GDPR candidate data retention for recruiters: how long to keep talent pool records on Mac

What GDPR says about keeping candidate data

GDPR does not give a fixed number of days or months for candidate records. It gives a test instead. Article 5(1)(e) says personal data can be kept in a form that identifies people for no longer than is necessary for the purpose you collected it for. This is the storage limitation principle. Every retention decision you make starts from that test.

The same article lists a few exceptions. Longer storage is allowed when data is processed only for archiving in the public interest, scientific or historical research, or statistics, with the safeguards the regulation requires. Keeping applicants for future vacancies is not on that list. A talent pool needs its own reason and its own end point.

Here is how that plays out. Two people applied for the same role last spring. One was rejected at the first screen. The other reached final interviews. The reason to keep the second file is stronger than the reason to keep the first. Most teams never write that difference down, so every file gets the same treatment.

Why talent pools make retention harder

An applicant has a clear purpose. You process the application to fill one role. A talent pool is different. People often enter it without applying. A sourcer adds them from a conference list or a profile search. Their purpose is vague, so their end date is vague too.

Greenhouse shows the problem inside its own product. Talent Rediscovery searches prospects and past applicants for current roles. Past candidates lists only people who applied before. Greenhouse says prospects who were never submitted as applications do not appear in that tab. If you search only Past candidates, you miss the prospects in your pool.

Talent Rediscovery needs the Plus or Pro tier and Job Admin permissions that can view or edit candidates, or higher. Greenhouse's help article calls it the older workflow. The same article does not say how long prospect data stays. Ask your Greenhouse admin which tab your team uses, and who is allowed to delete.

Set a retention rule you can defend

Start with one page. Name each pool. Write why you hold its data. Write when the data ends and who deletes it. A short rule gets followed. A long policy sits unread in a shared drive.

The table has no real periods on purpose. GDPR does not supply one, and the sources I checked do not give a safe default. Your counsel or data protection lead sets the period for each pool. Write it into the rule, then follow it every month.

Clean up duplicate candidates in Apple Contacts on Mac

Duplicates break retention. You delete a candidate in one place, and an older copy survives in another. Apple Contacts can find and merge duplicate cards on a Mac. Run this cleanup before you apply any delete-by date. Otherwise the same person keeps two timers.

1. Open Contacts with ⌘ Space, then type Contacts and press Return.
2. Choose Card > Look for Duplicates.
3. Read each pair. Check the name, email and role before you agree.
4. Click Merge on a pair you have confirmed.
5. For cards you select yourself, choose Card > Merge Selected Cards.
6. Open the merged card and move any retention note into the right tracker.

Apple's merge guide is tagged macOS Sonoma 14 in its address, and another Contacts page is headed for macOS 27. Menu labels can move between macOS releases. If the wording on your Mac differs, look for the Card menu, then the words Duplicates and Merge.

Clean up candidate email in Gmail

Gmail often holds more candidate data than any tracker. Every thread with an applicant sits in your inbox, your sent folder and your archive. Retention means finding those threads by pool. Then you delete or archive them when your rule says so. Archive is not deletion. Archived mail still counts as stored data.

Start with a label for each pool. The steps are in our guide to creating a label in Gmail on Mac. Apply the label when a thread starts, not months later when you remember.

To find one candidate's threads, click the search box, or press / if keyboard shortcuts are turned on in Gmail settings. Type the candidate's name. Read every result before you delete anything. Then remove the threads your rule covers. Keep any thread tied to a live hire or a legal hold. Deleting from Gmail does not clean your tracker or Contacts, so clean each place.

Track retention dates in Google Sheets

A tracker is where retention goes wrong most often. Rows pile up. Nobody remembers what the status column means. Add three columns to the tracker: pool name, date added and delete by. Fill delete by the same day a candidate enters a pool.

Then sort or filter on delete by every month. The steps are in our guide to sorting data by column in Google Sheets on Mac. Sorted oldest first, the rows that need action rise to the top.

Keep the tracker lean. Store what you need to run the process. Leave out health, family or visa details unless your rule names them and your employer allows it.

Mistakes people make with talent pools

• Treating a talent pool as forever. No end date means no retention rule.
• Searching only one Greenhouse tab, then assuming the pool is empty.
• Keeping copies in a personal inbox or on a laptop after a role closes.
• Confusing archive with delete, then calling the data gone.
• Treating one click as consent for every future role, without checking what your counsel says the basis is.
• Cleaning Gmail but forgetting the copies in your tracker and Contacts.

Edge cases: other countries and UK guidance

Candidates may live in another country. If you hire across borders, your rule may need more than one version. Ask counsel which rules cover each candidate. Do not assume one country's rule covers all of them.

UK recruiters should check the ICO's recruitment guidance. A law firm article dated 23 February 2024 says the ICO had published it as a draft, with a consultation that ran until 5 March 2024. The article warns the draft is subject to change. I could not read the current ICO pages from this session, because they blocked automated reads. Check the ICO site for the final text before you rely on any summary, including this one.

Where Lazur helps, and where you still do the work

Lazur is a voice assistant for the Mac. Hold ⌥ ⌘ to ask about anything on screen. Lazur answers out loud, and it can point at the menu or button you need. That helps when you do not want to hunt through Contacts or Gmail for each step.

Lazur helps with reading, pointing and drafting. It can explain a clause in plain words, point at the Card menu, draft a short notice for your counsel to review, and set a reminder by voice. It does not click buttons for you. It does not delete candidates, merge cards or edit your tracker. Those choices stay with you and your data protection lead.

Start with the table in this guide. Name your pools, then open Contacts and Gmail. The pool names will tell you which threads and cards to touch first.