Keeping and protecting candidate CVs in Kenya
How long a Kenyan recruitment agency should keep candidates' CVs and screening papers under the Data Protection Act, and what to do once a role is filled.
By Achekam · · 5 min read · For Recruitment businesses in Kenya
A Nairobi recruitment agency fills a sales manager role in March. By June, its shared drive still holds every CV that came in for the job, the shortlisted candidates' certificates and ID copies, interview notes, reference call notes and a salary history for the person who got the job. Some of those files were also e-mailed to the client. Nobody has decided what happens to any of it now.
That pile is personal data about people who trusted the agency with it, and Kenyan data protection law has something to say about every part of it. This article covers what the Data Protection Act asks, how to turn that into a retention rule for each stage of a search, and how to tidy up once a vacancy closes.
Who is responsible for the CVs
Kenya's Office of the Data Protection Commissioner defines a data controller as a person or entity that collects personal data and determines how it will be used, and a data processor as the entity that processes data on the controller's behalf. It defines a data subject as any individual who can be identified, directly or indirectly, through an identifier or personal data.
A recruitment agency that advertises roles, collects CVs and decides who to shortlist is deciding how candidates' data is used. Every applicant is a data subject, whether or not they are ever interviewed. When the agency sends a shortlist to an employer, that employer also handles the data, so agree in writing what the client may do with the CVs it receives and when it should return or destroy them. The practical side of sending CVs to clients is covered in sharing CVs with clients.
The Act, as published on Kenya Law, also says no person may act as a data controller or data processor unless registered with the Data Commissioner, subject to the thresholds for mandatory registration that the Data Commissioner sets. Check where the agency stands against those thresholds before anything else.
The principles that apply to every file
The ODPC states that its mandate comes from the Data Protection Act 2019 and includes making sure that processing of personal data follows the principles in section 25 of the Act. Those principles, as published on Kenya Law, require personal data to be:
- collected for explicit, specified and legitimate purposes;
- limited to what is necessary;
- kept accurate;
- kept no longer than necessary;
- not transferred outside Kenya without proof of adequate safeguards or the data subject's consent.
Each has a direct consequence for recruitment. Collecting a candidate's ID number, date of birth and full salary history at the first application, when the role only needs a CV, goes beyond what is necessary. Sending a CV to a client's head office in another country brings in the transfer rule. Keeping every CV forever, "just in case", is the opposite of keeping data no longer than necessary.
The full text of the Act, including section 25, is on Kenya Law's page for the Data Protection Act, 2019, which covers the principles, data subjects' rights, registration and the Data Commissioner's powers.
A retention rule for each stage of the search
The Act does not hand the agency a number of months. It requires the agency to decide what is necessary and stick to it. A rule per stage is easier to follow than one rule for everything. A sensible starting point, to adapt with your own legal adviser:
| Stage | What you hold | Keep until |
|---|---|---|
| Application, not shortlisted | CV and covering note | The vacancy closes and any feedback window ends, unless the candidate agrees to stay on file |
| Shortlisted, not placed | CV, interview notes, any test results | The vacancy closes and any challenge to the process is unlikely, unless the candidate agrees to stay on file |
| Placed | CV, references, checks, offer details | As long as the agency needs them for the placement, the client's guarantee period and its own accounting records |
| Pool for future roles | CV and contact details only | The period the candidate agreed to, refreshed when you next contact them |
Write the rule down, give it to every consultant, and record when it is applied.
Candidates who were not placed
The candidate who came second is often the agency's best prospect for the next role. That is a good business reason to keep their CV, but it is a new purpose: the CV was collected for this vacancy, not for every future one.
The cleanest way to respect the purpose principle is to ask. When the vacancy closes, write to unsuccessful shortlisted candidates, tell them the role is filled, and ask whether they would like the agency to keep their CV for future roles and for how long. Keep the reply with the file. Those who say no, or do not reply, move to the removal list.
Ask for less at the start as well. Identity documents, certificates and reference contacts can wait until a candidate is genuinely shortlisted, and for travel or interview arrangements collect only what the arrangement needs; see candidate interview travel.
Archiving CVs and withdrawing shared links
In Achekam, Document Centre is a folder-based store where a business uploads files or whole folders, previews, renames, moves, tags, archives and searches them, and a new version keeps the earlier ones. A folder per vacancy, with sub-folders for applications, shortlist and placement, makes the retention rule easy to apply: when the vacancy closes, the whole applications folder can be dealt with in one step.
Tags help too. Tag each CV with the vacancy and, for the future-roles pool, the date the candidate's agreement runs to. A search on that tag each month shows which files are due for review.
Archiving takes a file out of everyday view, which is useful but not the same as erasing it. Where the retention rule says a CV must be destroyed, decide how that will be done and record it.
When CVs were sent to a client as links rather than attachments, the agency keeps control. A document can be shared by e-mailing a personal link with an expiry, an optional one-time code, and download allowed or not, and the share can be revoked. Set the expiry to the expected end of the client's decision, allow viewing only where possible, and revoke every share on the day the vacancy closes. Every stored file also gets a SHA-256 fingerprint, executable files are refused by default, and every upload passes a malware check, which matters when CVs arrive as attachments from strangers.
Pick one vacancy that closed last month, apply the table above to every file in its folder, and send the not-placed candidates a short note asking whether they want to stay on file.
General guidance only, not advice on your own circumstances. Tax and payroll rules change: check the current position with the authority or your adviser.
