Now considering the implications of the new GDPR this response from a well known recruiting agency could hardly be called compliant could it ? surely the default position would be to delete the CV if unsuccessful.

If your application is unsuccessful, we will keep your personal data for up to 6 months from the date we notify you of our decision. (Note, we may keep your personal data for longer than 6 months if you have asked us to consider you for future vacancies – see ‘Will we keep your application on file?’ below). There may, however, be circumstances in which it is appropriate for us to keep particular items of your personal data for longer. We will base these decisions on relevant circumstances, taking into account the following criteria:

· the amount, nature, and sensitivity of the personal data

I believe if they have an ongoing reason for keeping your data that is acceptable, you can obviously request it is destroyed, but that won't get you an option for another job.

Think about it this way. You are second choice of candidate, the primary for whatever reason does not remain, so you would be the next in line, that could be a few months down the line. Would you prefer that they immediately destroyed your data or wait for a while?

Thread moved to the appropriate forum.

Andy

Yes, it's compliant. One of the reasons for keeping information is "legal reasons". Were you to make a claim, for example, of discrimination, you would normally need to do so within three months. Sometimes that deadline can be extended, but it is exceptional to go over six months. So keeping information that could be subject to legal action will be compliant. Effectively, if they haven't heard from you/ your lawyer / ACAS by then, they won't!