Can an employer hold an unsuccessful candidate's CV on file in case a further job vacancy arises?

The Data Protection Act 1998 governs the processing of personal data, which includes the retention of data gathered in the recruitment process. An employer can keep the details of unsuccessful candidates on file, provided that it complies with its duties under the Act. The Information commissioner's Employment practices data protection code states that unsuccessful candidates should be advised if the employer intends to keep their details on file, and given the opportunity to have them removed.

It falls to the employer to set retention periods in respect of recruitment records according to its business needs. The Act states only that personal data should not be kept longer than is necessary for the particular purpose for which it is being retained. If the stated purpose of retaining the data is to enable the employer to consider the candidate in the event that a further job vacancy arises, the employer should have a process in place to ensure that this happens and that the candidate's details are not kept for longer than appropriate for this purpose.