How long can recruiting platforms keep applicant data?
Federal regulation requires employers to preserve application records for at least one year, and federal contractors for two. Those are minimums, not maximums — nothing in that rule requires anyone to delete your data afterwards. In practice, applicant records commonly persist for years, and the vendor holding them usually keeps its own copy under its own policy. A year is the floor, not the limit.
The one-year rule, and what it actually says
Under EEOC recordkeeping regulations (29 CFR 1602.14), employers covered by Title VII must preserve personnel and employment records — including job applications — for at least one year from the date the record was made, or from the date of the personnel action, whichever is later. Where a charge or lawsuit is pending, records must be kept until it is resolved.
Federal contractors face a longer obligation, generally two years under OFCCP rules.
Read the wording carefully, because the direction of the rule is the opposite of what most people assume. It is a preservation requirement. It compels employers to keep records so that discrimination claims can be investigated. It does not cap how long anybody may hold your data, and it does not oblige deletion when the period ends.
“At least one year” is a minimum imposed on employers. It is not a promise that your data disappears after twelve months.
The employer is not the only one holding it
This is the distinction that changes what you should do about it.
When you apply through a company’s careers page, you are usually typing into software the employer licenses from a vendor. Two records result:
| Holder | What they hold | Governed by |
|---|---|---|
| The employer | Your application to that specific role | EEOC/OFCCP retention rules, plus company policy |
| The vendor | Parsed resume, candidate profile, assessment results, rankings, and often activity across multiple employers | The vendor’s own retention policy |
The vendor’s copy is typically the more consequential one and the less visible. It can outlast your relationship with any single employer, and because a small number of vendors serve very large numbers of employers, it is also the copy most likely to affect a future application. Why shared vendors make this matter.
What vendor retention policies typically say
Published policies vary, but common patterns include:
- Retention “as long as necessary for the purposes described” — open-ended by design.
- Fixed windows, often measured in years rather than months, sometimes resetting on any new activity.
- Separate, longer retention for aggregated or de-identified data.
- Backup and archive copies excluded from routine deletion, purged on their own schedule.
None of this is unusual or necessarily improper. The point is only that “it’s been over a year, so it’s gone” is not a safe assumption.
Does a deletion request override a retention obligation?
Sometimes, partially. This is worth understanding before you send one so the response does not surprise you.
State privacy laws that grant a deletion right generally allow the recipient to refuse or narrow a request where they must keep the data to comply with another legal obligation. An employer within its EEOC preservation window may reasonably decline on that basis.
Two things follow:
- Vendors are the better target. A screening or sourcing vendor is often not the entity under the employer’s preservation duty, so it has less basis to refuse.
- A partial response is still a result. A company may delete a profile and assessment results while retaining the bare application record it is required to keep. That is a meaningful outcome, not a failure.
What to do with this
- Do not wait out a year expecting expiry. Nothing guarantees it.
- Send requests to the vendors, not only to employers.
- Do it before your next round of applications begins — new activity can restart retention clocks.
- Expect some refusals and some partial deletions, and keep a record of what you sent and when.
A practical sequence for doing this · Which states give you a deletion right
Sources
- 29 CFR 1602.14 — Preservation of records made or kept — U.S. Equal Employment Opportunity Commission
- Algorithmic Monocultures in Hiring — Stanford Digital Economy Lab
Clear your applicant data before you apply again
ATS Reset writes a deletion request for your state and gives you the privacy contacts to send it to. You send it yourself, from the email address you applied with.
Keep reading
- What is an ATS score?There is no single universal score. Here is what hiring systems actually calculate, and why the shorthand is misleading.
- Can ATS data affect future job applications?How applicant records persist across employers, and where retained data can plausibly influence a later application.
- Why qualified candidates get automatically rejectedKeyword parsing, knockout questions, ranking thresholds and assessment cut-offs — the mechanics behind a fast rejection.