Standard Retention Model
How long candidate data is kept, and why
Oryx | oryx.so
Version 1 | Effective Date: September 2026
This page forms part of the oryx Terms of Service and the Data Processing Agreement. By accepting those terms, an employer instructs oryx to apply the model set out below to their account.
00
How this works
Every application held in oryx has a retention clock. Three things decide it.
The clock runs per candidate, not per application. If someone applies to three of your roles over two years, there is one clock, and it resets each time they apply again. The most recent application is the anchor.
The region is set by the location of the role, not the candidate. A German candidate applying to your New York role falls under the United States rules. A US candidate applying to your Berlin role falls under German rules.
Some regions set a floor, others set a ceiling. A floor is a legal minimum you must keep, and no deletion request can override it. A ceiling is a legal maximum you must not exceed. The United States is the clearest floor. The European Union is the clearest ceiling. Both can apply to the same account if you hire in both places.
01
United States
Minimum you must keep: 1 year from the hiring decision, under EEOC recordkeeping rules. 2 years if you are a federal contractor with 150 or more employees or a contract worth $150,000 or more, under OFCCP rules. 2 years for educational institutions and state or local government employers.
Default retention: 24 months
Consent request sent: No. Not required in this regime
At the end: Anonymised
If a candidate requests deletion: the record is suppressed immediately, removed from your talent pool and excluded from all use, then destroyed once the minimum expires. It cannot be deleted sooner.
If a discrimination charge or lawsuit is filed, all related records must be preserved until the matter is finally resolved, regardless of the dates above.
02
California
Minimum you must keep: the same EEOC minimum as above
Default retention: 24 months
Consent request sent: No
At the end: Anonymised
Additional right: California job applicants can request access, correction or deletion at any time, and you must respond within 45 days. oryx suppresses the record on request and destroys it when the EEOC minimum expires.
03
Canada
Minimum you must keep: none
Default retention: 12 months
Consent request sent: month 11
At the end: Deleted
PIPEDA requires personal information to be kept only as long as necessary for the purpose it was collected for. Quebec's Law 25 adds an explicit deletion right and stricter consent rules, so Quebec follows the same consent-based flow as the European regions below.
04
United Kingdom
Minimum you must keep: none
Default retention: 6 months
Consent request sent: month 5
At the end: Anonymised
Six months matches the time limit for bringing a claim under the Equality Act 2010, which is the reason ICO guidance points to that period. Keeping data longer requires the candidate's consent.
05
European Union
The GDPR sets no fixed number. Periods come from national regulators and from the time limits for bringing a discrimination claim in each country, so they differ by member state.
5.1
France
Default retention: 24 months from last contact with the candidate
Consent request sent: month 23
At the end: Anonymised
This follows CNIL guidance on candidate databases. CNIL also permits longer restricted archiving for the defence of discrimination claims, which oryx does not currently offer.
5.2
Germany
Default retention: 6 months
Consent request sent: month 5
At the end: Deleted
Six months covers the claim window under the AGG, Germany's equal treatment act. German supervisory authorities treat anything longer as requiring the candidate's explicit consent.
5.3
Netherlands
Default retention: 4 weeks, extendable to 12 months with the candidate's consent
Consent request sent: week 3
At the end: Deleted
Four weeks is the period the Dutch data protection authority treats as customary without consent
5.4
Other EU member states
Default retention: 12 months
Consent request sent: month 11
At the end: Anonymised
Applied where a country has no specific regulator guidance. If you hire regularly in a member state not listed above, contact us and we will confirm the appropriate period.
06
Australia and New Zealand
Minimum you must keep: none
Default retention: 12 months
Consent request sent: month 11
At the end: Deleted
Australian Privacy Principle 11.2 requires personal information to be destroyed or de-identified once it is no longer needed. The employee records exemption does not apply to job applicants, so applicants have full rights. New Zealand's Privacy Act 2020 works on the same principle.
07
The consent request
In regions where consent is required to keep an application on file beyond the initial hiring process, oryx sends that request automatically on your behalf, before the period expires. You do not have to send it and you cannot forget to.
The email is short. It names your company, says when the candidate applied, and gives two one-click choices: keep my details, or delete my details. No account or login is required.
If they choose keep: the clock resets to the full period for that region and the legal basis becomes explicit consent. They can withdraw later from the same link
If they choose delete: the record is removed immediately and a confirmation is sent
If they do not reply: the record is deleted or anonymised on the expiry date
Silence is never treated as consent. The default on no reply is always removal, never retention.
08
What happens at the end of a period
Anonymised means name, contact details, resume, application answers and any documents are permanently removed. What remains is the stage the candidate reached, the source they came from, the dates, and their scores, so your hiring reporting still adds up. Anonymisation cannot be reversed.
Deleted means the record is destroyed in full and nothing remains.
Interview recordings are always deleted, never anonymised. A recording of someone's face and voice cannot be anonymised, so it is destroyed outright in every region.
09
Changing these settings
Every oryx account starts configured exactly as set out above. Most never need to change it.
You can adjust a retention period in your account settings, within the legal bounds shown for each region. Two limits cannot be changed, because they are not ours or yours to waive: we will not hold data beyond the maximum for a region, and we will not delete a record before a legal minimum expires.
Changing a setting regenerates your candidate privacy notice and asks you to approve it. Nothing changes for candidates until you do. Every change is recorded with the user who made it and the date, and forms part of your documented processing instructions to oryx.
10
Changes to this model
Retention rules change when regulators issue new guidance. If we change a default in a way that shortens or lengthens the period applied to your account, we will notify you at least 30 days before it takes effect, and you can adjust your settings in response.
This page is versioned. Previous versions are available on request from info@oryx.so.
Nothing on this page is legal advice. Retention periods reflect our reading of the applicable rules and regulator guidance in each region. If you have specific obligations, for example as a federal contractor, confirm them with your own counsel and adjust your settings accordingly.
