When you click submit on a job application, you are not sending a CV into a void. You are creating a record in an applicant tracking system, and that record usually outlives the job opening by a long way. Knowing what sits in it, how long it stays there and how to see or remove it is less complicated than most people assume.
What the record actually contains
Most candidates picture a single entry: name, email, CV. The real record is closer to a case file that grows every time a recruiter touches it.
A typical candidate profile in a modern ATS holds:
- Every application you have made to that employer, not just the latest one, each tied to a specific requisition.
- Parsed fields pulled from your CV: job titles, dates, employers, skills, education, sometimes a salary expectation you typed into a form.
- Attachments in their original form, including cover letters and portfolio files, plus the parsed text version the system extracted.
- Recruiter and hiring manager notes, from a one-line "strong on SQL, weak on stakeholder stuff" to full interview feedback forms.
- Stage history, meaning a timestamped trail of every move: applied, screened, phone interview, rejected, with who moved you and when.
- Rejection reason codes, the short dropdown labels recruiters pick when they close your application, such as "not enough experience" or "position filled".
- Assessment results from coding tests, personality questionnaires or video interviews, often stored as scores or reports from a third-party tool.
- Communication logs: emails sent through the platform, interview invites, sometimes internal messages about you.
Equal opportunity and diversity monitoring answers are usually kept apart from this profile, with restricted access, so they do not show up next to your CV for the hiring team.
The notes and reason codes are the part people rarely think about. They are written quickly, for internal use, and nobody expects the candidate to read them. In many places, you are entitled to read them anyway.
How long an ATS keeps candidate data
Here is where expectations and reality drift apart. Many people assume the file is deleted once the role is filled. In practice, employers tend to keep candidate records for a set period after the process ends, and that period is written in their privacy notice for applicants.
There is no single worldwide number. What you will commonly see is a period of months to a couple of years, but check the notice, because it varies by employer and by country. Some regulators have published guidance on this. The French data protection authority, the CNIL, for example, has issued recommendations on how long unsuccessful candidates' data should be kept and on asking for consent before keeping it longer.
Why does it often run longer than you would expect? A few practical reasons:
- The employer wants to defend itself if a rejected candidate later alleges discrimination, and the records are its evidence.
- Recruiters want to reuse strong profiles for future openings rather than pay to source them again.
- Nobody configured automatic deletion, so the data simply sits there. This is more common than any company would admit.
That last one matters. Retention periods are often a policy on paper and a manual cleanup job in reality. A privacy notice saying "we keep your data for a limited period" does not guarantee someone actually ran the purge.
Your right to see what they hold
Whether you have a right to access your record depends heavily on where the employer is and where you are.
In the EU, the GDPR gives you the right to obtain a copy of the personal data an organisation holds about you. In the UK, UK-GDPR gives the same right, and the ICO publishes guidance on it. This is usually called a subject access request, or SAR.
In the US, it is patchier. There is no general federal right of this kind for job applicants. Some states have privacy laws that reach applicant data, California's being the most cited, but coverage depends on the state, the size of the employer and the specific law. In many situations the right is weaker or simply absent. If you are outside Europe, look at the employer's privacy notice first: it usually tells you what rights it recognises and how to use them.
Who to write to
Look for a data protection contact in the privacy notice for candidates. It is often a dedicated email address or a named Data Protection Officer. If you cannot find one, write to the HR or recruitment team and ask them to forward it. Note that the employer, not the ATS vendor, is normally the one responsible for your data, so write to the employer.
What to ask for
Be specific enough that nothing gets left out:
- A copy of all personal data held about you in their recruitment systems, including notes, interview feedback, assessment results and stage history.
- The purposes for which it is used and who it has been shared with, such as assessment providers.
- How long they intend to keep it.
What you typically get back
Expect a zip file or a set of PDFs: your profile export, your CV, maybe a spreadsheet of stage changes. Interview notes are sometimes included and sometimes summarised. Organisations can hold back certain material in limited cases, for example where it would reveal someone else's personal data. Under GDPR regimes there is a response deadline, usually around a month, with extensions possible for complex requests.
Reading your own reason codes can be sobering. It can also be useful: "overqualified" tells you something different from "missing required certification".
Asking for deletion
The companion right, again mostly in GDPR territory, is the right to erasure. You can ask the employer to delete your data. It is not absolute: an employer may keep some records if it has a legal reason, for instance to handle a possible claim. But for a closed application with no dispute, deletion requests are generally honoured.
Keep the request short. Something like this works:
"I applied for [role] in [month and year]. Please delete all personal data you hold about me in your recruitment systems, including my candidate profile, attachments, notes and assessment results, and confirm when this is done. If you need to keep any data, please tell me what and why."
Send it to the same contact as an access request. If you also want a copy first, ask for access, wait for the file, then request deletion. Doing both at once can mean the copy never arrives because the data is already gone.
If the employer ignores you and you are in the EU or UK, you can complain to the national regulator: the ICO in the UK, the CNIL in France, and equivalent bodies elsewhere. This article is general information, not legal advice, and rules differ by country and situation.
The trade-off nobody mentions
Deletion is clean, but it has a cost. Many employers search their existing database before posting a new role, pulling up past applicants who looked promising. That is a real source of interviews, and the separate piece on talent pools covers how that resurfacing works.
Once your record is erased, you drop out of that search. If you liked the company and simply lost out to one other finalist, deleting your profile may close a door you wanted open. On the other hand, if the process was a bad experience, or you applied with an outdated CV you would rather not have on file, deletion is a reasonable choice.
A middle path exists: ask for access, read what they have, and correct anything inaccurate instead of deleting everything. Correction is also a recognised right under GDPR.
A practical routine
Keep a simple list of employers you have applied to, with the date and the contact address from their privacy notice. Every six months or so, go through it. For companies you would still consider, leave the record alone and make sure your next application uses an up-to-date CV. If you build it from your LinkedIn profile with a tool like Postulit, keeping the two consistent is easier, and the version stored in their ATS matches the one you actually stand behind.
For companies you are done with, send the short deletion request above. It takes five minutes per employer, and it is the only reliable way to know that the old notes and reason codes about you are gone.