How long to keep CVs of unsuccessful candidates after October 2026

UK law does not say how long to keep CVs of unsuccessful candidates: the ICO says you must not keep them longer than you need, and should not normally keep them beyond the period in which a candidate could bring a claim about the recruitment. For decisions made on or after 1 October 2026 that window can run to about ten months, so a retention period of 12 months from the rejection is the safer default.

That second figure is new. Until this autumn most employment tribunal claims had a three-month time limit, and a six-month retention period left room to spare. The limit has now doubled, so a policy written before the change can delete the records you would need to answer a claim that is still in time.

What the ICO says about keeping recruitment records

The ICO's guidance on keeping recruitment records starts from one principle. You must not keep information for longer than you need to, and the law "does not specify timescales for keeping recruitment records". You choose the period, set it clearly and write it down.

Its worked example is a restaurant that receives 50 applications for one vacancy. Unless there is a clear business reason, the restaurant should not keep records for unsuccessful candidates beyond the statutory period in which an applicant can bring a claim arising from the recruitment process.

The same page warns against deleting too early. If you destroy records too quickly, it may be harder to prove that your process was transparent, fair and accountable, particularly as candidates may make a subject access request for their information. In another ICO example, an airport sets its periods after weighing requests from candidates, its own appeal process and the chance of legal proceedings.

Why six months stopped being enough on 1 October 2026

GOV.UK's employment tribunals guide now lists two time limits for most claims: 6 months if the problem happened on or after 1 October 2026, and 3 months if it happened before. For a discrimination claim the period begins on the date of the most recent incident in the claim. For an applicant turned down at the CV stage, that will usually be the rejection.

Two more rules stretch the window. A claimant must contact Acas before going to a tribunal, and GOV.UK says the time limit is put on hold while Acas helps. Acas says early conciliation can last up to 12 weeks, and that someone who notified Acas within their time limit will have at least 1 month from the date of the certificate to make a claim. Bevan Brittan's note on the change puts the possible gap between the act complained about and the claim at 10 months.

A worked timeline

Say you reject a candidate on Monday 2 November 2026. These dates are approximate and are not legal advice, but they show how far the window now reaches:

• The six-month limit runs to early May 2027.
• If the candidate contacts Acas near the end of that period and conciliation runs its full 12 weeks, the certificate arrives around the end of July 2027.
• With at least a month after the certificate, a claim could still arrive towards the end of August 2027.

A six-month policy would have deleted that candidate's CV, your scores and your notes in May. A 12-month period counted from the rejection keeps them until November 2027 and then removes them, with a margin of about two months. If a claim is threatened, keep everything relating to it until it is settled. For anything longer, take legal advice: the ICO notes that some statutory limitation periods run to a number of years, while also saying that the possibility of a claim does not mean you have to keep records indefinitely.

Keep less, for the full period

The ICO says you are unlikely to need all the information you hold to defend a possible claim, and that you must be able to justify why you keep each item. For a small employer, that splits a vacancy file into parts:

• CVs and application forms from unsuccessful candidates. Keep them for the claim window, then delete them.
• The shortlisting record: the criteria, the weights, each candidate's scores and the reason for each decision. Keep it for the same period, because it is what shows the process was consistent.
• Interview notes. Same period. Acas says any recordings or notes made in interviews must be stored securely and confidentially, on its page about interviewing job applicants.
• Equality monitoring forms. Acas says these must be kept separate from the application form and CV, in its guidance on following discrimination law. If you only need the numbers, the ICO says to anonymise them, since fully anonymised records fall outside data protection rules.
• Emails about candidates in personal inboxes. These are easy to miss when the vacancy file is deleted, so move anything that matters into the file and delete the rest.

Talent pools need their own permission

Keeping a strong runner-up for the next vacancy is a new purpose, and the ICO is specific about what that takes. You need to review whether a different lawful basis applies, you must have told candidates beforehand that you will keep their information for that purpose, and you must destroy what you do not need.

Its example is a law firm that tells applicants on the application form that it will keep the recruitment information of its top 10 scoring candidates for six months, in case more vacancies open in that time. That period runs separately from the claim window. Tell pooled candidates how long they will be kept, and take them out when the time is up.

What to keep about the person you hire

The successful candidate's file follows a different rule. The ICO says you must carefully select the information you need for the employment relationship, and securely destroy anything that is no longer relevant now the candidate is an employee. Decide which parts of their application belong on the personnel file, and let the scoring sheets that compare them with other applicants follow the vacancy file's deletion date.

Write the schedule down

The ICO asks you to establish and document standard retention periods for the different categories of information you hold, where you can. One page is enough for a small business. For each line, record:

1. The category, for example CVs of unsuccessful candidates.
2. The period and the event it counts from, such as 12 months from the rejection.
3. A one-line reason, such as covering the six-month tribunal limit plus early conciliation for decisions on or after 1 October 2026.
4. Who deletes it, and how you check that it was done.

Put the same period in the privacy information candidates see when they apply. The ICO's 2024 audits of AI recruitment tools found some that kept candidate data indefinitely, and it recommended that all candidates receive transparent privacy information including a clear retention period, according to its November 2024 announcement. Recruitment agencies have further duties under the Employment Agencies Act 1973, which the ICO mentions on its records page.

For the reply to send a candidate who asks why they were turned down, see our guide to feedback for unsuccessful candidates at the CV stage. If software reads the CVs for you, our post on AI CV screening compliance covers what UK data protection rules expect of it.

How HireSieve handles retention

HireSieve is Braivex's CV screening tool, and a 12-month period is built into it. Records, CV files, the candidate registry and the event log are covered by one retention sweep, twelve months after screening. For a CV-stage rejection, screening and the decision are usually days apart. The sweep runs as a dry run first, listing what it would remove, and it deletes only when someone tells it to.

What it keeps for those twelve months is what a claim or a subject access request would ask for: the rubric written from your job advert, each candidate's score, and the line of the CV behind every criterion. The same CV and rubric give the same score on every run, so the number you show a year later is the number you acted on. Draft paperwork ships with the product, including a DPIA, a record of processing and a candidate privacy notice, with [CONFIRM] markers where only you can supply the fact.

The Trial plan covers 5 screenings with no card, and Starter is $19 a month for 100 screenings. Start free on HireSieve with your next vacancy, and write "12 months from rejection" into your retention schedule before the first CV arrives.