Recruitment records can include applications, interview notes, referee information and sensitive details about adjustments or checks. An employer needs to know what is collected, why it is needed, who can access it and what happens when recruitment ends.
Do not copy an employee-record retention period into a candidate spreadsheet without checking its basis. Privacy coverage, other legal requirements and the circumstances of the recruitment exercise need to be considered together.
Check the applicable obligations
The OAIC’s employee-records exemption guidance explains that the exemption does not cover future employment relationships, including unsuccessful applicants. It also describes limits concerning contractors handling employee information.
That does not mean every organisation and record has identical obligations. Identify the applicable privacy framework and obtain appropriate advice where coverage or another record-keeping requirement is uncertain. A general assumption that “these are HR files” is not enough.
Keep the recruitment process consistent with the organisation’s actual privacy notices and approved policies. Do not promise confidentiality or deletion that the organisation cannot deliver.
Map information across the process
Prepare an original record inventory with:
- Information: the specific record or data category.
- Purpose: why it is needed at this recruitment stage.
- Source: applicant, referee, assessor or another authorised source.
- Access: roles that need it and the approved storage location.
- Transfer: any agency, service provider or other recipient involved.
- Retention basis: applicable requirement or approved decision still to confirm.
- Disposal action: authorised process when information is no longer required.
- Owner: the person responsible for reviewing the record category.
Map copies as well as the main system. An application exported to a personal download folder remains part of the information-handling problem.
Limit collection and unnecessary sharing
Ask what information is genuinely required now. A shortlisted assessment panel may need relevant application evidence, while an appointment scheduler may need only contact and availability details.
Use approved channels for checks and sensitive information. Do not place medical details, identity documents or complete referee reports into a broadly accessible recruitment tracker simply because the tracker is convenient.
The OAIC’s employment privacy information also discusses access and correction in relation to job applications. Refer requests to the responsible privacy contact rather than promising that interview notes can never be accessed.
A fictional record review
In this invented example, an employer finds copies of interview notes in both the approved recruitment folder and an unrestricted meeting folder. The records owner reviews access, checks what must be retained and arranges the authorised handling of unnecessary copies.
The team does not immediately delete everything to make the issue disappear. It checks any preservation, incident-response or other applicable requirements and records the decision through the proper process.
Close recruitment with a defined review
At the end of the exercise, confirm which records remain necessary, the basis for keeping them and the next review date. If future-opportunity retention is proposed, check the relevant notice and authority rather than assuming the original application permits every later use.
Avoid a universal number of months or years in an informal guide. A useful recruitment record process can explain each information category, its access controls and the reason for its retention or disposal, with an accountable owner for unresolved questions.
