How long should a recruitment agency keep candidate records?

Recruitment is the opposite of the AML-driven professions on retention. There is no anti-money-laundering record-keeping floor here, and generally no statutory minimum for how long you must keep an unsuccessful candidate's file. So the risk is not keeping records too briefly, it is keeping them forever. APP 11 says you destroy or de-identify personal information once you no longer need it for any purpose. Your own employees' records are a separate question with their own rule.

By Jon Oates, Founder of Privaproof · Last updated 23 July 2026

General information, not legal advice. Privaproof is not a law practice.

The governing rule: destroy when no longer needed

Under APP 11, once you no longer need personal information for any purpose for which it may be used or disclosed (and you are not required by law to keep it), you must take reasonable steps to destroy it or de-identify it. In recruitment there is usually no competing statutory duty forcing you to hold a candidate file, so this destruction duty is the main constraint, and it points toward keeping candidate data for a defined, defensible period rather than indefinitely.

What that means by record type

Unsuccessful candidates. There is generally no statutory minimum. Set a defined retention period that reflects a genuine purpose (for example, considering them for similar roles for a limited time), tell them in your collection notice, and then destroy or de-identify. Keeping every unsuccessful applicant forever is the classic over-retention breach.
Placed candidates. You will usually keep more, and longer, because there is an ongoing relationship and legitimate records of the placement. Still hold only what you need, for as long as the purpose lasts.
Sensitive screening results. Police checks and medicals should be held for the shortest time and destroyed early, given the higher harm if breached. Read: police checks and medicals
Referee information. De-identify or destroy when the reason you held it has passed.

The one place a real minimum applies: your own staff

Do not confuse candidate records with your own employees' records. Where you employ people, the Fair Work Act requires an employer to keep certain employee records for 7 years. That duty is about your own current and former staff and sits on the employer, and it is separate from candidate data. A candidate you place with a client generally becomes the client's employee, not yours, so the client carries that record-keeping duty for them, not you. Read: employee records vs candidate records

Separately, your agency keeps its own business and tax records for the ATO's general period of about 5 years, but that is your financial records, not a reason to keep candidate files.

Common questions

Is there a legal minimum for keeping a candidate's application?

Generally no. Unlike the AML-regulated professions, recruitment has no anti-money-laundering retention floor, and there is usually no statute requiring you to keep an unsuccessful applicant's file. So you set a reasonable, purpose-based period yourself, and APP 11 requires you to destroy or de-identify once the purpose has passed.

Can we keep candidates on file forever in case a role comes up?

Only if you have a genuine, disclosed purpose and a real limit. "Forever, just in case" is the over-retention trap. A defined period for considering similar roles, told to the candidate up front, is defensible; indefinite retention of every applicant is not.

We keep staff records for 7 years, so do candidates get 7 years too?

No. The 7-year Fair Work rule is about your own employees' records, not candidates. Applying it to candidate files is a common mix-up that leads to holding candidate data far longer than you can justify.

This is general information and document templates you tailor to your own business, not legal advice. Privaproof is not a law practice and does not provide legal advice. Retention periods depend on your purposes and any laws that apply to your situation, so confirm your own position. Privaproof's recruitment documents are self-authored and are not independently reviewed by a solicitor. For advice on your specific circumstances, consult a qualified Australian legal practitioner.