Candidate data disposal for recruitment agencies.
Recruitment agencies handle highly personal candidate data — CVs, application forms, right-to-work document copies, reference letters and interview notes. Under UK GDPR, you have specific obligations around how long you retain this data and how you dispose of it when it is no longer needed.
Why recruitment agencies face specific candidate data obligations.
Recruitment agencies are significant processors of personal data — they routinely hold CVs, application forms, salary details, employment histories, references, right-to-work document copies and in some sectors, DBS check results and medical information. Under UK GDPR, all of this data must be handled in accordance with the data protection principles, including the storage limitation principle which requires that data is not retained longer than necessary.
The ICO is clear on what this means in practice for recruitment agencies: CVs and application data for unsuccessful candidates should typically be retained for no more than 6 months unless the candidate has provided explicit consent for longer retention. Candidate data for placed workers should be retained for the duration of the engagement and for a reasonable period after, but not indefinitely. When the retention period is met, the data must be securely destroyed.
Crucially, secure destruction means more than deleting digital records. Paper CVs, printed application forms, interview notes, reference letters and right-to-work document copies all need to be physically destroyed — and the destruction documented with a certificate of destruction from a certified provider.
The ICO recommends CVs and application data for unsuccessful candidates should be retained for no longer than 6 months. Beyond this, explicit consent is required or the data must be destroyed.
Copies of identity documents used for right-to-work checks must be retained for 2 years after employment ends, then securely destroyed with documented evidence of destruction.
The ICO's guidance for recruitment agencies requires that candidate records are disposed of securely when the retention period is met, with documented evidence of secure destruction.
Where candidate records contain health information, disability data or criminal conviction data (DBS), special category data obligations apply, requiring the highest level of security including at disposal.
All candidate and client documents accepted.
All paper-based candidate, client and administrative documents accepted. No sorting or preparation required.
Paper CVs and speculative applications for unsuccessful candidates at end of 6-month retention period.
Completed application forms, covering letters and supporting documents for unsuccessful candidates.
Copies of passports, visas, biometric residence permits and share codes used for right-to-work verification.
Handwritten or printed interview notes, assessment records and recruiter observations about candidates.
Employment references, written testimonials and character references containing personal information.
Salary history documentation, payslip copies and financial information provided by candidates.
Disclosure and Barring Service certificates — should not be retained beyond 6 months per DBS guidance.
Client job briefs, vacancy requirements, hiring manager correspondence and client personal data at end of retention.
Placement confirmation documents, offer letters, contract paperwork and post-placement correspondence.
How long should a recruitment agency keep candidate records?
These are the key retention periods for recruitment agency records. Once retention periods are met, secure destruction with a certificate of destruction is required.
| Record type | Recommended retention | Basis |
|---|---|---|
| CVs & applications (unsuccessful) | 6 months Unless candidate consents to longer | ICO employment guidance |
| Interview notes (unsuccessful) | 6 months After recruitment process ends | ICO employment guidance |
| Right-to-work check documents | 2 years After employment or engagement ends | Immigration Act 2014 |
| DBS check certificates | 6 months maximum Then destroy per DBS guidance | DBS Code of Practice |
| Placed candidate records | 6 years After end of engagement | Limitation Act / best practice |
| Client vacancy files | 6 years From date of vacancy | Limitation Act 1980 |
| Financial records (agency) | 6 years From end of accounting period | HMRC / Companies Act |
| Staff records (internal) | 6 years After employment ends | Employment law best practice |
This table is for general guidance. Always refer to the ICO's employment practices guidance and your own data retention policy for your specific circumstances.
Fixed prices. Published upfront.
All plans include free sacks or lockable bin and a certificate of destruction after every collection. No hidden fees.
Serving recruitment agencies across three counties.
Trusted by agencies across the region.
"Reliable and professional. The certificate of destruction is exactly what we need for our candidate data GDPR records. Collections are always on time and the service is consistent."
"We use Clearcut for all our candidate file destruction including right-to-work document disposal. Transparent pricing, no hidden fees and completely dependable. Would recommend to any agency."
Recruitment agency shredding FAQs
Get a quote for your recruitment agency.
We work with recruitment agencies across Dorset, Hampshire and Wiltshire. Regular collections or one-off candidate file purges — tell us your requirements and we'll confirm a price the same day.
89 Commercial Road, Bournemouth, England, BH2 5RR
Office@Clearcutconfidentialwaste.co.uk
01202 022409
© 2026 Clearcut Confidential Waste