GDPR states that there are two legal bases on which you can store and process candidates’ personal data.
Consents for data processing and data retention or
Legitimate interest to store their data
Candidates that applied via your careers page, social network, job board, etc., will be considered as Applied candidates. These candidates are informed about your data processing and data retention when they apply for a job and they can give their consents on the application form.
The data processing consent is mandatory for candidates in order to apply for a job.
The retention period consent is not mandatory. For candidates who don't give you their retention period consent, you will need to delete their information from your database when the job opening they applied for is archived, or the inactivity period has expired. They will be placed on the Needs to be deleted list.
NOTE: While TalentLyft has consulted with legal professionals both in the creation of this article and for our own product features, we are not a law firm. All information that is used in this article is general information and is not intended as legal advice. Users should take independent legal advice regarding their own data protection policies.