⚡ Quick answer CV retention under POPIA comes down to purpose: keep an unsuccessful applicant’s CV only as long as the recruitment purpose justifies — typically three to twelve months with consent for a talent pool — keep hired employees’ records for the statutory employment periods, and securely destroy everything past its purpose. Every hiring round leaves a trail of CVs — in the inbox, in a shared drive, in a physical folder from the interviews. Under POPIA, CV retention is not an administrative afterthought: a CV is personal information, and keeping it ‘just in case’ is exactly what the Act’s purpose-limitation principle prohibits. The rules are simple once separated…