Assessment Data Retention and Deletion for Employers: A Practical Guide

Online assessments generate more information than a final score. Depending on the assessment design, an employer or its service provider may hold candidate contact details, invitation histories, responses, question-level results, timing information, accommodations correspondence, reviewer notes, integrity flags and hiring decisions. Some records are essential for explaining a decision; others may have little value after an assessment closes.

Keeping everything indefinitely creates avoidable privacy and security exposure. Deleting everything immediately can also be irresponsible if the employer needs to respond to a legitimate challenge, demonstrate consistent selection procedures or investigate an error. The objective is not maximum retention or maximum deletion. It is a documented, lawful and proportionate lifecycle for each type of record.

This guide explains how to build that lifecycle, distinguish records that require different treatment, coordinate with an assessment provider and implement deletion without accidentally destroying evidence. It complements the Talentrenza guides on candidate privacy notices, assessment audit trails and assessment governance; its specific focus is the operational decision of how long data remains available and what happens when that period ends.

What is assessment data retention?

Retention is the period during which an organisation preserves information for a defined purpose. Deletion is the controlled removal of information once continued processing is no longer justified, subject to applicable legal obligations and properly assessed exceptions. In practice, deletion may involve erasure, irreversible anonymisation or scheduled expiry from different systems.

A retention schedule should answer five questions for every category of information:

1. What data is collected, and why?
2. Who is responsible for it?
3. What event starts the retention clock?
4. Which legal or operational basis justifies the period?
5. How will the data be securely removed or de-identified, and how will that action be evidenced?

A privacy notice may summarise these answers for candidates. The internal retention schedule should contain enough detail for administrators to carry them out consistently.

Start with a data inventory, not a universal deadline

A common mistake is to announce that all candidate data will be kept for a fixed number of months. That sounds simple but ignores important differences between records. An unsuccessful candidate's invitation link, a score used in a disputed decision and an anonymised item-performance statistic do not necessarily require identical treatment.

Create an inventory covering the full assessment journey:

For each category, identify whether the employer, assessment platform or another service provider controls the relevant system. A data inventory that covers only the employer's HR dashboard is incomplete.

Distinguish purpose from convenience

An employer may have legitimate reasons to preserve records after an assessment, but “we might find them useful someday” is not a sufficient policy on its own. Examples of purposes that may warrant a documented period include resolving a candidate complaint, fulfilling a statutory recordkeeping duty, investigating a security incident, or evaluating the quality of a recruitment process using data that cannot reasonably be anonymised sooner.

Avoid using one broad purpose to justify every record. The fact that a score may need to be retained does not automatically justify keeping a full browser-event history or every message about a candidate's personal circumstances.

The retention decision should consider necessity, proportionality, legal obligations, potential claims, contractual commitments and the consequences of an inaccurate or unavailable record. Privacy and employment law differ across countries and sometimes within a country. Have a qualified local adviser review any binding schedule.

Choose the event that starts the clock

A retention period is ambiguous unless the starting event is clear. Possible triggers include the date of the test, the closing date of the recruitment campaign, the final hiring decision, the candidate's last interaction, the conclusion of an appeal, or the end of an employment relationship.

Consider a fictional recruitment exercise:

• The candidate completes a test on 3 February.
• The employer makes its final decision on 28 February.
• The candidate requests a review on 12 March.
• The review concludes on 5 April.

If the policy says “retain for a period after completion” without defining completion, administrators could calculate three different deletion dates. The schedule must specify which event applies and how a pending review affects the timeline.

Do not automatically restart the retention clock whenever someone views a record. Otherwise ordinary administrative access could lead to indefinite retention.

Build a retention schedule with accountable owners

The following is a template, not a recommendation of universal durations:

Do not copy a retention duration from another employer or country without checking the legal basis. In some places, employment, anti-discrimination, tax, audit or sector-specific requirements may influence what must be preserved. In others, particular categories may need earlier deletion.

Worked example: calculate a scheduled deletion date

Suppose an employer adopts a hypothetical internal rule that an unsuccessful applicant's ordinary assessment records expire 180 calendar days after the recruitment campaign's final decision, unless a documented exception applies.

If the final decision is recorded on 1 March 2026, adding 180 days produces 28 August 2026. This is a calendar calculation only, not a statement that 180 days is legally appropriate. Before approving such a rule, the employer must check applicable requirements, its stated purpose and any potential claims.

Now suppose a complaint is opened before the scheduled expiry date. The relevant records should not be deleted mechanically if a lawful preservation obligation applies. Instead, a responsible reviewer should determine which records are necessary, record the reason for the hold, restrict access and set a date to review whether preservation is still justified. The hold should not silently extend every record in the candidate's profile.

Do not confuse a hold with indefinite retention

A preservation hold is an exception to the ordinary schedule, not a new default. A useful hold record includes the authorised requester, affected record categories, legal or operational rationale, start date, review date and release authority. Once the hold ends, the normal deletion workflow should resume according to the approved policy.

Handle candidate deletion requests carefully

A candidate may ask an employer or assessment provider to delete assessment data. The organisation should acknowledge the request through an appropriate channel, verify identity proportionately and determine which records it controls.

A practical response workflow is:

1. Receive and authenticate. Avoid requesting excessive new personal information merely to process the request.
2. Identify relevant systems. Include the assessment platform, HR system, email, exported spreadsheets and any processors.
3. Review applicable rights and exceptions. A deletion request does not necessarily override every legal retention obligation; equally, an employer should not invoke a vague possible future need to refuse deletion automatically.
4. Separate records by purpose. Some data may be deleted while limited evidence is preserved lawfully.
5. Execute and verify. Record the outcome without keeping a needless duplicate of the deleted content.
6. Communicate clearly. Explain what was removed, what was retained where disclosure is appropriate, and the reason and review path for any refusal or limitation.

Response deadlines, permitted exceptions and appeal routes depend on applicable law. Employers should not promise a universal turnaround time in public-facing copy without verifying it.

Make deletion work across systems

Deleting a candidate from a visible dashboard may only hide a record. Copies can remain in exports, internal reports, analytics pipelines, email attachments, support tickets or recovery backups.

Create a system-by-system deletion map. For each system, record whether deletion is immediate, queued, dependent on another service, or governed by backup expiry. Document any technical limitation and a compensating control, such as restricting restoration access until backup copies expire.

Live databases

Use an approved deletion workflow with access controls and audit records. Check whether related tables—responses, attempts, results and invitation records—are removed, anonymised or retained under a separate justified purpose. Test referential integrity so deletion does not corrupt aggregate reporting or unrelated records.

Exports and local files

Spreadsheets downloaded by hiring managers can defeat an otherwise sound retention policy. Limit exports by role, label files with handling instructions and include authorised export locations in the deletion process. Avoid treating personal laptops or unmanaged shared folders as permanent archives.

Email and support tools

Candidate communications and support tickets may contain identifiable details or accommodation information. Map those systems and decide whether retention is needed for the same purpose as the assessment record or for a separate documented purpose.

Backups

Many backup systems cannot remove one record from an existing immutable snapshot without undermining recovery integrity. A documented approach may rely on restricted access and scheduled snapshot expiry, provided that approach is lawful and accurately disclosed. If an older backup is restored, the organisation needs a procedure to reapply relevant deletion instructions before the restored data becomes operationally available.

A statement that data is “deleted immediately from all systems” is misleading if recovery copies remain accessible for weeks or months.

Anonymisation is not the same as removing a name

An employer may want to study whether an assessment form is too difficult, whether candidates frequently abandon a particular item or whether results vary between testing environments. Sometimes this can be done with truly anonymised aggregate information rather than identifiable records.

However, replacing names with random IDs is generally pseudonymisation, not necessarily anonymisation, if someone can reconnect the data to individuals or reasonably identify them from other details. Small groups, rare job titles, exact timestamps and unusual combinations of characteristics can create re-identification risks.

Before keeping analytics indefinitely, examine whether individuals can reasonably be identified, whether granular records are still needed, and whether aggregation or suppression would reduce risk. Reassess when datasets are combined or shared.

Establish responsibilities with assessment vendors

Employers should not assume that a vendor's standard deletion settings satisfy their own obligations. Before using a provider, clarify:

• Which party determines the purposes and means of processing, and which acts on instructions.
• Which categories of data the vendor stores and where.
• Whether subprocessors receive assessment information.
• How long live records, logs, exports and backups persist.
• How the employer can request or initiate deletion.
• Whether deletion is confirmed and how exceptions are documented.
• What happens at contract termination or migration.
• How incidents and data subject requests are coordinated.

Contractual terminology and obligations depend on the applicable privacy regime. Request evidence of operational deletion processes rather than accepting a general promise that information is secure.

Protect sensitive adjustment and investigation records

Some assessments involve accessibility adjustments, health-related disclosures or allegations of misconduct. These records can be especially sensitive. Separate the administrative fact that an adjustment was approved from detailed personal documentation where possible. Restrict access to those with a genuine need and apply an independently justified retention rule.

Likewise, an integrity flag is not proof of wrongdoing. A candidate should not be burdened indefinitely by an unverified suspicion preserved in a searchable profile. Document investigation outcomes, correction procedures and the basis for retaining or deleting the record.

Test the policy before relying on automation

A policy is not implemented simply because it appears in an employee handbook. Test whether the organisation can actually identify records that have expired and delete them without affecting active cases.

A useful quarterly control test can sample records from different categories:

1. Select a record whose scheduled retention has ended.
2. Confirm no approved hold or independent obligation applies.
3. Check whether the deletion job ran and whether related records were handled correctly.
4. Inspect relevant exports and processor confirmations.
5. Verify that operational reports still function.
6. Record exceptions, root causes and remediation owners.

Use synthetic or appropriately authorised test data when validating destructive workflows. Do not perform unapproved deletion tests against production candidate records.

A 30-day implementation plan

Week 1: Inventory and ownership

List all assessment data categories, systems, exports, processors and accountable owners. Identify untracked spreadsheets and legacy platforms. Record where candidate-facing notices currently describe retention.

Week 2: Decide purposes and rules

Define the purpose of each category, select a clear start event, identify legal and operational constraints, and document the proposed period. Obtain appropriate HR, privacy, security and legal review before approval.

Week 3: Configure deletion and exceptions

Implement expiry rules where technically possible. Define a controlled legal-hold workflow, processor instructions, backup treatment and an auditable method for approving exceptions. Restrict unnecessary exports.

Week 4: Validate and communicate

Test with synthetic records, review a sample of actual records non-destructively, train relevant staff and update candidate privacy notices to reflect what really happens. Schedule the next policy review and assign responsibility for vendor changes.

Common mistakes to avoid

Keeping all candidate data forever. Storage capacity is not a lawful purpose. Indefinite retention increases the potential impact of a breach.

Deleting records solely by test date. A pending review or legally required preservation may change the relevant decision.

Assuming dashboard deletion means erasure. Related tables, exports and backups may still contain the information.

Calling pseudonymised records anonymous. Re-identification may remain possible, especially for small candidate groups.

Using the same schedule for every country. Legal obligations and candidate rights differ across jurisdictions.

Making promises the vendor cannot fulfil. Verify deletion functionality, backup lifecycle and subprocessor practices before publishing absolute claims.

Using broad holds without review. Preservation exceptions should be specific, authorised and time-limited through periodic reassessment.

Employer retention and deletion checklist

• Every assessment data category has a documented purpose.
• The systems holding each category are identified.
• The responsible owner and approving authority are named.
• Each retention rule has an unambiguous start event.
• Periods have been reviewed for applicable legal and contractual requirements.
• Candidate-facing notices accurately describe retention practices.
• Deletion requests have a documented workflow.
• Holds are limited, justified, recorded and periodically reviewed.
• Exports, processors and backups are addressed.
• Deletion is tested and exceptions are monitored.

Frequently asked questions

How long should employers retain assessment results?

There is no single period suitable for every employer, country, assessment or decision. Determine a defensible duration from the purpose, applicable law, potential claims and operational need. Record the start event and end-of-period action.

Can a candidate request deletion immediately after a test?

A candidate may have applicable privacy rights, including a right to request erasure in some circumstances. The organisation must assess the request under relevant law; certain records may still need to be preserved for a lawful reason. The response should be specific rather than automatic.

Should an employer retain every answer if it keeps the final score?

Not necessarily. Consider what level of detail is needed to explain or review the result, support quality assurance or fulfil an obligation. The answer may differ between low-stakes practice and high-stakes selection decisions.

Can employers keep anonymous assessment statistics indefinitely?

Potentially, if the information is genuinely anonymous under the applicable standard and continued use is justified. Simply removing names may not prevent re-identification. Reassess risk when combining datasets or reporting small groups.

What happens to deleted records in backups?

Backup treatment depends on architecture and applicable obligations. Some copies expire through a controlled backup lifecycle rather than immediate item-level erasure. Access restrictions, restoration controls and accurate notices are important.

Does changing assessment software remove the need for retention governance?

No. A migration can create additional copies and unclear responsibilities. Establish export, transfer, verification, deletion and contract-termination procedures before moving records.

Conclusion

A credible assessment programme should be able to explain not only why it collected a candidate's information, but also why it still holds that information today. An effective retention and deletion policy makes those answers consistent, documented and operationally achievable.

Start with a clear inventory, assign accountable owners, establish purpose-specific rules, account for vendors and backups, and test the process. The result is a programme that preserves necessary evidence without treating every assessment record as a permanent asset.