I managed to make it to Tuesday this week before being told with complete confidence...
"The rules state the data needs to be kept for..... (insert random time period here)"
I'm going to focus on the recruitment industry in this post as there seems to be a lot of confusion to what the right time period is ...
There isn't one. or more accurately there isn't a documented one.
A lot of other industries are in the same boat however recruiters have to hold, as a bare minimum, Personally Identifiable Information (PII), Email, Telephone, Address. They may without any knowledge also store Sensitive PII , (as prospective candidates may include health, social and ethnic information within a CV without the knowledge of the recruiter) and if you happen to run a fast moving temp desk you will also have banking and national insurance data. You really need an answer here.
In the ICO's reference document "The Guide to Data Protection" principle 5 covers retention and at no point are specific timescales mentioned. In the 88 pages that make up the EU GDPR regulation the same is true and without an oversight organisation dictating the rules there is no mandatory answer.
Until there is as a business you need to look critically at the data you store and make informed and I'd recommend severe choices.
If you regularly place candidates years after they first registered with you could justify keeping data for many years provided you actively re-engage and continue to obtain consent. Alternatively stating that you want to retain all records until a candidate retires, (yes I've had that suggested to me), probably isn't going to wash especially if you specialise in placing school leavers and graduates.
If you run payroll, that's 7 years retention needed but critically only for that data set, you may have to still delete CVs and some email conversations much earlier than that.
If you need support in continuing to retain consent, want to understand what your placement profile is or want an external specialist to ask the hard questions give me a call.
A thought to leave you with:
If you have sent a CV to a client and the candidate was unsuccessful set a reminder to go back 6 months later and ask for the data to be deleted. The client at that point has no legitimate business need to retain it after this point as the 3 month window for claiming unfair recruitment practices, plus the 3 month arbitration exception period will have passed