A Slack Thread on Compliance and Recruitment Data

It started as a casual discussion in our Slack channel: “How long are we supposed to keep CVs?” A simple question, but it opened a Pandora's box of concerns around compliance, candidate trust, and operational efficiency. As a team focused on recruitment technology, the implications of GDPR were becoming increasingly clear, and we knew we had to address this head-on.

The Context: Compliance Matters

With the advent of GDPR, companies handling personal data faced strict regulations on how long they could retain that data. Recruitment teams, in particular, felt the pressure. We were not just storing resumes; we were safeguarding sensitive personal information that, if mishandled, could lead to hefty fines and damage to our reputation. The stakes were high, and we needed a clear strategy that aligned with both legal requirements and our operational goals.

The Problem: Vagueness in Retention Policies

Initially, our retention policies were vague. We kept CVs for an undefined period, resulting in a growing database filled with outdated applications. For example, one candidate applied in 2018 for a data analyst position, but we still had their CV in our system, despite having filled the role years ago. This not only cluttered our database but also posed risks regarding compliance, as we weren’t sure if we were still allowed to hold on to that data.

What We Tried First: A Lengthy Retention Period

Our first instinct was to set a lengthy retention period of five years, believing this would cover most scenarios. After all, we wanted to maintain a talent pool for future openings. However, after discussing with our legal team, we realized this approach was flawed. It failed to consider the principle of data minimization under GDPR, which emphasizes that data should only be retained for as long as necessary for its intended purpose.

The Technical Approach: Defining Clear Retention Windows

We revised our strategy to define clear retention windows based on the type of data and the candidate's engagement. We implemented a data retention policy that outlines:

• Active Applications: CVs for candidates actively interviewed will be stored for up to 12 months.
• Talent Pools: For candidates in our talent pool who have given explicit consent, we retain their CVs for up to 24 months.
• Inactive Applications: CVs of candidates not selected will be deleted after 6 months.

This structure allowed us to comply with GDPR while still enabling us to connect with potential candidates.

const retentionPolicy = {
  activeApplications: '12 months',
  talentPools: '24 months',
  inactiveApplications: '6 months'
};

Changes in the Product: Cleaner Data Management

After implementing this new retention strategy, we observed significant improvements in our database management. The internal team was able to streamline candidate searches, reducing clutter and increasing efficiency. For our users on the /jobs page, this meant a more relevant candidate experience, as they were only engaging with candidates who were interested and available. Furthermore, our compliance audit process became more straightforward, leading to enhanced trust from our users on /for-companies.

What We Learned: Key Takeaways

• Data Minimization is Crucial: Keeping only necessary data aligns with GDPR and simplifies management.
• Clear Policies Aid Compliance: Defining precise retention periods helps mitigate risks.
• User Trust is Paramount: Transparent policies foster better relationships with candidates.
• Review Regularly: As regulations evolve, so should our policies. Regular reviews are essential.

Candidate Perspective: Understanding Data Retention

As a candidate, knowing how long your CV will be retained is crucial for privacy and trust. With our new policies, candidates can feel secure knowing their information is only kept as long as necessary and with their consent, especially for those in our talent pools. They can also request deletion of their data at any time, ensuring they have control over their personal information.

Recruiter Perspective: Streamlined Processes

For recruiters, the new retention strategy means less time spent sifting through outdated applications and more focus on engaging with qualified candidates. Clarity in data management fosters a more efficient recruitment process, enabling recruiters to fill roles faster while staying compliant with GDPR regulations.

Next Steps: Remaining Vigilant

While we’ve made significant strides, there are still areas to address. We need to monitor the effectiveness of our retention policy and gather feedback from users on /for-candidates to ensure it meets their needs. Additionally, we are watching for any changes in GDPR regulations that might necessitate further adjustments. If we had to start over, we would engage legal counsel earlier in the process to avoid initial missteps.