A rejection ends the selection process, but not necessarily all data processing immediately. CVs, cover letters, certificates, interview notes and assessments can remain in the applicant management system for some time. Some companies also ask whether they may retain the profile in a talent pool for future positions. For applicants it is therefore important to distinguish: which retention still belongs to the completed procedure, when a new legal basis is required, and when a deletion request makes sense.
This guide explains how you delete application data have them deleted, which Austrian deadlines play a role and why the right to deletion does not always compel immediate removal. You will receive a clear procedure for access, revocation, deletion and complaint as well as wording that you can adapt directly to companies or recruiters.
The most important things in 60 seconds
- Application data must not be kept indefinitely.Under the GDPR, purpose limitation, data minimization and storage limitation apply.
- Immediate deletion after a rejection is not always mandatory. Unternehmen können Daten vorübergehend benötigen, um mögliche Ansprüche aus dem Bewerbungsverfahren abzuwehren.
- In Österreich sind sieben Monate ein wichtiger Orientierungswert. Die WKO verweist auf eine rechtskräftige Entscheidung der Datenschutzbehörde, nach der Bewerberdaten sieben Monate ab Ablehnung gespeichert werden dürfen.
- Ein Talentpool ist ein neuer Zweck. Für eine längere Evidenzhaltung wird regelmäßig eine tragfähige Rechtsgrundlage benötigt; häufig ist das eine freiwillige, informierte und widerrufbare Einwilligung.
- Auskunft und Löschung sollten nicht gleichzeitig verlangt werden. Die Datenschutzbehörde warnt, dass nach einer Löschung eine unvollständige Auskunft schwerer kontrollierbar sein kann.
- Auf Betroffenenanträge muss grundsätzlich binnen eines Monats reagiert werden. In complex exceptional cases, the deadline may be extended by up to two additional months.
Which data may be stored after an application
The visible CV is only part of the data record. Depending on the process, companies or contracted recruiters may process the following information:
- Contact details, CV, cover letter, photo and certificates,
- Responses from application forms and voluntary salary information,
- Notes from telephone calls and interviews,
- Assessments, rankings and justifications from the selection process,
- Results from work samples or aptitude tests,
- Communication via email, career portal, or recruitment agency,
- technical logs such as sending times, consents, and access events.
Companies must already inform transparently at the time of collection who is responsible, for which purposes the data are processed, which legal basis is relied upon, who receives the data and how long they are stored. Look for this information in the career portal's privacy policy, in the confirmation of receipt, or in the application form. Our article "Check application documents before submittingalso shows which information is really needed for the initial selection and which sensitive documents are better submitted later.
Why data may still be retained after a rejection
The GDPR does not require deletion on a rigid calendar date for every application. What matters is the purpose and the legal basis. As long as a selection procedure is ongoing, processing may be necessary to carry out pre-contractual measures. After the rejection, this immediate purpose generally no longer applies. However, a limited further retention may be permissible if the company needs records to assert, exercise, or defend legal claims.
In Austria, the Equal Treatment Act plays a central role here. Claims arising from discriminatory refusal to conclude an employment relationship are governed by "§ 15 Equal Treatment Act grundsätzlich to be asserted in court within six months from rejection. The WKO FAQ on employee data protection nennt deshalb sieben Monate ab Ablehnung als zulässigen Orientierungswert: sechs Monate für einen möglichen Anspruch plus ein Monat für den potenziellen Klageweg.
This does not mean that every company must, across the board, store every data record for seven months or may then automatically retain everything indefinitely. Necessity must fit the specific purpose. Likewise, a deletion request submitted before the expiry is not ineffective: the company must examine it and explain which data will be deleted, which will remain temporarily restricted, and which legal basis it relies on.
Talentpool: A rejection is not a permanent release
A talent pool is intended to keep applicants discoverable for future positions. That is not the same purpose as filling the position that was just rejected. Effective consent should therefore clearly describe which data will be collected, who can access it, for which roles the profile will be used, and how long the records will be retained. A formulation like "until revoked" without a comprehensible time frame is problematic.
Prüfen Sie vor Ihrer Zustimmung fünf Punkte:
- Specific purpose: Is it about similar positions within the same company or a group-wide pool?
- Retention period: Is a clear end or a regular renewal specified?
- Recipient: Do subsidiaries or external recruitment consultants get access?
- Withdrawal: Is there an easily accessible address or portal function?
- Voluntariness: Is it clear that refusing the pool will not result in any disadvantages in the ongoing proceedings?
You can withdraw consent for the future. Processing carried out up to the withdrawal will not thereby become unlawful retroactively. After the withdrawal, the company must check whether there is another legal basis for individual data. How companies actively approach candidates and which data sources play a role are explained in our guide to Active Sourcing in Austria.
Your rights: access, erasure or restriction?
Access, if you need clarity first
With a request under Art. 15 GDPR you can, among other things, find out which personal data are being processed, for what purposes, which categories and recipients are affected, how long the data are intended to be stored, and where data that were not collected directly from you come from. The request does not have to be justified. It is particularly useful if you do not know whether data are in a talent pool, with a recruitment agency, or in several systems.
It is practically wiser not to request access and deletion at the same time. Otherwise the company could first provide incomplete information and then delete the record; later verification becomes more difficult. If you need to secure evidence of possible discrimination or unlawful profiling, the sequence is particularly important. An overview of deadlines, identity verification and the individual rights is provided by the WKO on data subjects' rights under the GDPR.
Deletion when the purpose has ceased to exist
Art. 17 GDPR grants you a right to erasure, among other things, if data is no longer necessary for the original purpose, if consent has been withdrawn and no other legal basis exists, or if data has been processed unlawfully. However, this right is not absolute. Further processing may be necessary, for example, for the establishment, exercise, or defense of legal claims.
You can find the legal principles directly in the General Data Protection Regulation. A practical distinction is made between "no longer using for recruiting" and "technically destroying every copy immediately." A company can stop active use, restrict access, and keep a small data set blocked until the end of a verifiable legal defense period. It should inform you of this handling in a comprehensible manner.
Restriction when data is to be retained but not used
The restriction of processing according to Art. 18 GDPR may be appropriate if you contest the lawfulness but need the data for the time being as evidence. In principle, blocked data may only be processed in narrow exceptional cases. This is often more sensible than immediate deletion if you wish to have a selection decision reviewed.
The seven-step plan after a job rejection
- Save rejection and privacy notices: Save the email, the job posting, the confirmation of receipt and the privacy policy that was valid at the time of application.
- Find the responsible party: Write to the contact named in the privacy notice, the data protection officer, or the HR department. In a placement, recruiters and clients may be separately responsible.
- Set a goal: Do you only want to be removed from the talent pool, have your data completely deleted, or first know what is stored?
- Submit only an initial request: If unclear, start with an access request. Do not request access and deletion at the same time.
- Send with proof of delivery: Use the official contact address and keep proof of dispatch as well as the response.
- Note the one-month deadline: The company must generally respond within one month or inform you of a permissible extension within that period.
- Check the response: Pay attention to the purpose, legal basis, retention period, recipients and a concrete statement of which data have been deleted or restricted.
Wording for a deletion request
Subject: Request to delete my application data
Dear Sir or Madam, I applied on [Datum] for the position [Bezeichnung]. The application process ended with your rejection dated [Datum]. I request, pursuant to Art. 17 GDPR, the deletion of my personal application data insofar as no other legal basis or demonstrable necessity for the defense of legal claims exists. I hereby withdraw any consent that may have been given for inclusion in a talent pool with effect for the future. Please confirm which data have been deleted, which data may remain stored in a restricted form, on what legal basis this is done and until which specific date the storage is intended.
Kind regards
[Name]
Adapt the text to your case. The Chamber of Labour Upper Austria provides a template letter for data deletion. The EU portal Your Europe summarizes access, withdrawal, deletion and the complaint procedure in an easy-to-understand way.
What not to send prematurely
A company may verify your identity if there are reasonable doubts. However, that does not automatically justify an unredacted copy of your passport. First give the email address used, the application date, the position and, if applicable, the applicant number. If that is not sufficient, ask which additional information is specifically needed and why. Send identity documents only if it is really necessary, and redact any information that is not required.
Also avoid broad demands without context. A precise request can be processed more quickly. Do not write to individual interviewers via private channels, but to the official data protection or recruiting address. On application portals, you should not hastily delete your profile yourself if you first need a full disclosure or preservation of evidence.
Three typical cases from practice
The clear rejection without a talent pool
An applicant receives a rejection and does not want any further contact. The company cites a seven-month retention period for legal defense. She objects to any use for new positions and demands deletion after the specifically mentioned date. Immediate complete deletion is not guaranteed, but further use for recruiting must be cleanly separated from the blocked evidence records.
The talent pool with an unclear end
An applicant checked a talent pool box during the online application. Months later, he receives unsuitable inquiries. He revokes his consent, demands removal from the pool, and requests confirmation. The company must not treat the consent as a permanent authorization. Whether a small remainder is kept for legal claims must be justified separately.
Suspicion of discriminatory selection
After an interview, contradictory statements regarding the rejection are noticed. In this case, the applicant should not have all data deleted immediately. She saves the job advertisement and communication, first requests information, and seeks legal advice. The six-month period of the Equal Treatment Act begins upon rejection. Only when evidence preservation and potential claims are clarified does she decide on deletion or restriction.
A factual inquiry can help to classify the selection decision regardless of this. Our guide Ask about a job rejection contains formulations for constructive feedback without mixing data protection and legal issues.
If no response or only a blanket reply is received
If the company does not respond within one month, does not specify a concrete extension, or rejects the request with only a general formula, ask in writing. Request the specific legal basis, the purpose, the categories of the remaining data, and the planned deletion date. Also check whether your request was sent to the correct data controller.
If the result remains insufficient, you can file a complaint with the Austrian Data Protection Authority. Attach the request, proof of dispatch, response and relevant privacy notices in an orderly manner. A complaint is not a shortcut for initial contact: data subject rights must generally first be exercised with the responsible company.
FAQ on application data and deletion
Does a company have to delete my application immediately after rejection?
Not necessarily. A limited period of storage may be necessary to defend against possible claims. In Austria, seven months from rejection are considered an important reference point. However, longer use in a talent pool requires its own valid legal basis.
Can I revoke only the talent pool consent?
Yes. Explicitly state that you withdraw consent for future recruiting purposes and want to be removed from the talent pool. Also ask whether, and until when, a limited residual set of data will be retained for other reasons.
Does this also apply to recruitment agencies?
Yes, recruitment agencies must also respect data protection rights. However, check whether the agency and the prospective employer are each separate controllers. In that case, a separate request to both parties may be necessary.
Can I trigger deletion via the careers portal?
A portal function may suffice if it covers all affected data and purposes. Document the process. If unclear, you should additionally obtain written confirmation as to whether interview notes, talent pool entries, and data held by affiliated recipients were also included.
Conclusion: Clarify first, then delete selectively
After a rejection, application data does not have to remain in the system indefinitely. At the same time, "delete everything immediately" is not always the best or legally required solution. First check the purpose, retention period, and consent to the talent pool. If you do not know the extent of the data or need to secure evidence, start with an access request. If the purpose has ceased, revoke the talent pool consent and request a documented, verifiable deletion or restriction with a concrete end date. This way you retain control without losing important evidence prematurely.
