Data retention policy on CharityJob Recruiter

You can set a data retention policy for your organisation, so that candidate application data is automatically removed after a set period. This helps you meet your obligations as a data controller under GDPR, without needing to manually delete applications.

A data retention policy controls how long candidate applications remain visible and accessible in your hiring pipeline. Once the retention period ends, applications are automatically anonymised and removed. This includes any notes, evaluations, CVs and personal data attached to them.

This applies to applications associated with expired job ads (both paid and volunteer roles).

Only the organisation owner can enable, edit or disable the data retention policy. It will not be visible to admins or members.

Step 1 - Go to Settings

Navigate to Settings > Data retention policy in your organisation account.
​
​

Step 2 - Enable the policy

Toggle on Application retention setting. You'll see the default retention period is set to 12 months after a job has expired.

Step 3 - Set your retention period (optional)

If 12 months doesn't work for your organisation, you can change this to a different number of months. You can choose from three, six, nine, 12 or 18 months.

Step 4 - Confirm and save

You'll be asked to confirm you want to enable this feature via a pop-up window before saving. Once confirmed, a notification will appear to confirm the policy has been saved.

It applies to existing applications too. When you enable a retention policy, it backdates to any applications that have already met the retention threshold. For example, if you set a 12-month policy and have applications from a job that expired 14 months ago, those will be queued for removal.

There is a seven-day delay before it activates. After you save the policy, it won't take effect for seven days. This gives you time to review before any data is removed.

You'll receive a confirmation email. An email will be sent to you, as the owner, confirming the policy has been enabled, including the retention period you've set. You will receive an email notice seven days before the policy activates, followed by a reminder 24 hours before. After this time has elapsed, your data retention policy will become active.

How do you decide the length of your data retention policy?
​
GDPR doesn’t dictate a set period to keep personal data. You should make the decision based on your purposes for processing and you should document your reasons in writing.

The options available are:

Three months - Candidates have a three-month window to make any employment tribunal discrimination claims, so this is the bare minimum amount of time their data should be retained.

Six months - Employment tribunal claims can be extended beyond the initial three-month period, so most legal guidance recommends this as the minimum retention timeframe.

Nine months - A safe, middle ground between six and 12 months.

12 months - This is the most recommended period, as it should cover any extended tribunal claims.

18 months - This provides a buffer for late tribunal claims but is the most cautious option and is more appropriate for higher-level or higher-risk roles.

When a job ad expires and the retention period is reached, applications associated with that job will be automatically removed from the ATS. This includes:

· The applications themselves (both active and unsuitable),

· Notes and evaluations,

· CV contents and filenames,

· Any other personal data attached to the application.

You'll see a notice on the hiring pipeline and on the expired job in your ads list, confirming that the retention policy has been applied to that job.

You can update or turn off your retention policy at any time from Settings > Data retention policy.

To change your retention period, first you'll need to disable your current policy and then set up a new one. Go to Settings > Data retention policy, turn off the toggle and click on ‘save changes’ to deactivate the policy. Then re-enable it, select your new retention period and click on ‘save changes’.

If you disable the policy entirely, no further automatic data removals will take place. Any data that has already been removed will not be restored.

You'll receive a confirmation email when you deactivate your policy, and another when you enable the new one.