None of Singapore, Indonesia, Australia or New Zealand sets a fixed number of years for keeping candidate data. Each says the same thing in different words: keep it only while you still need it for a purpose you can name. Singapore's PDPA requires you to stop retaining data once the purpose is no longer served. Indonesia's Personal Data Protection Law requires you to delete data you no longer need and to destroy it when its retention period ends. Australia's APP 11.2 requires you to destroy or de-identify it once it is no longer needed. New Zealand's information privacy principle 9 bars keeping it longer than the purpose requires. What counts as "finished" differs: in Singapore, archiving is still retention, while Australia accepts putting data beyond use as a fallback. The practical answer is a retention schedule with a review point for each group of candidates. HyreTech does not delete candidate data on a timer, so you set the review points and ask us to delete what has passed them.
Retention is how long you keep personal data after you collected it. In hiring it covers CVs, interview notes and scores for people you did not hire, and for people who joined a talent pool without applying.
The risk runs both ways. Delete too early and you lose people you could have rediscovered, or the records you need to show a fair process. Keep too long and you hold data you have no purpose for.
Checked against the primary sources on 14 October 2026. This is a plain-language summary, not legal advice. Have counsel review any retention period you publish to candidates.
What Each Market Says
| Market | Provision | Core rule | Fixed years? | What counts as finished |
|---|---|---|---|---|
| Singapore | PDPA, section 25 | Cease retaining, or remove the means to link the data to a person, once the purpose is no longer served and retention is no longer necessary for legal or business purposes | No. Judged on reasonableness | Destroy, return or anonymise. Archiving or limiting access is still retention |
| Indonesia | Personal Data Protection Law (UU 27/2022), articles 42 to 45 | Stop processing when the retention period ends or the purpose is achieved. Delete data no longer needed, and destroy it when its retention period expires | No | Delete or destroy, and tell the person it was done |
| Australia | Privacy Act 1988, APP 11.2 | Take reasonable steps to destroy or de-identify once no longer needed for any purpose the APPs allow | No | Destroy, de-identify, or put beyond use |
| New Zealand | Privacy Act 2020, IPP 9 | Do not keep it longer than the purposes for which it may lawfully be used require | No | Stop keeping it. Removing a name alone was not enough in one OPC case |
For Singapore, Australia and New Zealand, who these rules cover, including unsuccessful applicants and the Australian turnover threshold, is set out in our AI hiring compliance guide.
Singapore: No Fixed Period, and Archiving is Not Deleting
Section 25 of the PDPA has no number in it. The PDPC's Advisory Guidelines on Key Concepts in the PDPA (revised 29 April 2026), in the chapter on the Retention Limitation Obligation, say the period is judged on a standard of reasonableness (paragraph 18.2).
Four points from it matter for hiring:
- No "just in case". Personal data must not be kept in case it is needed for purposes that were never notified to the individual (paragraph 18.4).
- Review regularly. Organisations should review what they hold and may apply retention periods to groups or batches of data (paragraphs 18.5 and 18.7).
- Write it down. As good practice, have a retention policy, and where data is kept for a relatively long time, set out the rationale (paragraph 18.8).
- Archiving does not count. Data that is merely archived, or access-limited, is still retained. To cease retaining it you must, for example, destroy it, return it or anonymise it (paragraphs 18.10 and 18.11).
The hiring-specific side, including candidates you want to consider for future roles, is covered in our candidate rediscovery guide, and the broader obligations in our PDPA guide for AI hiring.
Singapore Interview Records: TAFEP Expects a Year
Candidate data and the record of a selection process are not the same thing. The Tripartite Guidelines on Fair Employment Practices say a proper record of the interview, assessment process and job offer should be kept for at least one year, and TAFEP's fair hiring guidance (13 January 2026) repeats it.
It is guidance, not statute. The Workplace Fairness Act, which TAFEP expects to take effect at the end of 2027, is covered in our compliance guide. But a deletion window shorter than a year for candidates you interviewed needs a reason you can defend.
The practical split is to keep the decision record (criteria, scores, notes on what the candidate said) for that period, and delete or anonymise the rest of the profile on your normal schedule. What a usable decision record looks like is covered in structured interview rubrics for tech roles.
Indonesia: Delete When The Purpose is Met
Indonesia's Personal Data Protection Law (UU 27/2022), whose two-year transition period ended in October 2024, deals with retention in four articles. None of them sets a number of years:
- Stop when the purpose is met. A controller must end processing when the retention period is reached or the purpose of processing has been achieved (article 42).
- Delete what you no longer need. Personal data that is no longer needed to achieve the purpose must be deleted (article 43).
- Destroy at the end of the retention period. Data whose retention period has expired, under your records-retention schedule, must be destroyed (article 44).
- Tell the person. The controller must notify the individual that their data was deleted or destroyed (article 45).
The notice duty is the practical difference from the other three markets. In Indonesia, a deletion run for past applicants should end with a short message to each person affected, so build that step into the schedule. Like Singapore, the Law ties retention to a purpose, so tell applicants when you collect their CV if you may consider them for future roles.
Australia: Destroy, De-identify, or Put Beyond Use
The OAIC's Guide to securing personal information sets out APP 11.2. The duty does not apply where the information is in a Commonwealth record or where a law or a court or tribunal order requires you to keep it. The guide is not legally binding, but the OAIC refers to it when assessing compliance.
Three details matter for a hiring team:
- Outsourcing does not move the duty. An entity that stores data with a third party but keeps the right to deal with it still "holds" it. A cloud ATS does not make deletion the vendor's problem.
- Backups count. The guide asks whether backups are destroyed or de-identified, and whether you have a retention policy that reflects APP 11.2.
- Putting data beyond use is a defined fallback. Where electronic data cannot be irretrievably destroyed, you can put it beyond use. That means you will not use or disclose it, no other entity can access it, it sits behind access controls with logs and audit trails, and you commit to destroy it when that becomes possible. The OAIC expects this only in very limited circumstances.
The contrast with Singapore is useful. Singapore does not accept archiving as ceasing to retain, while Australia accepts beyond use in narrow cases, so a single "archive it" step does not satisfy both.
New Zealand: IPP 9 and a Recruitment Case
The Privacy Commissioner's page on principle 9 states the rule in one sentence and sets no time limit. The more useful material is a recruitment case. In an OPC case note, a former client of a recruitment agency asked for his online profile to be removed. The agency deleted his name, his photo and the link to the profile, but left the rest online. The Commissioner treated it as still identifying him, because of the detail it contained and because search engines still linked it to him. The agency then removed the profile completely.
The case was decided in 2013, under the earlier Privacy Act 1993 and its own principle 9. The lesson holds under the 2020 Act. Deleting a name from a CV is not the same as de-identifying it. If a record still contains enough detail to point to one person, it is still candidate data.
Where The Seven-Year Figure Comes From
Search results for retention are full of seven-year rules, and each market has its own source:
- Singapore. The PDPC's retention chapter notes that actions founded on a contract must generally be brought within 6 years under the Limitation Act, so an organisation may wish to keep records relating to its contracts for 7 years from termination.
- Australia. The Fair Work Act 2009 (section 535) requires employers to keep employee records for 7 years.
- New Zealand. The Tax Administration Act 1994 (section 22) requires business records to be kept for at least 7 years, and the Employment Relations Act gives access to wage and time records for the previous 6 years.
- Indonesia. The PDP Law sets no number at all.
Every one of these is about contracts, employees or tax. An unsuccessful applicant has no contract with you and is not your employee, and none of the privacy provisions above sets seven years for their CV.
If you adopt seven years for applicants, you need a purpose that justifies it, and in Singapore the PDPC expects you to write the rationale down.
A Retention Schedule You Can Adapt
A retention policy is the written rule. A retention schedule is the table that applies it. The review points below are examples to adapt. They are not legal minimums or maximums, except where a source above says otherwise.
| Group | What you hold | Review point (example) | Action |
|---|---|---|---|
| Applicant for an open role | CV, notes, scores | Role closes or decision made | Keep while the role is live |
| Unsuccessful, not interviewed, not told you may consider them later | CV, scores | A short window after the decision, such as 30 to 90 days | Delete or anonymise |
| Interviewed, not hired (Singapore) | Interview notes, assessments, scorecards, offer records | At least one year, per the Tripartite Guidelines | Keep the decision record, delete or anonymise the rest of the profile |
| Interviewed, not hired (Indonesia, Australia, New Zealand) | Same | A period you set and document with counsel | Same |
| Told you may consider them for future roles | Profile plus a record of what you told them | For example, every 6 to 12 months | Re-confirm interest or delete |
| Talent-pool sign-up, no application | CV, profile | Same review point | Keep until asked or the review lapses |
| Deletion request received | Everything, including exports | Your committed response time | Delete in every system. In Indonesia, tell the person once it is done |
| Backups and exports | CSV files, copies | When the source record is deleted | Singapore: destroy or anonymise. Indonesia: delete or destroy. Australia: destroy, or put beyond use. New Zealand: stop keeping it |
| Hired | CV, offer documents | On hire | Move to employee records under a separate schedule |
The "future roles" row is where rediscovery and retention meet. You can only search the people you are still allowed to keep, so the review point is also what keeps your talent pool usable.
How This Works in HyreTech
HyreTech does not delete candidate data on a timer, and there is no delete button for candidates in the app yet. When a group passes its review point, email privacy@hyretech.ai with the candidates to delete, and they are erased within 30 days of a verified request (how deletion works).
The talent-pool form tells candidates their profile is kept until they or the company ask for it to be deleted, and the talent-pool list shows the date each person submitted, which is the date to review against.
One more point catches teams out. If you keep your ATS and import candidates by CSV, imports are one-way and nothing is written back. Deleting a candidate from HyreTech does not touch the original in your ATS, and the CSV file itself is another copy. Run your schedule across all three.
Set a Review Point Before Your Next Batch
To see how many people you actually hold, start free, import a small batch of past applicants and search it.
If you hire across Singapore, Indonesia, Australia and New Zealand and want to go through how deletion requests and the talent pool work, book a demo.
FAQ
How long can I keep past applicants' data so I can contact them about future roles?
None of the four privacy regimes sets a fixed number of years. You may keep it while a purpose you told them about still needs it, such as considering them for future roles, and you should review it on a schedule, for example every 6 to 12 months. HyreTech does not delete candidate data automatically: you send the list of people to delete and they are erased within 30 days of a verified request. Imports from your ATS are one-way, so delete the candidate in the source ATS too.
Is there a 7-year rule for keeping job applicants' CVs?
No. Seven years comes from contract limitation periods in Singapore, employee records under Australia's Fair Work Act, and tax records in New Zealand. None of them covers unsuccessful applicants, so a seven-year period for CVs needs its own written purpose.
How long can you keep job applicant data in Indonesia?
The Personal Data Protection Law sets no number of years. Stop processing when the purpose is achieved or the retention period ends, delete data you no longer need, destroy it when its retention period expires, and tell the person when you do (articles 42 to 45 of UU 27/2022).
How long should you keep interview records in Singapore?
At least one year, according to the Tripartite Guidelines on Fair Employment Practices and TAFEP. It is guidance rather than law, so keep the decision record for that year and delete or anonymise the rest of the profile on your normal schedule.
What should a candidate data retention policy say?
For example: "We keep applications for roles we are filling until the role closes. If we do not hire you, we delete or anonymise your application within [period] unless you agree that we may consider you for future roles. If you agree, we review your details every [period] and delete them if we cannot confirm your interest. We keep records of interviews and assessments for [period]. You can ask us to delete your data at any time and we will respond within [period]." Fill in the periods with counsel.
Does archiving count as deleting candidate data?
Not in Singapore. The PDPC says archived or access-limited data is still retained, so you must destroy, return or anonymise it. In Australia, you may put data beyond use when it cannot be destroyed, but the OAIC expects that only in very limited circumstances.
Does deleting a candidate in HyreTech delete them from my ATS?
No. HyreTech imports are one-way by CSV and nothing is written back to your ATS. Ask us to delete the candidate in HyreTech, delete them in your ATS yourself, and delete any CSV exports.