your privacy notice.

Operationalising it: tools and processes

Implementing your retention policy requires consistent processes and, ideally, automation to reduce human error.

Consider the following:

  • Use your applicant tracking system (ATS) to set automatic deletion or archiving rules based on retention periods.
  • Schedule regular audits to review CV storage and compliance.
  • Train recruiters and administrators on the importance of timely deletion.
  • Document all retention and deletion actions for audit trails.
  • When deleting, ensure secure methods are used to avoid data recovery.
  • If you send CVs externally, include retention expectations in contracts with clients and partners.
  • Use tools like Distill to automate stripping personal identifiers and enforce anonymisation before sharing candidate CVs externally.

Operational discipline reduces the risk of over-retention and data breaches.

FAQ

How long can we keep CVs under UK GDPR?

There is no fixed period. Typically, 6 to 12 months for unsuccessful candidates is reasonable, up to 2 years if justified for future vacancies. Successful candidates' data is retained according to employment law.

Can we keep CVs indefinitely if candidates consent?

Consent must be specific and revocable. Even with consent, you must review retention regularly and delete data no longer needed.

What if a candidate asks us to delete their CV?

You should delete it promptly unless you have a lawful reason to retain it, such as ongoing recruitment or legal claims.

Do we need to inform candidates about retention periods?

Yes. Your privacy notice should clearly state how long you keep CVs and candidates' rights.

What if we share CVs with clients?

You should ensure clients agree to the same retention standards and inform candidates about this sharing.

For more on CV compliance and fair hiring practices, see our GDPR CV compliance guide for recruiters and UK Equality Act blind hiring guidance.

If your agency regularly sends 20+ CVs a week to clients, Distill helps you stay compliant by stripping names, emails, phone numbers, photos, and graduation years before submission — reducing personal data risks and simplifying retention management. Try Distill free to see how it fits your process.