Three hot cases and breach response
Step 1 / 4·Rejected candidates' CVs
0/4 steps done
Learning objectives — after this module you will:
- Handle the three most common HR situations correctly
- Set a retention period for each type of file
- Know what to do in the first 72 hours of an incident
Rejected candidates' CVs
Deal with recruitment's largest forgotten data store.
One campaign for five roles can bring in 300 CVs. Four people are hired; the other 296 CVs sit in an inbox and a shared drive — usually forever. This is the single largest store of personal data that almost no company manages.
Candidates send a CV for one clear purpose: to apply for this role, in this round. When the round closes, that purpose is complete. Keeping it for a future round is a NEW purpose requiring separate consent — and this consent is perfectly valid, because the candidate can decline at no cost.
A lean procedure for rejected CVs
- In the job advert, state that CVs are used for this round and how long they are kept.
- When the round closes, send a thank-you note with one clear choice: would they like their file kept for future opportunities?
- Move those who agree into a talent pool, with a date and a retention limit recorded.
- Delete the files of those who decline or do not reply, on schedule — automate it, do not rely on memory.
- Record the deletion: date, volume, who performed it.
Key takeaway: A CV sent for this round is for this round; keeping it longer needs a separate ask and a deletion schedule.