How Long Can You Keep Applicant Data Under GDPR? DE, AT, FR and UK Side by Side

GDPR does not give you a number of months. It gives you a principle, storage limitation in Article 5(1)(e), and leaves the number to whatever purpose justifies keeping the data. For rejected applicants that purpose is defending a discrimination claim, so the retention period is the claim window in your country plus a buffer: around six months in Germany, seven months in Austria, up to two years for a French talent pool next to a five-year claim-defence archive, and the employment tribunal claim period in the UK. Keeping anyone longer needs a separate basis, in practice consent for a talent pool.

I run ScalingPPL, a recruitment agency, and I built Pickr, an applicant tracking system with EU hosting in Frankfurt, so I have to answer this question for my own candidate database. This is not legal advice. What follows is the statute or regulator statement behind each figure, with the link, for whoever carries your data protection responsibility.

What does GDPR itself say about how long you can keep applicant data?

Three articles do the work. Article 5(1)(e): personal data is "kept in a form which permits identification of data subjects for no longer than is necessary for the purposes for which the personal data are processed" (GDPR Article 5). Article 13(2)(a): you tell the candidate at collection "the period for which the personal data will be stored" or "the criteria used to determine that period" (Article 13). Article 17(1)(a): a right to erasure once the data "are no longer necessary in relation to the purposes for which they were collected", with the Article 17(3)(e) exception "for the establishment, exercise or defence of legal claims" (Article 17).

That exception is the whole story. Once you have rejected someone, the remaining purpose is defending a possible discrimination claim, so the retention period is the national claim window, and national law is where the numbers come from.

How long can you keep applicant data in Germany?

Six months after the rejection, built from two statutes. § 15 Abs. 4 AGG: a compensation claim "muss innerhalb einer Frist von zwei Monaten schriftlich geltend gemacht werden", counted for applications from receipt of the rejection (§ 15 AGG, gesetze-im-internet.de). § 61b Abs. 1 ArbGG: the lawsuit "muss innerhalb von drei Monaten, nachdem der Anspruch schriftlich geltend gemacht worden ist, erhoben werden" (§ 61b ArbGG). Two months to assert, three to sue, one for post and processing. The Dr. Datenschutz article of 14 March 2023 puts it at "bis zu sechs Monate nach Abschluss des Bewerbungsverfahrens" and adds a corollary: a rejected applicant who asks for deletion within the two months without asserting a claim is deleted before the six months are up, because no lawsuit under § 61b ArbGG can follow (dr-datenschutz.de).

The two months and the three months are law. The six-month total is practitioner practice built from those two deadlines; you will not find it in the AGG. The basis for processing applicant data at all is § 26 Abs. 1 BDSG, with § 26 Abs. 8 counting applicants as employees (§ 26 BDSG).

How long can you keep applicant data in Austria?

Austria has a regulator decision rather than a rule of thumb. On 27 August 2018 the Datenschutzbehörde (DSB) dismissed a rejected applicant's erasure complaint against a personnel services company. It held that six months under § 29 Abs. 1 GlBG plus one month for a possible lawsuit, "sohin sieben Monate ab Bewerbungseingang", is "angemessen und nicht unverhältnismäßig lange", and that further storage was necessary under Article 17(3)(e) GDPR (DSB-D123.085/0003-DSB/2018, RIS).

Two details matter. The DSB counted from receipt of the application, although the GlBG deadline runs from the rejection: § 15 GlBG says claims "sind binnen sechs Monaten gerichtlich geltend zu machen" and the period "beginnt mit der Ablehnung der Bewerbung" (§ 15 GlBG, RIS). Counting from the rejection is the more conservative reading. And the decision is from 2018; it is still the figure practitioners cite (the German article above reports the DSB "hält eine Aufbewahrungsfrist von sieben Monaten für vertretbar"), but check for a newer decision before writing it into a policy.

How long can you keep applicant data in France?

France is where "two years" and "five years" both appear, and they answer different questions. The CNIL's retention reference for HR data (référentiel, published 2 April 2026, updated 20 May 2026, recruitment rows dated 29 January 2026) splits applicant data into three rows (CNIL référentiel, PDF):

• During the process: "le temps de la procédure de recrutement jusqu'au résultat de la candidature".
• Claim defence for rejected candidates: "à des fins probatoires, pour les éventuelles actions en discrimination : 5 ans à compter de la date à laquelle le poste a été pourvu", for intermediaries and employers alike, marked as an obligation under Article L.1134-5 of the Code du travail. A restricted-access archive, not a live record.
• Talent pool (CV-thèque, "vivier de candidats"): "jusqu'à 2 ans à compter du dernier contact avec le candidat non retenu", only for candidates whose profile interests the employer and who have not objected or who have consented, marked as a recommendation.

The CNIL's Q and A for candidates says the same in plain words: if informed and in agreement, "le dossier pourra être conservé 2 ans après votre dernier contact avec le recruteur, ou plus longtemps si vous avez donné votre accord formel" (CNIL direct). A French agency therefore runs a two-year live pool and a five-year locked archive, on separate clocks.

How long can you keep applicant data in the UK?

No fixed period either, and the closest guidance is a draft. The ICO's "Keeping recruitment records" page says "Our consultation on this draft guidance is now closed" and "The final version will be published in due course", and that it is under review because of the Data (Use and Access) Act (ICO, keeping recruitment records). Its position: the law "does not specify timescales for keeping recruitment records", and its example restaurant with 50 applications "should not keep recruitment records for unsuccessful candidates beyond the statutory period in which an applicant can bring a claim", absent a clear business reason. Agencies in Great Britain also have record duties under the Employment Agencies Act 1973.

The statutory period is section 123 of the Equality Act 2010. As enacted it was "the period of 3 months starting with the date of the act to which the complaint relates" (s.123 as enacted). The current text reads "the period of 6 months", substituted with effect from 1 October 2026 by the Employment Rights Act 2025 per the amendment note (s.123, current version). Either way the tribunal can allow "such other period as the employment tribunal thinks just and equitable", which is why UK policies add a buffer. Behind all of this sits the ICO's rule that "You must not keep personal data for longer than you need it" and that "The UK GDPR does not set specific time limits for different types of data", so you set them in a retention schedule (ICO, storage limitation).

The four countries side by side

All figures as of 2026-10-14. "Rejected, no consent" means someone you turned down who never agreed to a talent pool.

Country	Rejected, no consent	Clock starts	Built from	Status	Source
Germany	About 6 months	Receipt of the rejection	2 months (§ 15 Abs. 4 AGG) + 3 months (§ 61b Abs. 1 ArbGG) + 1 month buffer	Deadlines are statute; the total is practice	dr-datenschutz.de
Austria	7 months	Receipt of the application (DSB); § 15 GlBG counts from the rejection	6 months (§ 29 Abs. 1, § 15 GlBG) + 1 month	Regulator decision, 27 August 2018, final	DSB decision, RIS
France	Until the result; then 5 years in a restricted archive	Date the post was filled	Article L.1134-5 Code du travail	Obligation per the CNIL	CNIL référentiel
France, talent pool	Up to 2 years	Last contact	Informed, no objection or consent	CNIL recommendation, rows dated 29 January 2026	CNIL référentiel
UK	Statutory claim period plus your buffer	Date of the act complained of	Equality Act 2010 s.123: 3 months as enacted, 6 months from 1 October 2026	ICO guidance is draft and under review	ICO draft

The pattern is the same in every row: a claim window set by employment or equality law, a buffer for the court process, a hard stop. GDPR adds that you write the period down, tell the candidate and actually delete.

When does the clock start?

This is where most retention policies are vague. The sources disagree on the trigger, and the trigger moves the deletion date by months:

• Germany counts from receipt of the rejection letter. A candidate you never formally rejected has no clock running at all, one more argument for sending the rejection.
• Austria's DSB counted from receipt of the application, which can be earlier than the rejection by the whole length of the process. Counting from the rejection is the safer reading.
• France counts the pool from the last contact, so every email to a pooled candidate restarts the two years, and counts the claim-defence archive from the date the post was filled.
• The UK counts from the act complained of, and "conduct extending over a period is to be treated as done at the end of the period" (s.123(3)(a)).

Whatever you choose has to be the trigger your ATS records. If the system timestamps the stage move to "Rejected" but your policy says "from the date the post was filled", nobody can compute the deletion date, and the deletion does not happen.

Can you keep candidates in a talent pool for longer?

Yes, with a separate basis, and the sources say so in their own words. Dr. Datenschutz: a talent pool needs "auf informierter Basis abgegebene Einwilligungen der Betroffenen". The CNIL: two years from last contact, "sauf opposition de leur part ou pour ceux qui y ont consenti", longer only with formal agreement. The ICO draft's examples: a law firm that tells candidates on the application form it will keep the top ten scorers for six months, and a portal that deletes everyone "unless they explicitly consent by opt-in".

Three things follow. The consent has to be informed, naming the purpose, the period and the right to withdraw, and under Article 7(3) "It shall be as easy to withdraw as to give consent" (Article 7). It has to be evidenced: date, wording version and channel, not a checkbox state. And the pool has its own clock and deletion date, separate from the claim window. The companion piece on how to build a talent pool covers the recruiting side; the compliance side is those two dates.

From our work at ScalingPPL, the pool is where retention goes wrong far more often than the active pipeline. The pipeline ends when the role closes. The pool has no end unless you give it one, and "we might place them one day" is not a purpose any regulator above accepts without consent.

What should the deletion workflow in your ATS look like?

No law names a feature. Article 5(1)(e) and Article 17 name an outcome: the data is gone when no longer necessary, and you can show it. The buyer's checklist for GDPR-compliant recruiting software asks the vendor questions; this is your side, whichever ATS you use.

1. One period per country, written down. Germany 6 months, Austria 7, France 2 years pool and 5 years archive, UK statutory period plus your buffer. Put them in the retention schedule and in the candidate privacy notice, because Article 13(2)(a) requires the period or the criteria at collection. "As long as necessary" is the principle, not the period.
2. One trigger per period, stored as a field. Rejection date, application date, last contact, post-filled date. If the ATS only stores "stage changed to Rejected", that is your trigger, and the policy should say so.
3. Consent as data, not a checkbox. A talent-pool flag with timestamp, wording version and channel, filterable, so you can list everyone held under consent and everyone held under the claim window.
4. Deletion that is deletion. Notes, emails, attachments, interview transcripts and search indexes go too. Archiving or hiding the row is not Article 17.
5. A monthly review and a log. Automated or manual, the output is a list of what was deleted and when. That log is what a client's procurement team asks for before a renewal.
6. An early-exit path. A German candidate who asks for erasure inside the two-month window without asserting a claim is deleted early, per the Dr. Datenschutz reading of § 61b ArbGG, without waiting for the scheduled run.

In Pickr the pieces that live in the product are what you would expect from an ATS with a live pipeline per client: the career page application form shows your own consent text and records it with each candidate, candidates manage their consent on their own candidate portal page, and the product comes with EU hosting in Frankfurt and a data processing agreement included. The periods, the trigger and the review cadence are yours to decide, because they depend on the country of the role. The wider obligations for an agency are in what GDPR requires from a recruitment agency.

Sources

• § 15 AGG, Entschädigung und Schadensersatz, gesetze-im-internet.de: https://www.gesetze-im-internet.de/agg/__15.html (accessed 2026-10-14)
• § 61b ArbGG, Klage wegen Benachteiligung, gesetze-im-internet.de: https://www.gesetze-im-internet.de/arbgg/__61b.html (accessed 2026-10-14)
• § 26 BDSG, Datenverarbeitung für Zwecke des Beschäftigungsverhältnisses, gesetze-im-internet.de: https://www.gesetze-im-internet.de/bdsg_2018/__26.html (accessed 2026-10-14)
• Dr. Datenschutz, "Aufbewahrungsfrist: Wann sind Bewerbungen zu löschen?", 14 March 2023: https://www.dr-datenschutz.de/die-aufbewahrungsfristen-von-bewerberdaten/ (accessed 2026-10-14)
• Datenschutzbehörde (Austria), decision DSB-D123.085/0003-DSB/2018 of 27 August 2018, RIS: https://www.ris.bka.gv.at/Dokumente/Dsk/DSBT_20180827_DSB_D123_085_0003_DSB_2018_00/DSBT_20180827_DSB_D123_085_0003_DSB_2018_00.html (accessed 2026-10-14)
• § 15 GlBG, Fristen für die Geltendmachung von Ansprüchen, RIS: https://www.ris.bka.gv.at/NormDokument.wxe?Abfrage=Bundesnormen&Gesetzesnummer=20003395&Paragraf=15 (accessed 2026-10-14)
• CNIL, Référentiel "Les durées de conservation des données à caractère personnel, Gestion des ressources humaines", published 2 April 2026, updated 20 May 2026: https://www.cnil.fr/sites/default/files/2026-04/referentiel_durees_de_conservation_gestion_des_ressources_humaines.pdf (accessed 2026-10-14)
• CNIL direct, "Recrutement : un employeur peut-il conserver mon dossier ?": https://www.cnil.fr/fr/cnil-direct/question/recrutement-un-employeur-peut-il-conserver-mon-dossier (accessed 2026-10-14)
• ICO, "Keeping recruitment records" (draft guidance, consultation closed, under review): https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/employment/recruitment-and-selection/keeping-recruitment-records/ (accessed 2026-10-14)
• ICO, "Storage limitation", guide to the data protection principles: https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/data-protection-principles/a-guide-to-the-data-protection-principles/storage-limitation/ (accessed 2026-10-14)
• Equality Act 2010, section 123, current version (changes in force on or before 14 October 2026), legislation.gov.uk: https://www.legislation.gov.uk/ukpga/2010/15/section/123 (accessed 2026-10-14)
• Equality Act 2010, section 123, as enacted, legislation.gov.uk: https://www.legislation.gov.uk/ukpga/2010/15/section/123/enacted (accessed 2026-10-14)
• GDPR Article 5, gdpr-info.eu: https://gdpr-info.eu/art-5-gdpr/ (accessed 2026-10-14)
• GDPR Article 7, gdpr-info.eu: https://gdpr-info.eu/art-7-gdpr/ (accessed 2026-10-14)
• GDPR Article 13, gdpr-info.eu: https://gdpr-info.eu/art-13-gdpr/ (accessed 2026-10-14)
• GDPR Article 17, gdpr-info.eu: https://gdpr-info.eu/art-17-gdpr/ (accessed 2026-10-14)