HR

Candidate files after rejection or end of placement

3 December 2025 · 6 min read · DeSnipperaar

A staffing agency processes hundreds to thousands of candidate files per year. Far from everyone ends up in a placement. What do you do with the CV, the assessment report, the cover letter, the copy-ID and the screening document for someone you do not place or whose placement ends? The GDPR sets out a clear framework, but its application in practice is often messy.

This article explains how long you may keep what, when consent extends the period, and how to build destruction into the branch routine.

The four-week guideline

The Autoriteit Persoonsgegevens uses a guideline that application data of rejected candidates should be destroyed within four weeks of the close of the procedure. This is not a hard statutory period but a fleshing-out of the storage limitation principle (GDPR art. 5(1)(e)). Four weeks gives a rejected candidate room to object to the decision or to ask for feedback.

For a staffing agency "end of procedure" is not always sharp. At an agency that keeps people in a pool for later proactive outreach, "end" is only the moment you decide to remove the candidate from your pool or when the candidate withdraws.

Extension with consent up to a year

If you want to keep a candidate longer for potential future vacancies, you must request unambiguous consent. Valid consent:

• Is freely given, specific, informed and unambiguous.
• Can be withdrawn at any time with the same ease as it was given.
• Is evidenced in your records (who, when, via which channel).

Common practice is a retention period of up to one year with consent. After that, ask again whether the candidate wishes to remain in the pool. See also our GDPR retention periods cheatsheet for other document types.

What belongs in the candidate file?

A complete candidate file at a staffing agency often contains:

• CV and cover letter.
• Application form with personal details.
• Copy-ID (if already requested for screening or placement).
• Test results: language skills, numeracy, personality, Cito variants, psychological report.
• Certificate of good conduct (VOG).
• Reference notes and interview notes.
• Correspondence by email or post.

For each of these items, the four-week rule applies on rejection, or the longer period with consent.

End of placement for placed candidates

For candidates who were placed and are no longer actively assigned, different periods apply. Employment contracts, payroll statements and hours records fall under the seven-year tax retention obligation. Copy-ID goes after two years following departure. The candidate portion (assessment, test scores, intake notes) that does not fall under payroll administration should be destroyed at the end of the employment relationship, unless you can justify another reason for keeping it.

You are not a museum. Keep only what you need for a concrete purpose and review each year whether that purpose still exists.

Test results and assessment reports

Assessment reports often contain behavioural information, cognitive scores and sometimes psychological interpretations. Such information does not fall under GDPR special categories but is sensitive and requires extra care. Limit access within your organisation, do not keep longer than needed, and destroy at the end of the purpose in a certifiable way.

Screening and VOG

The VOG is issued publicly by Justis and does not contain criminal data as such, but it does contain personal information. Keep the VOG as long as the candidate is active and destroy it on departure together with the copy-ID. If you work for clients in healthcare or education and periodic rescreening is required, work with expiry dates in your HR system.

Digital destruction is also destruction

The GDPR makes no distinction between paper and digital for the duty to destroy. If a CV sits in your recruitment platform, in your email archive and on the recruiter's laptop, you destroy it in all three places. This requires clear procedures and, for smaller agencies, an annual clean-up.

On-site paper destruction at the branch

For practical reasons many agencies still keep a paper shadow archive, especially for signatures, printed ID copies and old screening documents. For that stream, on-site destruction is a calm solution: once a quarter or once a year the shredder truck visits your branch, paper goes through the cutting heads on the spot to DIN 66399 P-5, the certificate follows immediately. No boxes travelling between locations, no transport risk.

Process in three steps

1. Separate on intake: which documents relate to the procedure, which to placement, which to payroll.
2. Set a destruction rhythm per stream (procedure: monthly, placement: annually, payroll: per term).
3. Document in your records of processing who destroys what when, and keep certificates as evidence.

Work at a staffing agency and want a practical clean-up check? See our page for staffing agencies and payroll.