CV Retention Rules: How Long May You Keep Job Applications?
Every hiring round leaves a trail of CVs — in the inbox, in a shared drive, in a physical folder from the interviews. Under POPIA, CV retention is not an administrative afterthought: a CV is personal information, and keeping it ‘just in case’ is exactly what the Act’s purpose-limitation principle prohibits. The rules are simple once separated into the two files every employer actually has: the applications that went nowhere, and the ones that became employees.
- ✔POPIA allows personal information to be kept only as long as the purpose requires.
- ✔Unsuccessful CVs: a short, defined period — get consent if you want a talent pool.
- ✔Hired employees: the CV moves into the employee file with statutory retention periods.
- ✔BCEA records must be kept for three years; some UIF and EE records run longer.
- ✔Destruction must be secure — shredding or permanent deletion, not the recycling bin.
CV retention for unsuccessful candidates
The recruitment purpose ends when the position is filled. From that point, holding rejected CVs needs its own justification. Good practice: keep them for a short, defined window — three to six months — to answer any dispute about the hiring decision, then destroy. If you want to keep promising candidates on file for future roles, that is a new purpose, and the clean way to do it is consent: tell applicants their CV will be kept for up to twelve months for future vacancies and let them opt in.
What you may not do is build a shadow database of everyone who has ever applied, kept indefinitely without consent. That is the pattern POPIA complaints are made of. How this fits the wider record-keeping picture is in the employee data retention guide.
CV retention after hiring: what moves into the employee file
The successful candidate’s CV becomes part of the employee record, and different clocks start. The BCEA requires core employment records to be kept for three years; employment equity records for designated employers and various UIF and tax records run longer — five years is the common safe horizon for payroll-related files. During employment, keep what the employment relationship actually uses; after termination, the statutory periods govern, as set out in what you tell employees about their data.
CVs carry ID numbers, addresses, sometimes photos and marital status — exactly the special and sensitive data POPIA guards hardest. Restrict who can open the recruitment folder, and never circulate shortlists by group email or WhatsApp.
Destroying records: the end of the CV retention line
POPIA requires destruction or de-identification once retention expires, and destruction must be secure: cross-cut shredding for paper, permanent deletion — not the recycle bin — for files, and certificates from any destruction vendor you use. Keep a simple destruction register: what was destroyed, when, by whom. It is a one-line-per-event document that answers the Regulator’s favourite question instantly.
Put the two rules together and the policy writes itself: recruitment file, short window, consent for longer; employee file, statutory periods, secure destruction at the end. The complete POPIA framework for employers is in the POPIA pillar guide, and the hiring-side paperwork is in the hiring pillar guide.
- Information Regulator (South Africa)
- Protection of Personal Information Act
- Basic Conditions of Employment Act
Always confirm current requirements with the official source — rules and deadlines change.
- ✔Admin Boss handles registrations, filings and payroll admin
- ✔Registered tax practitioner · 20+ years experience
- ✔Fully remote — all 9 provinces
Frequently asked questions
How long may I keep CVs of unsuccessful applicants?
Only as long as the recruitment purpose justifies — typically three to six months to handle disputes about the hiring decision. Keeping CVs longer for future vacancies requires the applicant's consent, usually up to twelve months.
How long must employee records be kept in South Africa?
The BCEA requires core employment records for three years. Payroll, UIF and employment equity records commonly need five years or more. After the applicable period, records must be securely destroyed or de-identified under POPIA.
Can I keep a database of past job applicants?
Only with consent. A talent pool of unsuccessful candidates is a new purpose beyond the original recruitment, so POPIA requires you to tell applicants and get their agreement, define the retention period, and honour objections.
Last reviewed: July 2026 · How we research our guides
EmployerGuide.online provides general information about South African employer obligations — not legal, tax or professional advice for your specific situation. Laws, rates and deadlines change; confirm current requirements with the official sources linked above, or ask Admin Boss. See our disclaimer.