Right to Be Forgotten

## Legal Basis and Rights

The right to be forgotten (formally, the right to erasure) is a GDPR Article 17 right allowing data subjects to request deletion of their personal data. In recruitment context, candidates can request their CVs, interview notes, application data, and all related records be deleted. This right isn't absolute—legitimate legal interests (like employment dispute defense) can override it—but recruitment firms must have clear policies and processes to handle deletion requests.

## Retention vs. Deletion Tensions

Recruitment firms face genuine tension between GDPR deletion obligations and professional best practices. Retaining records protects firms against future disputes with candidates or clients over hiring decisions. However, GDPR requires clear justification for any retention beyond the hiring process conclusion. Best practice is developing tiered retention policies: immediate-use data deleted after hire decision, contingent retention for potential disputes (typically 6-24 months), and archival of hired employee records transferred to HR systems.

## Process Implementation

Effective right-to-be-forgotten management requires: clear policies defining retention timeframes, documented processes for receiving and processing deletion requests, technical capability to identify and delete all candidate data across systems, and audit trails documenting deletion. Many firms struggle with deletion because candidate data is scattered across ATS, email, personal notes, and external systems.

## Strategic Data Governance

Progressive firms view GDPR deletion obligations as prompting better data governance overall. By implementing clear retention and deletion policies, firms reduce data storage costs, minimize liability, and demonstrate respect for candidate privacy. Transparency about data usage and clear deletion processes also strengthen employer brand with candidates increasingly concerned about privacy.