A hiring record can include your resume, application answers, communications and assessment or interview information, depending on the employer’s process. This selected-rule overview was revised October 7, 2026. It does not establish that every employer stores the same fields or that every applicant can obtain every record.
What retention rules do—and do not—establish
For employers covered by the cited rule, 29 CFR 1602.14 requires personnel and employment records to be preserved for one year from creation or the relevant personnel action, whichever is later, and relevant records until final disposition of a discrimination charge. Different obligations may also apply. This guide does not treat the former federal-contractor rule under Executive Order 11246 as a universal current two-year requirement.
The UK regulator’s recruitment-records guidance discusses justified retention and relevant claim periods. It does not prescribe a universal six-month deletion date. A minimum retention period, maximum retention policy and access right are separate questions.
Selected access and deletion rules
| Framework | Potential request or information | Coverage and limits |
|---|---|---|
| California CCPA | Access, correction and deletion requests, subject to applicable conditions. | California residents and covered businesses; verification and statutory exceptions can apply. |
| UK data-protection framework | A subject access request for personal data. | Coverage, confidentiality and exemptions matter; access is not an automatic copy of every complete document. |
| Illinois AI Video Interview Act | Deletion request for covered AI-analyzed video interviews. | Positions based in Illinois; the cited act specifies deletion within 30 days after a request and instructions to recipients of copies. |
| New York City Local Law 144 | Notice and a publicly available bias-audit summary for covered AEDTs. | Tool and use must fall within the rule; this is not a general right to a complete applicant file. |
| Colorado SB26-189, from January 1, 2027 | Covered-ADMT interaction notice, adverse-outcome description and requests concerning data or human review. | Coverage conditions and exceptions apply; the role description is not a complete explanation of every algorithm. |
California Attorney General CCPA guidance explains covered businesses, request procedures and exceptions. Eligible requests to know, correct or delete generally have a 45-day response period with a permitted extension under the rules. Deletion can be limited by retention or other legal obligations; do not assume the right removes every record immediately.
The ICO’s employer subject-access guidance discusses the one-month response period, extensions for complex or multiple requests, genuine clarification and exemptions. Its recruitment guidance is identified as draft and under review. Applying to a company that also hires in the UK does not by itself establish that the framework applies to your application.
The Illinois Artificial Intelligence Video Interview Act concerns AI analysis of submitted video interviews for positions based in Illinois, including notice, explanation, consent and deletion provisions. New York City’s official AEDT page describes its different covered-tool audit and notice rules. Neither source establishes a universal applicant-file right.
Colorado’s enacted SB26-189 introduces covered automated-decision requirements starting January 1, 2027. It includes interaction notices, a plain-language description of the technology’s role within 30 days after a covered adverse outcome, data-correction and human-review requests, and at least three years of compliance records. Those records are not necessarily the same as every document in your application.
A verified applicant-notice enforcement example
On September 30, 2025, the California Privacy Protection Agency announced its $1.35 million Tractor Supply settlement. The agency described a failure to inform job applicants of their CCPA rights, among other issues. This is evidence about a named enforcement action, not proof that every employer or jurisdiction provides identical rights.
How to request information practically
- ▸Read the employer’s applicant privacy notice and identify its request channel.
- ▸State the application, approximate dates and the information or correction you seek.
- ▸If invoking a legal right, check that the framework covers your circumstances and use the relevant terminology accurately.
- ▸Respond to reasonable identity or clarification requests through the official channel; avoid sending extra sensitive documents to an unverified address.
- ▸Keep the request and response, and use the relevant regulator’s complaint guidance if needed.
Illustrative request to adapt
I applied for [role] on [date]. Please explain the retention policy for my application and the process for requesting access to, correction of or deletion of my personal data. Where applicable, I am making a request under [verified framework]. Please let me know the official verification steps and any information needed to identify the record.
If a record contains inaccurate dates or titles, ask about correction rather than trying to obscure the history in future applications. Keep your resume and LinkedIn consistent, and verify your own factual claims. Neither a retained record nor a privacy request guarantees a future opportunity.