Applications from candidates you did not hire may only be kept while you have an objective need, and the Danish Data Protection Agency accepts at most 3 years after recruitment ends without very special reasons. If you only need them for 6 months, delete them after 6 months. Write down your reasoning so you can explain the deadline if asked.
GDPR
GDPR in recruitment: applications, references and deletion
How to handle applicant data lawfully in Denmark: information duty, how long you may keep applications, references, criminal records, child-protection certificates and social media — based on Datatilsynet’s guidance.
Step-by-step guide
- 1
Tell applicants what you do with their data
When you receive an application, you must tell the applicant who the data controller is, what the data is used for, your legal basis, how long it is kept and what rights they have (GDPR Article 13). It can be in the job ad, an auto-reply or a page you link to. One standard text used in every recruitment is enough.
- 2
Collect only what you need
Ask only for information you need to assess whether the person fits the role. There is usually no reason to collect a CPR number before hiring. Ask about health only if it matters for whether the person can do the specific job. Share applications with those involved in the recruitment — not the whole company.
- 3
References: inform the candidate
According to the Danish Data Protection Agency, references should not rely on consent but on a balancing of interests (GDPR Article 6(1)(f)). That means you must tell the candidate that you collect references and what you ask about. It is good practice to ask the candidate whom you may contact. Note only what is relevant for the role.
- 4
Criminal records and child-protection certificates
Private employers may only obtain a criminal record when it is objectively relevant for the specific role — for example a bookkeeper or a job with access to people’s homes — and only once the candidate is under consideration. A general policy of obtaining criminal records for everyone is not acceptable. A child-protection certificate (børneattest), however, must be obtained when hiring people who will have direct contact with children under 15.
- 5
Social media and tests
You may use information the applicant has published themselves, for example on LinkedIn, but the basic principles apply: only relevant information, and the applicant should be able to know that you look. Personality and skills tests require the applicant’s active participation; explain what the test is used for and who sees the result.
- 6
Delete after a fixed deadline
Set a fixed deletion deadline for applicants you did not hire, and include it in your privacy text. The Danish Data Protection Agency accepts up to 3 years after recruitment ends, but only if you need the data, for example to document an objective selection. If you do not need it that long, delete it sooner — many choose 6 months. Remember emails, shared drives and printed CVs.
Ready to get started?
Create your company on Arbejd.com and start using GDPR straight away.
Frequently asked questions
Yes, if the applicant consents. Consent must be freely given and specific, the applicant must know how long the application is kept, and withdrawing consent must be as easy as giving it. Without consent the application must be deleted after the deadline you set for that recruitment.
No, as a rule there is no reason to collect CPR numbers during recruitment. Only when you hire do you need the CPR number for payroll, tax and ATP. Remove the field from application forms, and do not ask candidates for passports or health cards before employment is agreed.
Unsolicited applications follow the same rules as other applications: tell the applicant what you do with the data, and delete it when you no longer need it. If you want to keep the application for a future role, ask for consent. Reply to the applicant so they know what happens.
On Arbejd.com candidates are shown anonymously to businesses until you message them, and candidates control their own profile. When a candidate replies or applies for your job, you become an independent data controller for the information you receive. That is why the rules in this guide also apply to applications that come via Arbejd.com.