A rejection ends the selection process, but it does not always immediately stop all data processing. Resumes, cover letters, certificates, interview notes and evaluations may remain in the applicant management system for some time. Some companies also ask whether they may keep the profile in a talent pool for future positions. For applicants it is therefore important to distinguish: which storage still belongs to the completed procedure, what requires a new legal basis, and when a deletion request is appropriate?
This guide explains how you Delete application data Find out which Austrian time limits are relevant and why the right to erasure does not always force immediate removal. You will receive a clear procedure for access, withdrawal, erasure and complaint as well as wording that you can adapt directly to companies or recruiters.
The essentials in 60 seconds
- Application data must not be kept indefinitely. Under the GDPR, purpose limitation, data minimization, and storage limitation apply.
- Immediate deletion after rejection is not always mandatory. Companies may temporarily need data to defend against possible claims arising from the application process.
- In Austria, seven months is an important benchmark. The WKO refers to a final decision of the Data Protection Authority, according to which applicant data may be stored for seven months from rejection.
- A talent pool is a new purpose. For longer data retention, a viable legal basis is regularly required; often this is a voluntary, informed and revocable consent.
- Access and deletion should not be requested at the same time. The data protection authority warns that after deletion an incomplete access response may be harder to verify.
- Data subject requests must generally be responded to within one month. In complex exceptional cases, the deadline may be extended by up to two further months.
Which data may be stored after an application
The visible CV is only part of the data set. Depending on the process, companies or contracted recruiters may process the following information:
- Contact details, CV/resume, cover letter, photo, and certificates,
- Responses from application forms and voluntary salary information,
- Notes from phone calls and interviews,
- Assessments, rankings and justifications from the selection process,
- Results from work samples or aptitude tests,
- Communication via email, careers portal or recruitment agency,
- technical logs such as sending times, consents and accesses.
Companies must already provide transparent information at the time of collection about who is responsible, for what purposes the data are processed, which legal basis is relied upon, who receives the data and how long they are stored. Look for this information in the privacy policy of the careers portal, in the confirmation of receipt or in the application form. Our article Check application documents before sending shows furthermore which information is really necessary for the initial selection and which sensitive documents are better submitted later.
Why data may still be retained after a rejection
The GDPR does not require deletion according to a rigid calendar date for every application. What matters are the purpose and the legal basis. As long as a selection process is ongoing, processing may be necessary to carry out pre-contractual measures. After a rejection, this immediate purpose generally ceases to apply. Nevertheless, limited further storage may be permissible if the company needs documents to assert, exercise or defend legal claims.
In Austria, the Equal Treatment Act plays a central role in this. Claims arising from discriminatory refusal to establish an employment relationship must, according to § 15 Equal Treatment Act in principle be asserted in court within six months of the rejection. The WKO FAQ on employee data protection therefore cites seven months from the rejection as an admissible guideline: six months for a possible claim plus one month for the potential course of litigation.
This does not mean that every company must across the board retain every data record for seven months or that afterwards it may automatically keep everything indefinitely. Necessity must fit the specific purpose. Likewise, a deletion request submitted before the deadline is not without effect: the company must examine it and explain which data will be deleted, which will remain restrictedly stored for the time being, and on which legal basis it relies.
Talent pool: A rejection is not a permanent release
A talent pool is intended to make applicants discoverable for future positions. This is not the same purpose as filling the position they were just rejected for. Effective consent should therefore clearly describe which data are collected, who can access them, for which roles the profile will be used, and how long records will be kept. A phrase like 'until revoked' without a verifiable time frame is problematic.
Check these five points before you consent:
- Specific purpose:Is it for similar positions within the same company or for a group-wide pool?
- Retention period:Is a clear end date or a regular renewal specified?
- Recipient:Do subsidiaries or external recruitment consultants have access?
- Withdrawal: Gibt es eine leicht erreichbare Adresse oder Portal-Funktion?
- Freiwilligkeit: Ist eindeutig, dass eine Ablehnung des Pools keine Nachteile im laufenden Verfahren bringt?
Sie können eine Einwilligung für die Zukunft widerrufen. Die bis zum Widerruf erfolgte Verarbeitung wird dadurch nicht rückwirkend rechtswidrig. Nach dem Widerruf muss das Unternehmen prüfen, ob noch eine andere Rechtsgrundlage für einzelne Daten besteht. Wie Unternehmen Kandidaten aktiv ansprechen und welche Datenquellen dabei eine Rolle spielen, erläutert unser Ratgeber zu Active Sourcing in Österreich.
Ihre Rechte: Auskunft, Löschung oder Einschränkung?
Auskunft, wenn Sie zuerst Klarheit brauchen
Mit einem Antrag nach Art. 15 GDPR können Sie unter anderem erfahren, welche personenbezogenen Daten verarbeitet werden, zu welchen Zwecken, welche Kategorien und Empfänger betroffen sind, wie lange die Speicherung vorgesehen ist und woher nicht direkt bei Ihnen erhobene Daten stammen. Der Antrag muss nicht begründet werden. Er ist besonders sinnvoll, wenn Sie nicht wissen, ob Daten in einem Talentpool, bei einem Personalvermittler oder in mehreren Systemen liegen.
In practice, it's wiser not to request access and erasure at the same time. Otherwise, the company might first provide incomplete access and then delete the record; later verification becomes more difficult. If you need to secure evidence of possible discrimination or unlawful profiling, the order is especially important. An overview of time limits, identity checks and the individual rights is provided by the WKO on data subject rights under the GDPR.
Erasure when the purpose is no longer applicable
Art. 17 GDPR gives you, among other things, a right to erasure where data are no longer necessary for the original purpose, consent has been withdrawn and there is no other legal basis, or where data have been processed unlawfully. However, the right is not absolute. Further processing may, for example, be necessary to defend legal claims.
You can find the legal principles directly in the General Data Protection Regulation (GDPR). Practically important is the distinction between "no longer using for recruiting" and "technically destroying every copy immediately." A company can stop active use, restrict access and keep a small dataset locked until the end of a verifiable legal defense period. It should communicate this handling to you in a way that is understandable.
Restriction when data are retained but should not be used
A restriction of processing under Art. 18 GDPR may be appropriate if you dispute the lawfulness but initially need the data as evidence. Restricted data may generally only be processed in very limited exceptional cases. This is often more sensible than immediate deletion if you want a selection decision to be reviewed.
The seven-step plan after a job rejection
- Save rejection and privacy notices: Save the email, job posting, confirmation of receipt, and the privacy policy that was valid at the time of application.
- Find the data controller: Write to the contact named in the privacy notice, the data protection officer, or the HR department. In the case of a placement, the recruiter and the client may be separately responsible.
- Set your goal: Do you only want to be removed from the talent pool, have everything deleted completely, or first find out what is stored?
- Only submit one initial request: Begin with a request for information if in doubt. Do not request information and deletion at the same time.
- Send with proof: Verwenden Sie die offizielle Kontaktadresse und bewahren Sie Versandnachweis sowie Antwort auf.
- Note the one-month deadline: The company must generally respond within one month or inform you within this period about any permitted extension.
- Check the response: Pay attention to purpose, legal basis, storage duration, recipients, and a concrete statement of which data have been deleted or restricted.
Wording for a deletion request
Subject: Request to delete my application data
Dear Sir or Madam, I applied on [Datum] for the position [Bezeichnung]. The application process was concluded following your rejection dated [Datum]. Pursuant to Art. 17 GDPR, I request the deletion of my personal application data, insofar as no other legal basis or demonstrable necessity for the defense of legal claims exists. I hereby withdraw any consent previously given to be included in a talent pool, with effect for the future. Please confirm which data have been deleted, which data, if any, remain stored in a restricted form, on what legal basis this is being done, and until which specific date the storage is intended.
Kind regards
[Name]
Adjust the text to your situation. The Arbeiterkammer Oberösterreich stellt ebenfalls einen Musterbrief zur Datenlöschung bereit. Das EU-Portal \"Your Europe summarizes access, withdrawal, deletion and the complaint process in a clear and understandable way.
What you shouldn't send along too hastily
A company may verify your identity if there are legitimate doubts. However, that does not automatically justify an unredacted copy of your passport. First, provide the email address used, the application date, the position, and, if applicable, the applicant number. If that is not sufficient, ask which additional information is specifically required and why. Only send identity documents when it is truly necessary, and redact any information that is not needed.
Also avoid broad, unrelated demands. A precise request can be processed more quickly. Do not write to individual interviewers via private channels; use the official data protection or recruiting address instead. On application portals, you should not prematurely delete your profile yourself if you first need a full disclosure or preservation of evidence.
Three typical real-world cases
A clear rejection without a talent pool
An applicant receives a rejection and does not want any further contact. The company cites a seven-month retention period for legal defense. She objects to any use for new positions and requests deletion after the specifically stated date has passed. Immediate complete deletion is not guaranteed, but any further use for recruiting must be cleanly separated from the quarantined evidence records.
The talent pool with an unclear end
An applicant ticked a talent-pool checkbox during the online application. Months later he receives unsuitable inquiries. He withdraws his consent, requests removal from the pool and asks for confirmation. The company must not treat consent as a permanent release. If a small residual record is retained for legal claims, it must justify that separately.
Suspicion of discriminatory selection
After an interview, contradictory statements regarding the rejection stand out. In this case the applicant should not immediately have all data deleted. She secures the job posting and communications, first requests access and obtains legal advice. The six-month period of the Equal Treatment Act runs from the rejection. Only when evidence preservation and possible claims have been clarified does she decide on deletion or restriction.
A factual follow-up question can independently help to put the selection decision into context. Our guide "Follow up on a job rejection contains phrasing for constructive feedback, without conflating data protection and legal issues.
If no response or only a generic reply is received
If the company does not respond within one month, does not provide a concrete extension, or rejects the request with only a generic phrase, inquire in writing. Request the specific legal basis, the purpose, the categories of the remaining data, and the planned deletion date. Also check whether your request was sent to the correct data controller.
If the result remains inadequate, you can file a complaint with the Austrian Data Protection Authority. Include the request, proof of dispatch, the response, and any relevant privacy notices in an organized manner. A complaint is not a shortcut for the initial contact: data subject rights must generally first be exercised with the responsible company.
FAQ on application data and deletion
Does a company have to delete my application immediately after rejection?
Not necessarily. A limited period of storage may be necessary to defend against possible claims. In Austria, seven months from rejection are considered an important guideline. However, longer use of a talent pool requires its own viable legal basis.
Can I revoke only the talent pool consent?
Yes. Explicitly state that you are revoking consent for future recruiting purposes and want to be removed from the talent pool. Also ask whether, and until when, a limited remaining set of data will be retained for other reasons.
Does this also apply to recruitment agencies?
Yes, recruitment agencies must also respect data protection rights. However, check whether the agency and the potential employer are each separate controllers. If so, a separate request to both parties may be necessary.
Can I initiate deletion through the careers portal?
A portal function can suffice if it covers all affected data and purposes. Document the process. If unclear, you should additionally obtain written confirmation whether interview notes, talent-pool entries and data held by affiliated recipients were also included.
Conclusion: Clarify first, then delete selectively
After a rejection, application data does not have to remain in the system indefinitely. At the same time, “delete everything immediately” is not always the best or legally required solution. First check the purpose, retention period and talent-pool consent. If you do not know the extent of the data or need to secure evidence, start with a request for access. If the purpose has ceased, revoke the talent-pool consent and demand a verifiable deletion or restriction with a specific end date. That way you retain control without prematurely losing important evidence.
