Few processing activities raise as many doubts in Human Resources as the management of candidate CVs. How long can they be kept? What happens to those who were not selected? Is the consent appearing at the bottom of the application form valid? Can CVs be shared across group companies?
The selection process is a personal data processing with its own profile. Anyone sending a CV is not a client, not an employee and does not quite fit any of the usual categories. This guide organises the applicable criteria under the GDPR (Regulation (EU) 2016/679), the LOPDGDD (Spain's Organic Law 3/2018) and the Spanish Workers' Statute.
The candidate as data subject: what data is processed and for what purpose
When a person sends a CV, several possible processing purposes begin and they should be kept separate from the outset:
| Purpose | Typical data | Legal basis |
|---|---|---|
| Selection for the vacancy | Identifiers, education, experience, contact, salary expectation. | Pre-contractual measures (6(1)(b)) |
| Talent pool / future vacancies | Full CV and retained professional profile. | Express consent (6(1)(a)) |
| Reference checks | Contact with professional references provided. | Informed candidate consent |
| Technical tests and interviews | Test results, internal interviewer notes. | Pre-contractual measures (6(1)(b)) |
| Offer communication and follow-up | Contact details of the shortlisted candidate. | Pre-contractual measures (6(1)(b)) |
Retention: a reasonable period and the storage-limitation principle
Spanish law does not set a closed period for keeping the CV of an unsuccessful candidate. What does exist is the storage-limitation principle (art. 5(1)(e) GDPR): data cannot be kept longer than necessary for the purposes for which it was collected.
Applied to recruitment, the consolidated practical rule is:
- During the active process: the CV is kept until the selection closes.
- After closing, without additional consent: the CV must be erased or anonymised within a short period, unless there is a specific reason to keep it (ongoing litigation about the process itself, for instance).
- With the candidate's express consent for future vacancies: the CV may be kept in a talent pool for a reasonable, proportionate period. Standard accepted practice is one to two years, communicated to the candidate in the information notice.
- Once the period expires: effective erasure or, if the company wishes, refresh consent by emailing the candidate to ask whether they wish to remain in the pool.
Keeping CVs "just in case" for five or ten years, or indefinitely, is not compatible with minimisation or storage limitation. The AEPD has sanctioned this pattern on several occasions.
Clear information: the art. 13 GDPR notice applied to the CV
Information must be delivered to the candidate at first contact: the website application form, the candidate portal, the automated email when an unsolicited CV is received. The notice must contain:
- Identity of the controller (the employer, with contact details).
- Contact details of the Data Protection Officer where there is one.
- Specific purposes set out separately: selection for this vacancy; where applicable, retention for future vacancies; where applicable, reference checks.
- Legal basis for each purpose (pre-contractual measures for the current selection; express consent for future vacancies).
- Recipients or categories of recipients: external payroll provider if involved, ATS or recruitment software, where applicable headhunters or partner consultancies.
- International transfers if the recruitment tool operates outside the EEA.
- Retention period: during the process and, if consent is given, during the talent-pool period (1 or 2 years are common).
- Candidate rights and how to exercise them.
- Right to lodge a complaint with the AEPD.
Separate consent for future vacancies: how to capture it well
The most common mistake in recruitment forms is a single tick-box stating "I have read and accept the privacy policy". That is not consent to keep the CV in a talent pool: it is information read.
For consent for future vacancies to be valid (freely given, specific, informed and unambiguous, art. 4(11) GDPR), the form needs:
- A separate tick-box, unticked by default, with text: "I consent to my data being kept for [period, e.g. 24 months] so I can be considered in future selection processes of the company."
- Not conditioned on continuing with the application (the candidate can apply for the role and decline to enter the pool).
- Easily withdrawable: a clear link or channel to withdraw at any time.
- The company must be able to demonstrate that consent was given (record of the moment, IP address, version of the wording accepted).
"A candidate's CV is not a permanent corporate asset. It is data provided for a specific decision. When that decision ends, the data should end too, unless the candidate has expressly and consciously decided otherwise."
Mario P. Talamillo · Managing Partner, Certix®
Common situations and how to handle them
Unsolicited CV received by email
If the company has no open process and receives an unsolicited CV, the processing still begins. Good practice: an automated reply delivering the information notice, asking whether the candidate wishes to be added to the talent pool and stating the retention period.
CV forwarded by an employee
Where an employee forwards an acquaintance's CV to the recruitment team, the candidate has had no direct contact with the company. The company must contact the candidate and deliver the information notice before further processing.
Headhunters and external consultancies
The headhunter usually acts as independent controller of its own talent base, but when it receives a specific mandate from a client company and forwards specific CVs, the client company becomes controller of that data from receipt. Each party must inform the candidate at its respective stage. The contract between headhunter and client company should clarify the role.
ATS and recruitment software
When the company uses an Applicant Tracking System (Workday, BambooHR, Personio, Factorial, Recruitee, Greenhouse or others), that provider is a processor and requires an art. 28 GDPR contract with verification of international transfers if servers sit outside the EEA.
Transfer to group companies
Sharing CVs across group companies is not automatic. Each legal entity is an independent controller. The transfer requires its own legal basis and must be declared in the notice. If one group company processes data on behalf of another, an art. 28 GDPR contract is signed.
Technical tests and interview notes
Test results and notes taken by the interviewer are part of the selection file and are processed under the same basis (pre-contractual measures). Subjective notes require special care: the candidate may exercise the right of access and the company must be ready to deliver that information or justify any applicable restrictions.
Sensitive data and CVs: what should not be asked
The minimisation principle (art. 5(1)(c) GDPR) prevents asking the candidate for data that is not strictly necessary to assess the role. By default, in a recruitment process do NOT ask for:
- Marital status, family responsibilities or relationship situation.
- Health data, unless the role has legally established physical requirements and the assessment falls to the occupational health service, not the recruitment team.
- Religion, ideology, trade union or political affiliation.
- Sexual orientation or gender identity.
- Criminal record, unless required by law for the role (for example, work with minors, art. 13.5 LOPI).
- Personal financial data of the candidate (debts, attachments, scoring) unless specifically justified.
If the CV submitted by the candidate voluntarily contains any such data, the company must refrain from using it in the decision and, where appropriate, anonymise it in the file.
Effective erasure at closing: how it is done
Erasing CVs is not "delete the email and forget". It requires a technical procedure that reaches:
- The inbox of those involved in the selection.
- Network folders and shared drives where the CV was stored.
- The ATS or recruitment software (configuring automated retention policies).
- Copies sent to managers, selection committees or other areas.
- Paper notes or physical notebooks, which must be securely destroyed.
The professional company documents the erasure procedure, sets owners and periodically checks that the policy is applied, especially when closing each selection process.
Minimum HR checklist for recruitment processes
- Application form with a visible art. 13 GDPR information notice.
- Separate tick-box, unticked by default, for consent to future vacancies.
- Internal periods policy: during the process, after closing without consent, in the pool with consent.
- Documented, operational erasure procedure.
- Art. 28 GDPR contract with the ATS and other recruitment providers.
- Verification of international transfers (Data Privacy Framework where applicable).
- Procedure for handling candidate rights (access, erasure, objection).
- Training for the recruitment team on prohibited data in questions and notes.
- Periodic review of the talent pool: clean-up at the end of the period.
Frequently asked questions
How long can a company keep the CV of an unsuccessful candidate?
No closed legal period. Reasonable practice is 1 or 2 years with the candidate's express, duly informed consent for future vacancies. Without consent, the CV should be erased shortly after the process closes. Indefinite retention is not compatible with the minimisation principle.
What legal basis applies to processing a candidate's CV?
Pre-contractual measures (art. 6(1)(b) GDPR) for the specific process. Express consent (art. 6(1)(a) GDPR) to keep the CV with a view to future vacancies. The two purposes must be kept separate in the notice and in the form.
Can I share CVs across group companies or with other consultancies?
Not automatically. Each group company is an independent controller. The transfer requires its own legal basis and an express statement in the notice. With headhunters and external consultancies an art. 28 GDPR contract is signed where they act on behalf of the company.
What rights does the candidate have over their CV and how must they be handled?
Access, rectification, erasure, objection, portability where applicable and complaint to the AEPD. The company has one month to respond, extendable by two further months in justified complex cases. The channel must be accessible and stated in the information notice.
This content is for general information purposes only and does not constitute specialist legal advice. The application of the rules to each specific case requires individual analysis. Spanish regional sector-specific rules may extend or modify timeframes and requirements.
Want to put candidate management and the talent pool in order under the GDPR?
At Certix we assign you a data protection expert for HR. No commercial intermediaries, no generic templates.
Talk to an expert