How Long Can Employee CVs Be Retained Under KVKK?

⏱️ Reading time: 11 min · 📁 Category: KVKK & Digital Compliance

How long may employee CVs be retained under KVKK? A detailed retention and destruction guide for HR professionals — 2026

In human resources processes, CV retention periods are among the areas where the article reports frequent KVKK infringements.
Keeping CVs just in case they are needed later creates particular risks and is difficult to justify in an audit.

For successful and unsuccessful applicants, this guide brings together legal bases, reasonable retention periods,
destruction obligations and practical controls for HR teams in one framework.

💡 Core principle for HR: Set retention periods according to
purpose, legal basis, evidential needs and proportionality, rather than habit. 1️⃣ Are CVs Personal Data in the Scope of the KVKK?

Yes. Names, contact details, education and employment history, references and photographs in a CV constitute
personal data. In some cases, CV information may also indirectly reveal
special categories of personal data, such as health information or biometric data.

Collecting, retaining, classifying, emailing CVs and transferring them into ATS, CRM or HR software are therefore
data processing under KVKK.

2️⃣ For What Legal Reason Are CVs Processed?

CV processing activities in HR processes are mostly based on the following legal reasons:

• Direct connection with entering into a contract (KVKK m.5/2-c)
• Legitimate interests (KVKK m.5/2-f)

⚠️ Note: Explicit consent is not the default legal basis. Seeking consent when another legal basis applies can increase the risk that it is found
not freely given, insufficiently specific or inadequately limited in time, and therefore invalid. 3️⃣ Key distinction: was the applicant hired?

Retention periods depend on this distinction because the purpose and legal basis of processing
change according to whether the applicant is hired.

4️⃣ How long may unsuccessful applicants’ CVs be retained? 🔴 Principle: retention ends when the purpose ceases

When the recruitment process is completed in terms of the candidate who is not hired, the purpose of processing the CV is eliminated.
Indefinite archiving is incompatible with proportionality and storage limitation.

✅ Reasonable Time in Practice

For defending potential disputes and demonstrating closure of recruitment, the article proposes
a maximum of 6 months to 1 year as a potentially reasonable framework; suitability requires a case-specific assessment.

📌 Risk threshold: retention beyond 1 year without justification carries a high infringement risk, according to the article.
A possible future need is not sufficient justification on its own. ❓ May CVs be retained for future vacancies?

Automatically? No. The article requires long-term retention in a talent pool to be based on separate explicit consent. The applicable legal basis must be assessed for the particular process.
That consent must be:

• Specific with a clear talent-pool purpose
• Time-limited for example, 12 months
• Withdrawable through an easy procedure

Additionally, the lack of explicit consent should not be constructed to negatively impact the candidate's recruitment process.

5️⃣ How Long Can CVs of Hired Candidates Be Stored?

Once an applicant is hired, the CV generally becomes part of the employee’s personnel file
. Retention must then reflect the requirements of the employment relationship.

Data / Document	Storage Time	Reason (Practical)
CV of a hired applicant	During the duration of the employment relationship	HR processes, role suitability, career planning and a complete personnel file
CV after employment ends	Usually 10 years	Disputes, evidential needs, limitation periods and audit risks

⚠️ Important: The article’s 10-year approach must be
justified by the company’s risk profile and dispute history, and must align with its retention and destruction policy. It is not a universal statutory CV retention period. 6️⃣ What happens at the end of the retention period? Destruction duties

Under KVKK, expiry of the retention period requires destruction of the data.

• Digital CVs: permanent deletion, secure deletion or overwriting
• Paper CVs: shredding or pulping, documented in a destruction record
• Mailboxes: manual and automated cleanup rules, including labels and retention rules

📌 Evidence for audits: deletion and destruction should, where possible, be demonstrated through logs,
and physical destruction through a destruction record. 7️⃣ Key risks for HR departments: areas attracting Board penalties

• Retaining unsuccessful applicants’ CVs for years
• Creating a "CV pool" without explicit consent
• Collecting CVs without privacy notice (career page, email, form, etc.)
• Keeping unlimited CVs in email boxes
• No retention and destruction policy / non-implementation

8️⃣ Practical roadmap for HR

1. Policy: Define CV retention periods in a written retention and destruction policy.
2. Distinction: Separate the processes for hired and unsuccessful applicants.
3. Schedule: The article recommends deleting unsuccessful applicants’ CVs within 1 year at most, subject to a justified, case-specific retention assessment.
4. Talent pool: For a talent pool, obtain separate, time-limited and withdrawable explicit consent.
5. Evidence: Log deletions and document physical destruction.
6. Training: Inform the HR team and the managers involved in recruitment according to the KVKK procedures.

9️⃣ Brief reminder for HR

• Unsuccessful applicant’s CV: short retention then deletion; the article proposes 6–12 months
• Hired applicant’s CV: personnel file during employment; the article proposes a justified 10-year period afterwards in many scenarios
• Without explicit consent: no talent pool, under the article’s approach
• When retention expires: destroy the data

✅ Final Thoughts (Expert Perspective)

Although CVs may seem like routine HR information, the article treats them as high-risk personal data under KVKK.
One of the most easily identified violations in audits is the "former candidate CV archive".

Keeping CVs just in case does not itself provide a valid legal basis under KVKK.
Retention and destruction therefore need coordinated policies, technical systems and evidence records.

Get help with HR CV retention and destruction policies and talent-pool notices