Data Retention in Background Screening: How Long Can You Keep Candidate Records?
Introduction
A candidate completes a background check. Their identity is verified, employment history is reviewed, qualifications are checked, and depending on the role, criminal records, sanctions, adverse media, or other information may also be assessed.
The candidate is either hired or rejected.
But what happens to all that information afterwards?
A copy of the screening report may remain in an applicant tracking system. Documents may sit in an HR folder or email inbox. A screening provider may retain records in its platform. Someone may have downloaded a copy to a local drive.
Months or even years later, an organization may still have sensitive candidate information without being entirely clear why it is being retained, who can access it, or when it should be deleted.
This creates an important question for employers, recruitment agencies, HR teams, and background screening providers:
How long should candidate background screening information actually be kept?
There is no universal answer. Retention depends on the jurisdiction, the type of information, the purpose for which it was collected, applicable legal or regulatory obligations, and whether there is a legitimate reason to retain it.
For example, the UK's Information Commissioner's Office (ICO) states that personal information collected for pre-employment vetting should not be retained longer than necessary and that particularly intrusive vetting information will often need to be securely and permanently destroyed once the recruitment process is complete.
In the United States, meanwhile, federal employment recordkeeping requirements can require covered employers to retain certain personnel and employment records for specific periods, with longer retention where a discrimination charge or related litigation is pending.
So the real question is not simply, "How many years can we keep a background check?"
It is:
"What information are we retaining, why do we need it, how long is that purpose valid, and what should happen when the retention period ends?"
Table of Contents
- Why Data Retention Matters
- Is There a Standard Retention Period?
- What Information Should Be Retained?
- What Happens to Unsuccessful Candidates?
- When Can Records Be Kept Longer?
- Secure Deletion Matters
- The Role of Screening Providers
- How DE RISC Group Supports Responsible Screening
- Key Takeaways
- FAQs
1. Why Data Retention Matters in Background Screening
Background screening helps organizations make informed hiring decisions. However, retaining every document and screening result indefinitely can create unnecessary exposure.
The longer personal information remains stored, the longer it may be vulnerable to:
- Unauthorized access
- Data breaches
- Accidental disclosure
- Internal misuse
- Outdated or inaccurate information
The principle of storage limitation requires organizations to consider whether personal data is still necessary for the purpose for which it was collected.
The ICO advises organizations to establish appropriate retention periods and regularly review whether personal information is still required.
This means data retention should be considered as part of the entire background screening lifecycle, not as an administrative task after recruitment ends.
2. Is There a Standard Retention Period?
There is no universal number of years that applies to every background screening record.
Retention requirements can vary depending on:
- The country where the employer operates
- The type of screening performed
- The sensitivity of the information
- Industry-specific requirements
- Legal and regulatory obligations
- Potential employment claims
For example, U.S. EEOC rules require covered employers to retain certain employment records for specified periods, while relevant records may need to be preserved for longer when a discrimination charge or related litigation is pending.
Therefore, organizations should avoid adopting a blanket rule such as "keep every background check for five years."
Instead, retention periods should be purpose-driven and jurisdiction-specific.
3. What Information Should Be Retained?
A screening file can contain considerably more information than the final screening outcome.
It may include:
- Identity and address information
- Employment and education records
- Identification documents
- Criminal-record information
- Sanctions results
- Adverse media findings
- Verification correspondence
- Screening reports and research notes
These categories may not all require the same retention period.
A useful question is:
Do we need to retain the underlying document, or is a record of the screening outcome sufficient?
The ICO notes that organizations may, in appropriate circumstances, retain a record of the outcome and decision while securely destroying intrusive information obtained during vetting once it is no longer required.
This approach supports data minimization without preventing organizations from maintaining appropriate evidence of their recruitment decisions.
4. What Happens to Unsuccessful Candidates?
This is one of the most overlooked areas of recruitment data management.
If 500 candidates apply for a position and only 50 are hired, should the organization retain all 500 screening files indefinitely?
Generally, there should be a defined reason and retention period for keeping information about unsuccessful applicants.
The ICO advises that recruitment information relating to unsuccessful candidates should not normally be retained indefinitely and should be subject to an appropriate retention period based on potential claims and business requirements.
Organizations may choose to retain basic candidate information for future recruitment where there is an appropriate basis for doing so.
However, being retained in a talent pool does not automatically justify keeping sensitive background screening documents indefinitely.
5. When Can Records Be Kept Longer?
.jpeg)
"Do not retain longer than necessary" does not mean delete everything immediately.
There may be legitimate reasons to preserve records beyond the normal retention period, including:
- An ongoing legal claim
- Regulatory investigations
- Audits
- Statutory recordkeeping requirements
- Contractual obligations
- The need to establish or defend a legal claim
For example, U.S. EEOC requirements can require relevant employment records to be preserved until the final disposition of a discrimination charge or related litigation.
Organizations should therefore have a process for retention exceptions and legal holds so that scheduled deletion does not remove information that must legitimately be preserved.
6. Secure Deletion Matters
A retention policy is incomplete if it only answers:
"When should we delete the information?"
It should also answer:
"How will we securely delete it?"
Candidate information can exist across:
- Applicant tracking systems
- HR platforms
- Screening portals
- Cloud storage
- Shared drives
- Local devices
- Physical files
U.S. guidance on background checks states that once applicable recordkeeping requirements have been satisfied, background information should be disposed of securely so it cannot be read or reconstructed.
Organizations should therefore establish procedures for both retention and secure disposal.
7. The Role of Background Screening Providers
When screening is outsourced, organizations should understand how their provider manages candidate information.
Before engaging a provider, employers should consider:
- What information is collected?
- Where is it stored?
- Who can access it?
- How long is it retained?
- How is it protected?
- When and how is it deleted?
- What contractual requirements govern the processing?
For international screening, these questions become even more important because information may involve multiple jurisdictions and different legal requirements.
Data retention should therefore be addressed during vendor selection and contract discussions, rather than after the screening process has already started.
8. How DE RISC Group Supports Responsible Screening
Responsible background screening is not only about obtaining accurate information. It is also about ensuring that screening processes operate within an appropriate privacy and data-management framework.
DE RISC Group supports organizations with international background screening and research services, including:
- Employment verification
- Education verification
- Identity and address verification
- Criminal record checks
- Sanctions screening
- Adverse media screening
- International background checks
- Due diligence and corporate investigations
For organizations using third-party screening services, understanding the complete information lifecycle from collection and verification to handling, retention, and disposal can help create a more responsible screening program.
The objective is simple:
Collect what is necessary, protect it appropriately, retain it for a justified period, and securely dispose of it when it is no longer required.
Key Takeaways
Effective background screening does not end when a report is delivered.
Organizations should:
- Avoid assuming there is one universal retention period.
- Define retention based on purpose and applicable law.
- Treat sensitive screening information carefully.
- Establish clear periods for unsuccessful candidates.
- Maintain legal holds where necessary.
- Securely delete information once retention requirements expire.
- Understand how third-party screening providers manage candidate data.
- Regularly review retention policies as requirements change.
Good background screening is not about keeping everything forever. It is about keeping the right information for the right reason and for the right amount of time.
Frequently Asked Questions
How long can candidate background checks be kept?
There is no universal retention period. It depends on the jurisdiction, type of information, purpose of processing, and applicable legal requirements.
Can an employer keep a background check indefinitely?
Organizations generally need a legitimate and justifiable reason to retain personal information. It should not be kept indefinitely simply because it may be useful someday.
Should unsuccessful candidates' screening information be deleted?
Organizations should establish an appropriate retention period based on applicable legal and business requirements. Sensitive screening information should not automatically be retained indefinitely.
Does data retention apply to digital screening records?
Yes. Retention policies should cover information held in HR systems, screening platforms, email, cloud storage, physical files, and other locations.
Can records be retained longer because of litigation?
Yes. Where a legal claim, investigation, or regulatory requirement applies, relevant records may need to be preserved beyond the normal retention period.