Can I keep a candidate's data if we might hire them in future?

Only if you have documented consent and an active hiring strategy for similar roles. If you're simply keeping files 'just in case,' that fails the necessity test under revDSG. A vague possibility of future hiring is not a lawful basis. Set a retention schedule—6 to 12 months for rejected candidates—and honor erasure requests after that period.

What if my ATS does not support data deletion?

You must still comply with the deletion request. Work with your ATS vendor to delete the candidate record, or export the data and remove it manually. The limitations of your software do not override the candidate's legal right. If your tool cannot support revDSG, consider switching vendors or implementing a workaround immediately.

Do I have to delete data if the candidate became an employee?

No. Once someone is employed, their data (CV, employment contract, payroll records, working time reports) falls under employment and tax law, not just recruitment law. You must retain payroll data for at least five years per VAT and income tax rules. However, you may still delete extraneous recruiting materials (interview notes, rejected-candidate flags) unless they're legally required.

Right to Erasure for Candidate Data

The right to erasure (or "right to be forgotten") is a candidate's legal entitlement to request that you delete their personal data from your recruiting files. Under Swiss data protection law (revDSG), candidates can demand deletion when data is no longer needed, collected unlawfully, or when they withdraw consent. You must respond within 30 days, though exceptions exist—for example, if you must keep records for payroll or legal reasons.

Also available inDeutsch Français Italiano

When a candidate applies for a role at your SME, you collect CV, contact details, and interview notes. Once you hire someone else or the role closes, that candidate data sits in your files. Under revised Swiss Data Protection Act (revDSG), candidates have the right to ask you to delete it.

This right is not absolute. You may legally retain some data for tax, employment contract, or statutory purposes. The key is knowing which data must go, which can stay, and how quickly you must act.

When the Right to Erasure Arises

A candidate triggers this right by explicitly requesting deletion—usually in writing, sometimes via email or contact form. Common scenarios: after rejection, when withdrawing consent to data processing, or years after a rejected application sits unused in your system.

Swiss law (revDSG) recognizes erasure requests when data is no longer necessary for the recruiting purpose, was collected illegally, or when the candidate withdraws consent. You cannot simply ignore the request or delay indefinitely.

Candidate applies, you reject them, they email asking you to delete their data
You store CV and interview notes from a hiring campaign that ended two years ago
Candidate explicitly did not consent to data retention after the role closed
Data was collected without proper consent notice at application
Candidate exercises their revDSG right in writing or through your system

Your Legal Obligation

You must respond to a deletion request within 30 days (revDSG Article 17). If you can delete the data, do so and confirm completion. If you have a lawful reason to retain it—payroll records, proof of application for audits, or an active employment contract—you must clearly explain why deletion cannot happen.

Document your response. Keep a record that you received the request, what you decided, and why. This protects you if a complaint reaches your cantonal data protection authority (such as the Zurich, Geneva, or Bern DPA).

Acknowledge receipt within 10 days; resolve within 30 days total
Delete all personal data unless a legal basis (employment law, tax law) permits retention
Write a clear explanation if you deny erasure—don't simply refuse
Keep proof of your decision and the candidate's request in your files
Handle requests the same way for all candidates; do not discriminate
If you use an ATS or recruiting tool, verify it supports data deletion workflows

Most Common Mistake

The single biggest error: ignoring or delaying deletion requests because you assume all hiring data should be kept indefinitely. Many SMEs treat rejected-candidate CVs like archives, forgetting that retention must have a purpose.

You risk a fine from your canton's DPA if you keep personal data longer than necessary. Establish a clear data retention policy: typically 6–12 months for rejected candidates, unless legal obligation (like employment contract evidence) applies. Respond promptly and in writing—silence is not a valid answer.

Assuming 'we might hire this person later' justifies keeping data for years
Failing to respond or responding verbally without written confirmation
Deleting data but not documenting that you acted on the request
Retaining data 'just in case' without a clear, lawful purpose
Not training yourself or your team on revDSG erasure obligations
Using excuses like 'it's in our backup' or 'our IT can't delete it quickly'

Frequently asked questions

Can I keep a candidate's data if we might hire them in future?: Only if you have documented consent and an active hiring strategy for similar roles. If you're simply keeping files 'just in case,' that fails the necessity test under revDSG. A vague possibility of future hiring is not a lawful basis. Set a retention schedule—6 to 12 months for rejected candidates—and honor erasure requests after that period.
What if my ATS does not support data deletion?: You must still comply with the deletion request. Work with your ATS vendor to delete the candidate record, or export the data and remove it manually. The limitations of your software do not override the candidate's legal right. If your tool cannot support revDSG, consider switching vendors or implementing a workaround immediately.
Do I have to delete data if the candidate became an employee?: No. Once someone is employed, their data (CV, employment contract, payroll records, working time reports) falls under employment and tax law, not just recruitment law. You must retain payroll data for at least five years per VAT and income tax rules. However, you may still delete extraneous recruiting materials (interview notes, rejected-candidate flags) unless they're legally required.

General information for Swiss employers, not legal advice. Have a lawyer confirm anything with legal consequences.