In short and in plain language
This article is about applications you turn down. How long may you keep this data?
The data stays with you after a rejection. You may keep it only as long as you need it. The article explains how to set this time limit.
A careers page is a page for job seekers. It should say how long you keep their data. The note belongs right next to the form.
A list of future applicants needs its own consent. If someone asks you to delete their data, you should reply quickly. To do that, you need to know where the data is.
We build your careers page with this note.
The job ad is running, the form on the careers page works, and after four weeks there are twenty-two applications in the inbox. Two people are hired, twenty receive a rejection - and that is exactly where the part of the process begins for which, in practice, no fixed routine is laid down. At the end of 2023 there were 15,549 (Federal Statistical Office) home care services in Germany with a combined 446,425 (Federal Statistical Office) staff; over the course of a year each of them collects CVs, references, photographs and occasionally details that fall under the prohibition on processing health data. How long these documents may be kept is not stated as a number in any statute. The period follows from two provisions, a buffer and the question of which route the application took. This article works through the periods, shows the notice the careers page needs for them, and describes the procedure for an early erasure request.
Key takeaways
- Application documents are employee data: applicants are expressly regarded as employees (Federal Data Protection Act). Storage limitation therefore applies, meaning the data may be kept only as long as the purpose requires (General Data Protection Regulation).
- The standard period comes from two provisions: two months (General Act on Equal Treatment) from receipt of the rejection for asserting a claim in writing, then three months (Labour Courts Act) for filing it. Five months in total, plus a buffer.
- No statute names a deletion period for application documents: after five months both periods have expired, and a buffer for delivery and evidence is a decision of your own that needs a reason. Guidance from the supervisory authority in Baden-Württemberg dating from before the General Data Protection Regulation allows the discretion available under longer limitation periods only where a shorter period can be shown to be insufficient (State Commissioner for Data Protection Baden-Württemberg).
- The careers page has to state the retention period or the criteria used to determine it (General Data Protection Regulation) - not the legal notice, not an attachment, but the place where the application is sent.
- An erasure request generally has to be answered within one month (General Data Protection Regulation). That only works if it is known where an application sits in the organisation: database, inbox, paper file, backup.
Why a rejection does not end the processing
A care service that advertises a post processes personal data from the moment the first application arrives. The basis is the run-up to a contract: processing is permitted where it is necessary in order to take steps at the request of the data subject prior to entering into a contract (General Data Protection Regulation). The Federal Data Protection Act adds that applicants are regarded as employees (Federal Data Protection Act) - the rules for employee data therefore apply long before anyone is hired. The rejection removes the original purpose. What remains is a second, narrower purpose: defending against possible claims arising from the selection process. That purpose only carries as long as such claims can be brought at all. The question of a deletion period is therefore not a matter of feeling but an arithmetic task with two known terms.
The second particularity lies in the sector itself. Care applications regularly contain details that enjoy special protection: vaccination records, notes on physical resilience, disability certificates, copies of medical notes. Processing health data is prohibited in principle and permitted only under narrow conditions (General Data Protection Regulation). For the careers page this yields a practical rule: the form asks for none of it, and the free-text field is labelled so that nobody thinks of entering a diagnosis there. How an application form can be built with few fields is described in data-minimal forms for care services. If something is entered anyway, the same deletion period applies to it as to the rest of the application, only with tighter access on the way there.
Applicants are employees in the sense of the Act
The two periods practice is built from
The first term comes from the General Act on Equal Treatment. Anyone who considers themselves disadvantaged has to assert the compensation claim in writing within two months (General Act on Equal Treatment), unless the parties to a collective agreement have agreed otherwise, and in the case of an application that period begins when the rejection is received. What counts is therefore not the date on the rejection letter but the day it arrives - a difference of a few days that matters in a tight calculation. The amount is capped: in the event of non-recruitment, compensation may not exceed three monthly salaries (General Act on Equal Treatment) if the person would not have been recruited even if the selection had been free of discrimination. For a home care service with two vacancies that is not a theoretical sum but the reason why the documents should remain findable until the period has expired.
The second term comes from the Labour Courts Act: a claim for compensation has to be filed within three months (Labour Courts Act) after it has been asserted in writing. Two plus three gives five months from receipt of the rejection. Because days pass between sending and receipt, and because receipt has to be evidenced later, a short buffer makes sense. No statute names its length; for application documents the statute names no figure at all. Guidance from the supervisory authority in Baden-Württemberg, which still cites the Federal Data Protection Act in the version in force until 24 May 2018, points to the two-month standard period from equal treatment law for application documents (State Commissioner for Data Protection Baden-Württemberg); the provision behind it, section 15(4) of the General Act on Equal Treatment, is unchanged. Anyone going beyond the five months should have the reason noted in the deletion policy rather than looking for it in a dispute.
What arrives by which route
The period is the easy part. The harder question is where an application sits once it is to be deleted. A typical home care service receives applications through the form on the careers page, through a shared inbox, through the letterbox, through a message to the nursing manager and occasionally through a sheet somebody fills in at a training fair. Each of these routes creates its own copy, and each copy has its own lifetime: the form writes to a database and additionally sends a message to the inbox, the message then sits in the deleted items and in the backup, the paper sits in the folder. A deletion run that only clears the database has not deleted the application; it has removed it from the most visible place. The same question arises with every other form on the website, for example the sign-up for care courses for relatives: whoever accepts data has to know where it sits and when it goes.
| Route | What stays behind | Legal basis | Period and evidence |
|---|---|---|---|
| Careers page form | record, attachments, confirmation in the inbox | steps prior to a contract (General Data Protection Regulation) | deletion after two months (General Act on Equal Treatment) plus three months (Labour Courts Act) |
| Shared inbox | message, attachments, deleted items, server copy | steps prior to a contract (General Data Protection Regulation) | same period; explicitly include deleted items and archive folders |
| Paper application | folder, copies from the interview, notes | steps prior to a contract (General Data Protection Regulation) | return or destruction, with destruction documented in two lines |
| Talent pool | profile, notes, follow-up date | consent (General Data Protection Regulation) | ends with the withdrawal, which is possible at any time (General Data Protection Regulation) |
| Fair or noticeboard | handwritten sheet, photo, business card | steps prior to a contract (General Data Protection Regulation) | transfer into the regular inbox, then destroy the original |
The notice the careers page has to carry
Anyone collecting data has to provide information at the time of collection about the period for which the data will be stored or, if that is not possible, about the criteria used to determine that period (General Data Protection Regulation). Both are feasible on a careers page, and the second variant is usually the more honest one: the application is processed until the procedure is complete and then kept for the period in which claims from the selection process can be asserted. The place matters. The notice belongs at the form, not solely in the privacy statement, because in practice it is not read there at the moment of entry. Two sentences above the send button, linked to the full statement, meet the duty and, in practice, cost no applications. What else belongs in the ad, such as the salary figure, is covered in salary disclosure in care job ads.
- State the period, do not hint at it. “We keep your documents until the procedure is complete and then for five months” is a statement. “We store your data only as long as necessary” is not. Whoever names the figure has to keep to it in the deletion run - which is why it goes into the calendar before it goes onto the page.
- Offer the talent pool separately. A box that is not pre-ticked, with its own text and its own duration. Anyone who leaves it unticked still applies. Anything else turns consent into a condition, and a condition is not a free decision.
- Show the route to deletion. An address where an erasure request arrives and one sentence on how quickly it will be answered. That saves queries and is the cheapest way of meeting the period. How we build careers pages with a form, a notice and an orderly inbox is set out under careers page and recruiting.
- Match the language to the audience. Anyone addressing care workers from abroad needs the notice in the language of the ad and in simple sentences. What else to consider is covered in careers pages for international care workers.
Talent pool: consent rather than silence
Many services would like to keep good applications even when no post is free. That is permissible, but not on the same basis. Keeping documents in a talent pool rests on the data subject having given consent for one or more specific purposes (General Data Protection Regulation), and consent needs three things: clear wording, an active step and a named duration. The duration follows from the purpose of the pool and is stated in the consent text; no statute prescribes one. When it expires, nothing is extended silently; the question is asked. A short message with two options - stay or be deleted - is at once a point of contact and evidence that the pool is being maintained.
Withdrawal has to be as easy as giving consent (General Data Protection Regulation). In practice that means: whoever could join with one click may not be referred to a signed letter. A link in every message from the pool and an address on the careers page are enough. Withdrawal only takes effect for the future; what was lawfully processed beforehand does not become unlawful retrospectively. The documents still have to be deleted as soon as no other purpose carries them. Anyone running the pool as a fixed part of recruitment should also maintain it in substance; suggestions for that are set out in job ads on your own website.
Withdrawal has to be as easy as consent
When someone asks for early deletion
Independently of any period, an applicant can request that her data be erased without undue delay where one of the grounds set out in the Regulation applies (General Data Protection Regulation). The controller has to reply without undue delay and in any event within one month (General Data Protection Regulation) of receipt of the request; that period may be extended by two further months (General Data Protection Regulation) where necessary, and the extension and its reasons have to be communicated. One month sounds generous until you try, in a running operation with tours, handovers and holiday cover, to work out which folder the application is in. The erasure request is therefore the test case for your own order: whoever passes it without searching also has the regular deletion run under control.
- Acknowledge receipt and date it. The day of receipt starts the period. A short acknowledgement with a date is both evidence and a calendar anchor; without it, the discussion later turns to when the request actually arrived.
- Walk every route, not just the convenient one. Database, inbox, deleted items, archive folder, paper file, backup. The list of these places belongs in the deletion policy and not in one person's head - otherwise it is missing precisely when that person is on holiday.
- Check whether another purpose carries. If a claim is still on the table, keeping the data may remain permissible. Processing is then restricted and the reason communicated, rather than rejecting the request without comment.
- Document the completion. Who, when, which holdings, what remains. Two lines are enough, but they have to exist. After the fact, a deletion run without a note cannot be told apart from a forgotten one.
The record and the deletion policy
The record of processing activities calls for the envisaged time limits for erasure of the different categories of data, where possible (General Data Protection Regulation). For a recruitment procedure that means one line per route and per category: applications for an advertised post, speculative applications, talent pool, documents on people who were hired. The last category leaves the procedure anyway - the application documents of a hired care worker become the personnel file, with its own retention periods from employment, tax and social security law. Anyone who does not make that separation generally either deletes too early or not at all. How this fits with the rest of data protection on the website is set out under data protection for care services.
How far you may go beyond the standard period is not a free decision. Guidance from the supervisory authority in Baden-Württemberg dating from before the General Data Protection Regulation puts it this way: where limitation periods are longer there is indeed discretion, but the full length may only be used where experience can show that a shorter period is not sufficient (State Commissioner for Data Protection Baden-Württemberg). The fine range for infringements of the processing principles and of the rights of data subjects goes up to 20,000,000 euros (General Data Protection Regulation) or 4 per cent (General Data Protection Regulation) of the total worldwide annual turnover of the preceding financial year, whichever is higher. For a home care service the practical risk is less the maximum than the complaint of a rejected applicant who, months later, receives post from a talent pool she did not sign up for.
What the careers page needs technically
So that the period does not fail on the technology, the careers page has to do three things: consolidate the inbox, limit access and supply the date. Consolidating means every application comes through the same door, including the one sent as a message to the nursing manager - it is transferred into the regular inbox there and deleted at the point of origin. Limiting means the whole team does not read the applications; the two people who decide do. And the date is the anchor for everything else: date of receipt, date of rejection, date the rejection was received, date of deletion. What a page looks like that produces these four dates by itself is shown under websites for care services.
- One door for all applications. One form, one inbox, one filing place. Anything arriving alongside is transferred and removed at the point of origin - otherwise the copy appears that nobody finds when deleting. What a short form without a cover letter looks like is set out in quick application without a cover letter.
- No private messenger as an application route. What runs through private accounts sits on private devices and is typically out of reach in the deletion run. Why that is more than a question of form is set out in WhatsApp in a care service.
- A follow-up date instead of a reminder. The deletion date is created when the rejection is sent and is not looked for at year end. One calendar entry per procedure is generally sufficient for a service with twenty applications a year.
- Think of the backups. A backup that reaches back several months contains deleted applications. That is permissible but belongs in the deletion policy: the backup is not searched, it expires on its cycle, and that cycle is written down.
Period on the case, not in someone's head
The deletion date is created when the rejection is sent and stays attached to the case. Anyone carrying it in memory loses it at the first sick day in the office.
A branch for the erasure request
A separate route for requests, with a date of receipt and a named owner. The one-month standard period gets tight if the request is only recognised as one after three weeks.
One line per route
Form, inbox, paper, fair, talent pool. The record names a period for every route; a route without a line is a holding without deletion.
Access for two people
Applications do not sit in the team folder. Whoever decides reads them; whoever does not decide does not. That is data protection and calm in the team at the same time.
A talent pool with its own clock
Its own consent, its own duration, its own way out. A pool that grows out of the application inbox is not a pool - it is an unnoticed holding.
A note instead of a memory
Two lines per deletion run: who, when, which holdings. Without a note, a completed deletion cannot be told apart from a forgotten one.
In summary, the deletion period for application documents is an organisational question more than a legal one. The two figures are fixed, the buffer is a decision that needs a reason, and everything else depends on whether the careers page orders the inbox so that a deletion run takes ten minutes instead of two hours. The same order pays off elsewhere: a service that keeps applications tidy can also evidence reliable rosters as an argument and gather voices from the team without searching afresh for every enquiry. If you would like to know what that looks like for your service, you will find the overview under our services or you can write to us through the contact form.
Sources and status
Related Articles
ePA in care: what relatives want to know about access
The ePA in care: what the care service sees, who adds entries, how relatives object or act as representatives, and how a guide page answers these questions.
Employer reviews in care: responding to criticism calmly
Criticism of rosters or onboarding: how a care service replies to employer reviews without personal data and puts them in context on its careers page.
Whistleblower protection in home care: the online channel
Internal reporting office from 50 employees: how a care website carries the reporting route with its own page, a confidential form, deadlines and privacy notes.