Candidate CVs should not live in shared folders forever

A shared folder called ‘CVs’ can survive several hiring managers and many recruitment rounds. Some applicants were rejected years ago, some withdrew and some became employees. The folder often gives no clue which purpose still justifies each record or who should be able to open it.

Bring the records back to the recruitment activity. A CV for a current vacancy, a retained decision record and an optional future talent-pool entry are different uses that need separate treatment.

Name the application purpose

Connect each submission to a vacancy or a clearly described recruitment process. Explain what information is needed, who will review it and how the person can contact the organisation. Avoid requesting an unrestricted set of identity or financial documents before they are relevant to the stage.

As of 22 October 2026, the relevant substantive DPDP duties are scheduled for 13 May 2027 under the commencement notification. The future sections 4 to 7 will require an appropriate processing route. Do not assume that every recruitment activity is automatically covered by the employment-related clause, or import a general contractual-necessity ground that the Act does not set out. Assess the actual activity and its basis.

If consent is the route, prepare a purpose-specific notice and a suitable decision process. A request to consider a person for one role does not automatically explain an indefinite, unrelated talent database.

Limit the review copies

Give reviewers access to the candidates they are assessing and the information relevant to their part of the decision. Avoid sending complete application bundles to a large distribution list because one colleague needs to answer one question.

Decide where interview notes and scores belong. Keep comments relevant, respectful and understandable. A private observation in an informal chat can still influence a decision while remaining disconnected from the official record. Bring material decision information into the controlled process without copying unrelated conversation.

The future section 8(3) will address completeness, accuracy and consistency where data is likely to be used for a decision affecting the person or disclosed to another fiduciary. Provide a way to correct the relevant record and ensure the correction reaches the reviewers who use it.

A hypothetical hiring-round closure

A design agency finishes recruiting a project coordinator. Its owner finds CVs in an applicant system, an interview spreadsheet and two downloaded folders. The team reconciles those locations and records the outcome of the vacancy.

For unsuccessful candidates, it separates any justified retained decision evidence from active recruiting use. A future talent pool is assessed as its own purpose, with an appropriate explanation and route. The agency does not assume that a candidate’s original application expressed a wish to receive unrelated offers indefinitely.

For the successful candidate, the HR team receives the information needed for the next stage. It does not automatically inherit every informal interviewer comment or unrelated attachment. The original recruitment working copies are then reviewed under the applicable retention process.

Choose a retention rule you can explain

Do not invent a universal six-month or one-year CV deletion rule from this article. The right decision depends on the purpose, applicable obligations and the future framework’s actual retention provisions. Section 8(7) must be read with legal retention requirements, including rule 8(3) and the Seventh Schedule.

Record the category, the reason for retention, the event that starts the review and the person responsible. Where a dispute or another obligation requires preservation, restrict the retained record to that purpose. It should not remain in the routine candidate-search pool merely because deletion is not yet appropriate.

Review provider exports and backups through the same lifecycle. Deleting the main application does not necessarily remove a spreadsheet that a hiring manager saved elsewhere.

Make the process survive staff changes

Give the recruitment folder an owner, remove former reviewers’ access and include open vacancies in the handover when a recruiter leaves. The future rule 6 security framework will be relevant to access and related safeguards; these practical controls can be designed now.

Use a synthetic application to test closure. Can the team identify the authoritative record, apply a correction, remove unnecessary reviewer access and explain what remains after the vacancy closes? If not, a longer policy will not resolve the underlying gap.

The recurring failure is treating a CV as permanently useful because another vacancy might appear. Keep active recruitment, optional future contact and restricted retention distinct. That gives every remaining record a reason to be there and a person responsible for its next decision.