GRPD and recruitment software: information collected and data retention period. You can collect personal data as part of a recruitment process. However, there is also a lot of data that you cannot collect in your recruitment software. For example, you cannot record a social security number or a criminal record. Questions about the family environment should also be excluded. In fact, for each piece of information you collect, you have to ask yourself whether it is legitimate to collect it as part of a recruitment process.
Of course, you can collect other information if you have informed the candidate beforehand. This category includes, for example, the collection of references from the candidate’s professional environment (superiors, colleagues, internship supervisors, clients, suppliers, etc.).
GRPD and recruitment software: The deadline for retention
Now if you are wondering about the length of time the data is kept. The law does not give a precise time limit. The GRPD specifies that personal data can only be kept “for no longer than is necessary for the purposes for which they are collected and processed”. This is particularly true if we are interested in the data of job applicants. The CNIL has given its opinion on what it means by “necessary duration”. Thus, the CNIL recommends that the period of retention of information (on computer and paper) should not exceed 2 years. Please note that this period is calculated from the “last contact” with the person concerned.
We remind you that the recruitment process is subject :
Firstly to the French Data Protection Act n°78-17 of 6 January 1978 (LIL)
Secondly, the General Regulation on the protection of personal data n°2016/679 of 27 April 2016 (GRPD)
And finally, the Labour Code which also regulates the information collected during recruitment in articles L 1221-6 and following of the Labour Code
Let us not forget to mention the recommendations of the Commission informatique et libertés (CNIL): Cnil, practical guide for employers
