You applied for something in March, heard nothing, and forgot about it. In September a recruiter from that company emails about a different role and quotes a line from the summary you have since rewritten. Somewhere in their system is a version of you from six months ago, and nobody asked whether you still wanted it there.
Most advice on this question is written for employers, by law firms, and answers the only question employers ask: what is the minimum we must keep? Almost nothing is written for the person whose résumé it is. This piece is the other side of that. What follows is drawn from the regulators themselves and from the published documentation of the software doing the storing, rather than from the recycled six-month rule of thumb that appears on every recruiting blog with no source attached.
Where your résumé actually goes when you apply
One click on “Apply” usually produces three separate records, held by three different parties under three different rules. Almost every frustrating thing about deleting your data comes from people treating them as one.
- The job board's copy. The profile and stored résumé on LinkedIn, Indeed, SEEK or Reed. This one is yours to manage: you can edit it, hide it from search, or delete the whole account without asking anybody.
- The employer's copy, inside their applicant tracking system. A separate record in Workday, Greenhouse, SmartRecruiters, Taleo or whatever the company runs, created the moment your application lands. Deleting the job board profile does nothing to it. This is the copy that resurfaces in September.
- Whatever somebody downloaded. A PDF a hiring manager saved to their laptop, a file forwarded to a panel, a copy an agency put in its own database when it submitted you. This copy is real, it is common, and no deletion process reliably reaches all of it.
If you only remember one thing, make it this: deleting your account on a job board does not delete the applications you already sent through it. Indeed's help centre is explicit that changing your privacy settings will not affect previous applications. Those went to employers, and they live in the employers' systems now.
What the law actually makes an employer keep
This is where the six-month rule of thumb comes from, and it is wrong almost everywhere. Only one of the four big English-speaking job markets names a number in law, and the number is not six months.
United States: one year, and then it depends
The EEOC's recordkeeping requirements state plainly that under Title VII and the ADA, “EEOC Regulations require that employers keep all personnel or employment records for one year.” Your application is a personnel or employment record. That is a floor rather than a ceiling: it says how long they must keep it, and nothing at all about when they have to stop.
There is a second rule underneath it that surprises people. If anyone files a charge of discrimination, the same guidance says records “must be kept until the final disposition of the charge or any lawsuit based on the charge”, defined as either the expiry of the 90-day period to file suit or the date litigation ends including appeals. A charge does not have to be yours. If a rejected applicant from your hiring round files one, the whole applicant pool becomes evidence, and asking for your file to be deleted in the middle of it will not get you very far.
United Kingdom: no number, just a question
UK law sets no retention period for recruitment records whatsoever. The ICO's draft guidance on keeping recruitment records says so in as many words: “Under data protection law, you must not keep information for longer than you need to. However, it does not specify timescales for keeping recruitment records.”
What it does give employers is an anchor, and it is a useful one to know as a candidate. Its worked example says that, absent a clear business reason, an employer “should not keep recruitment records for unsuccessful candidates beyond the statutory period in which an applicant can bring a claim arising from the recruitment process”. For most claims that window is short: GOV.UK says you usually have to make an employment tribunal claim “within 3 months of your employment ending or the problem happening”. So a UK employer sitting on your file two years after a rejection is not following the regulator's own reasoning, and saying that back to them is more effective than quoting the regulation.
Australia: destroy it once you no longer need it
Australia takes the same approach as the UK but states the destruction duty more directly. The OAIC's APP Guidelines chapter 11 summarise APP 11.2 as requiring an entity to “take reasonable steps in the circumstances to destroy or de-identify the personal information it holds once the personal information is no longer needed for any purpose for which the personal information may be used or disclosed”, unless it is part of a Commonwealth record or a law or court order requires it to be kept.
One quirk worth knowing if you are in Australia: the much-discussed employee records exemption applies to records about the employment relationship of current and former employees. A rejected candidate is neither, so it is the wrong thing to be told when you ask.
Canada: it depends who is hiring you
Canada is the awkward one, and it is worth checking before you write to anybody. The Office of the Privacy Commissioner of Canada is direct that the federal private-sector law's coverage of employment “is limited to the federally-regulated sector”: banking, telecoms, broadcasting, aviation, interprovincial transport and so on. Applying to a bank and applying to a retailer put your file under different regimes. Outside that sector, provincial law decides, and Alberta, British Columbia and Quebec each have their own private-sector statute while other provinces have none covering private employment.
The practical upshot: in Canada, ask first and cite second. “Please confirm what you hold about my application and delete what you no longer need” works everywhere. Naming the wrong statute invites a reply explaining why it does not apply, which is not the conversation you wanted.
What the software is set to do, and why it usually does nothing
Here is the part almost nobody writes down, and it explains most of the six-month-old résumés resurfacing in recruiters' inboxes. Applicant tracking systems ship with retention timers, and the timers do not delete anything.
Greenhouse is a good example because its documentation is public. Its guide to configuring a data retention rule tells an employer to “input how long (in days) your organization wishes to retain candidate personal data”, per office. There is no default. Somebody at the company has to choose the number, and then somebody has to act on it: once the timer lapses for a rejected candidate, “a specified user is notified that they should manually delete the data”, and the documentation states flatly that “deleting a candidate's personal data must be done manually”.
The copies you can delete yourself today
Before writing to any employer, clear the copies that are actually under your control. This is the fastest part and the part most people skip.
- LinkedIn. Closing the account is a real deletion on a stated clock: LinkedIn's privacy policy says “we generally delete closed account information within 30 days of account closure”, with exceptions for legal obligations, disputes, security and fraud. If you would rather keep the profile, turn off the setting that lets recruiters see you are open to work and remove any résumé file saved on your Easy Apply profile.
- Indeed. Deletion runs through a personal data request form rather than a button, and Indeed's help centre says “each request takes about a month”. Do the export first if you want your own application history; once it is gone, it is gone. A linked Glassdoor account has to be deleted separately.
- Agency and recruiter databases. These are the copies people forget, and often the oldest. If you registered with a staffing agency in 2019, they still have the file. They are a separate data controller from the employers they submitted you to, and they have to answer a request in their own right.
- Your own trail. Old résumé files in a shared drive, a public portfolio page with a phone number on it, a document set to “anyone with the link”. None of this is regulated by anybody, and it is the version most likely to be out of date.
What none of that touches is the employer's copy of an application you already submitted. That needs an actual request.
How to ask an employer to delete your file
Send it in writing, to the address in their privacy notice or careers page, and keep it short. Long requests get escalated to legal and slow down; short ones get actioned. You do not need to cite a regulation, and in most cases you should not, because an employer that has to check whether you are right will take longer than one that simply agrees.
I am writing to formally invoke my rights under all applicable data protection legislation to demand the immediate and permanent erasure of any and all personal data your organisation may hold concerning myself, in any form whatsoever.
I applied for the Operations Coordinator role (ref OPS-4417) on 14 March 2026 using this email address. Please delete my application and résumé from your recruitment records, and confirm when it is done. If you need to keep anything, please tell me what and why.
The second version works better for a reason that has nothing to do with politeness. Recruitment records are searched by name, email and requisition, so giving all three turns a hunt into a lookup. And asking them to say what they are keeping and why is the part that gets you useful information: a company that has to write down its reason usually finds it only has one for a fraction of the file.
What happens next, and how long it takes
- In the UK and the EU, one calendar month. The ICO states that “an organisation has one calendar month to respond to your request”, and that in certain circumstances they may take up to two extra months if they tell you within the first month why.
- Expect a partial deletion rather than a clean one. The ICO also lists when an organisation can refuse, including where keeping the data “is necessary for establishing, exercising or defending legal claims”. An employer keeping the bare fact that you applied and were not hired, while deleting the résumé and the interview notes, is behaving normally.
- They must still reply if they say no. Per the ICO, an organisation that decides it does not need to erase your data “must still respond”, explain why, and tell you about your right to complain to the ICO or through the courts.
- In California, the same right exists and is newer than people realise. The California Attorney General's July 2023 announcement notes that “effective January 1, 2023, covered businesses must also comply with the CCPA's robust privacy protections as it relates to employee data”, covering requests “to access, delete, and opt out of the sale and sharing of personal information” for employees, job applicants and independent contractors alike.
- Elsewhere in the US, there is usually no individual right to force it. Most states have no equivalent, so outside California and the handful of states with comparable laws, a deletion request to an employer is a courtesy ask. It still frequently works. Ask anyway.
The more useful request: ask what they hold
If you are in the UK, the EU or California, there is a second request available that most candidates never make, and it is often the one worth making. Rather than asking an employer to delete your file, ask them for a copy of it.
The reason is that the file is not just your résumé. It usually contains the screening notes, the interview scores, any assessment result, and the internal comments attached to your record. The ICO's recruitment guidance takes for granted that this happens: it warns employers that destroying records too quickly makes it “more difficult for you to prove that your end-to-end process is transparent, fair and accountable”, “in particular, as candidates may make a SAR for their information”. The regulator is telling employers to expect the request.
When you would rather they kept it
Deleting everything is not automatically the right move, and it is worth being deliberate about which files you clear.
- A company you would still work for. Talent pools are real and they do produce calls. If the reason your résumé is still on file is that somebody flagged you as a near miss, that is an asset.
- A live process you might dispute. If you think a rejection was discriminatory, the employer's records are the evidence. Ask for a copy before you ask for a deletion, and do not ask for deletion at all until you have decided.
- An application under a year old in the US. They are required to keep it. A request will be declined, correctly, and you will have spent the email for nothing.
- Anything you would rather have current than gone. Often the real problem is not that an old résumé exists, it is that it is out of date. Sending an updated one and asking them to replace what they hold solves that better than deletion does.
That last point is the one that matters most in practice. If a recruiter is quoting a six-month-old summary back at you, the fix is a better current document rather than an argument about storage. Our guide to pulling keywords out of the job description covers what to change, the free ATS score check shows which of a posting's terms your résumé is missing before you send it, and what employers actually verify is worth reading before you rewrite anything you would not want checked. If the file you are chasing is stuck in a portal that has not moved for weeks, what those status labels mean is the shorter answer.
Send a résumé you would not mind them keeping
Paste the posting and see which of its terms your résumé is missing. Free to run.
Frequently asked questions
How long do employers keep resumes on file?
In the United States there is a legal minimum rather than a maximum: the EEOC's recordkeeping requirements state that employers must keep all personnel or employment records for one year, and until final disposition if a discrimination charge is filed. In the UK and Australia no period is set in law at all, and the test is whether the employer still needs the information. In practice the answer for any given company is whatever number somebody typed into their recruiting software, and whether anyone has acted on the reminder it produces.
Can I ask a company to delete my resume?
You can always ask, and it often works. Whether they must comply depends on where you are. In the UK and the EU the right to erasure applies and the organisation has one calendar month to respond. In California the CCPA has covered job applicants since 1 January 2023, giving rights to access and delete. In most other US states, and for many Canadian employers outside the federally regulated sector, there is no individual right to force deletion, so it is a courtesy request. Send it in writing with the role, the reference number and the date you applied.
Does deleting my Indeed or LinkedIn account delete my job applications?
No. It deletes the profile and the copy stored on that platform, not the applications you already sent, which now sit in each employer's own system as separate records. Indeed's help centre notes that changing your privacy settings will not affect previous applications. LinkedIn's privacy policy says it generally deletes closed account information within 30 days of closure, with exceptions, but that is LinkedIn's copy only. Every employer you applied to has to be asked separately.
How long does an applicant tracking system keep candidate data?
For as long as the employer configured, and often longer. Greenhouse's documentation asks the employer to input a number of days per office and sets no default, and when the timer lapses “a specified user is notified that they should manually delete the data”. The deletion itself “must be done manually”. So the retention rule is really a reminder to a person, which is why old candidate records are so common and why a direct request from you tends to move faster than the timer does.
Can I see the interview notes an employer wrote about me?
In the UK, the EU and California, usually yes, through a subject access request or the equivalent access request. Interview notes, screening comments and scoring grids attached to your record are your personal information. The ICO's draft recruitment guidance explicitly warns employers not to destroy recruitment records too quickly partly because “candidates may make a SAR for their information”. Expect other people's names and some internal commentary to be redacted, and expect a reply within one calendar month.
Why did a recruiter contact me about a job I applied for months ago?
Because their copy of your application is still in the system and somebody searched it. That is normally lawful and often deliberate: the ICO's guidance describes employers keeping high-scoring candidates on a shortlist for later vacancies, on the condition that candidates were told on the application form that this would happen and for how long. If you were never told, that is worth asking about. If you would take the call, there is nothing to fix.
Should I delete my resume from old job applications?
Usually only where you would not want the company contacting you, or where the résumé is badly out of date. An old file at an employer you would still join is closer to an asset than a liability. Where the problem is that the version they hold is stale, the better move is to send a current one and ask them to replace what they have, which takes the same single email and leaves you in the pipeline rather than out of it.
Is there a time limit on how long a recruitment agency can keep my CV?
No fixed period in the UK, Australia or Canada, and none in most of the US. An agency is a separate data controller from the employers it submits you to, which cuts both ways: their retention is their own decision, but a deletion or access request to them has to be answered on its own terms rather than passed to a client. Agencies also tend to hold the oldest copies of anyone's CV, so they are the first place worth asking.