How long can we keep candidate data?

Short answer: For the hiring purpose, then delete unless the candidate agrees

Only as long as you need it for the hiring purpose. If you want to keep CVs for future roles, ask the candidate. Background check reports are sensitive and should have a short retention and limited access.

What the law says

Section 8(7) asks for erasure when the purpose is over. Section 6 needs consent for keeping data for future roles.

Section 8(7) · Rule 8: Erase personal data when its purpose is over or consent is withdrawn, unless a law requires you to keep it, and have your processors erase it too. Rule 8(3) asks every Data Fiduciary to keep personal data, traffic data and logs for at least one year for purposes listed in the Rules.
Section 6: Consent must be free, specific, informed, unconditional and unambiguous, given by a clear action, limited to the data needed for the purpose, and as easy to withdraw as it was to give.
Section 5 · Rule 3: When you ask for consent, give a clear notice that stands on its own: what data, for what purpose, how to withdraw consent, how to use the rights and how to complain to the Data Protection Board. For data collected before the Act, a notice is due as soon as reasonably practicable.

Steps

Set a retention period for unsuccessful candidates.
Ask consent for the talent pool.
Limit access to background reports.
Delete on schedule.
Check job portal and recruiter vendor terms.

Evidence to keep

Retention setting in ATS
Talent pool consent
Deletion logs

Common mistakes

Keeping every CV forever
Recruiters with personal copies
Background reports in email

From each seat

DPO / Privacy lead: Candidates also ask what you hold.
HR head: Your largest data pile is usually candidates.
HR department: Set the ATS retention this month.

What a good answer from management sounds like

“Candidate data expires on schedule unless the candidate opts in, and background reports are restricted.” Effort and time: Light · 2 to 4 weeks.