Applicant data protection covers applicants' personal data throughout the process, based on the GDPR and § 26 BDSG. Only data necessary for the selection decision may be collected, impermissible questions need not be answered truthfully, and applicants must be informed through a dedicated privacy notice. The usual six-month retention rule of thumb is derived from the AGG deadlines plus the time courts take to serve a claim.
At a glance
- The basis is the GDPR, supplemented by § 26 BDSG
- Applicants need their own privacy notice, visible where they apply
- Only data necessary for the selection decision may be collected
- Impermissible questions (such as about pregnancy or trade-union membership) need not be answered truthfully ("Recht zur Lüge", the right to lie)
- Data processing must be disclosed transparently to applicants
- Rejected applications should be kept only as long as needed to defend against possible claims (a rule of thumb of about six months)
- Background checks and social-media research are permitted only within narrow limits
A privacy notice for applicants
The information duty under Art. 13 GDPR applies in recruiting as everywhere else, and it is the point where something is most often missing in practice. A general website privacy notice does not cover it, because it states neither the purposes nor the recipients nor the retention period of the recruiting process.
The sensible answer is a dedicated applicant privacy notice, linked in the application form and in the acknowledgement email. It should set out:
- purposes and legal basis of the processing
- what data is collected and from which sources
- recipients, in particular the applicant tracking system in use and any group companies
- retention after a rejection and the basis for a talent pool
- data subject rights and how to reach the data protection officer
Anyone wanting to run a talent pool needs separate, demonstrable consent for it. It cannot be written into the privacy notice.
Retention and AGG deadlines
- After a rejection, claims under the General Equal Treatment Act (AGG) may arise; these must generally be asserted in writing within two months (§ 15 AGG)
- A three-month deadline to file suit then runs from that written assertion (§ 61b ArbGG)
- On top of that, a claim only takes effect on service, and service by the court can take several weeks. A company can therefore learn of a claim whose deadline was met long before
- The usual six-month rule of thumb follows from adding these periods together. It is not a statutory figure but a derivation
- Longer storage is permitted only with consent, for example for a talent pool
FAQ
On what legal basis is applicant data processed?
On § 26 (1) BDSG, which permits processing for the purpose of establishing an employment relationship. The test is necessity for the selection decision. In practice the legal basis rarely causes problems; necessity in the individual case often does.
Which interview questions are impermissible?
Questions with no factual link to the role, such as pregnancy, family planning, health without a job link, religion, or trade-union membership. Applicants may knowingly answer impermissible questions untruthfully without this later justifying a dismissal or rescission.
How long may application documents be kept?
Only as long as necessary. After a rejection, a period of about six months is common in order to defend against possible AGG claims. After that the data must be deleted unless there is consent for longer storage.
Are background checks and a look at social media allowed?
Only in a limited way. Publicly visible professional profiles may be considered more readily than private networks. Comprehensive background checks are permissible only where they are necessary and proportionate for the specific role.
Last updated: August 2026
This article provides general information and is not a substitute for legal advice in individual cases.
