How long should a recruitment agency keep candidate records?
Recruitment is the opposite of the AML-driven professions on retention. There is no anti-money-laundering record-keeping floor here, and generally no statutory minimum for how long you must keep an unsuccessful candidate's file. So the risk is not keeping records too briefly, it is keeping them forever. APP 11.2 says you take reasonable steps to destroy or de-identify personal information once you no longer need it for any purpose and no law requires you to keep it. Your own employees' records are a separate question, with their own rule in s 535 of the Fair Work Act.
By Jon Oates, Founder of Privaproof · Last updated
General information, not legal advice. Privaproof is not a law practice.
The governing rule: destroy when no longer needed
Under APP 11.2, once you no longer need personal information for any purpose for which it may be used or disclosed, and no Australian law or court order requires you to keep it (APP 11.2(d)), you must take reasonable steps to destroy or de-identify it. APP 11.2 sets no period: the clock starts when the purpose ends. In recruitment there is usually no competing statutory duty forcing you to hold a candidate file, so this is the main constraint, and it points toward a defined period rather than indefinite retention. Over-retention also enlarges what APP 11.1 has to protect: in Australian Information Commissioner v Australian Clinical Labs Ltd (No 2) [2025] FCA 1224 the Federal Court ordered A$4.2 million of a A$5.8 million penalty for a security failure affecting 223,000 people.
What that means by record type
- Unsuccessful candidates. There is generally no statutory minimum. Set a defined retention period that reflects a genuine purpose (for example, considering them for similar roles for a limited time), tell them in your collection notice, and then destroy or de-identify. The question for your own system: does a candidate record carry a deletion date, or only a created date? Keeping every unsuccessful applicant forever is the classic over-retention breach.
- Placed candidates. You will usually keep more, and longer, because there is an ongoing relationship and legitimate records of the placement. Still hold only what you need, for as long as the purpose lasts.
- Sensitive screening results. Police checks and medicals should be held for the shortest time and destroyed early, given the higher harm if breached. Read: police checks and medicals
- Referee information. De-identify or destroy when the reason you held it has passed.
Where a real minimum does apply: your own staff
Do not confuse candidate records with your own employees' records. Section 535(1) of the Fair Work Act 2009 requires an employer to "make, and keep for 7 years, employee records of the kind prescribed by the regulations" for each of its employees, so the 7 years attaches to each record from when it is made. A candidate you place permanently with a client becomes that client's employee, so the client carries that duty. But temps and on-hire workers you employ and pay are your employees, and s 535 reaches their records. Under s 557C, an employer that failed to keep a required record carries the burden of disproving an allegation in proceedings about a civil remedy provision, unless it provides a reasonable excuse. Read: employee records vs candidate records
Separately, your agency keeps its own business and tax records for the ATO's general 5-year period (Income Tax Assessment Act 1936 s 262A), measured from when you prepared or obtained the record or completed the transactions it relates to, whichever is later. That is your financial records, not a reason to keep candidate files.
Common questions
Is there a legal minimum for keeping a candidate's application?
Generally no. Unlike the AML-regulated professions, recruitment has no anti-money-laundering retention floor, and there is usually no statute requiring you to keep an unsuccessful applicant's file. So you set a reasonable, purpose-based period yourself, and APP 11.2 then requires you to destroy or de-identify once the purpose has passed and no law requires you to keep it.
Can we keep candidates on file forever in case a role comes up?
Only if you have a genuine, disclosed purpose and a real limit. "Forever, just in case" is the over-retention trap. A defined period for considering similar roles, told to the candidate up front, is defensible; indefinite retention of every applicant is not.
We keep staff records for 7 years, so do candidates get 7 years too?
No. The 7-year rule in s 535(1) of the Fair Work Act is about your own employees' records, not candidates. It can reach a temp or on-hire worker you actually employ, but it never reaches an unsuccessful applicant. Applying it to candidate files is a common mix-up that leads to holding candidate data far longer than you can justify.
This is general information and document templates you tailor to your own business, not legal advice. Privaproof is not a law practice and does not provide legal advice. Retention periods depend on your purposes and any laws that apply to your situation, so confirm your own position. For advice on your specific circumstances, consult a qualified Australian legal practitioner.