What does a company keep when you apply for a job?
Applying hands over more than a CV: identity, right-to-work copies, interview notes, test scores, sometimes a recorded interview. Hired or not, the file commonly stays for the window in which you could bring a claim, and often longer as a talent pool you never asked to join.
If it leaks
An application file leaked is your identity documents beside what an interviewer wrote about you and the scores a machine gave you. You were never hired, and they still had it.
What repeats in the files
More than the CV
An application file collects your CV, identity and right-to-work copies, interview notes, test results, and the correspondence around them. Software often reads it first: applications are ranked and scored before a person sees them, and the scores stay in the file. An access request reaches the notes and the scores.
Rejected is not deleted
The stated reason to keep an unsuccessful application is the window in which you could bring a claim, and the regulator's line is not to keep it beyond that. The extension nobody mentions is the talent pool: kept for future roles unless you object, on a timescale they choose.
The interview that was also a recording
If your interview ran through a recording platform, your face and voice were captured and often scored by the platform's software. That trade has its own fine print.
What lawfully stays, and what they choose to keep
Two kinds of hold. Law sets it: a statute makes them keep it. They set it: a period the company grants itself.
Criminal-record certificate Law sets it up to 6 months
DBS code of practice: destroy the certificate information once the decision is made.
The application file They set it the claim window
Guidance rather than law: keep it no longer than a rejected candidate could bring a claim.
Talent pool They set it until you object
A new purpose they tell you about, on a timescale they choose.
Vetting findings They set it end of process
Checks and social-media findings are destroyed when the process ends, though the outcome can be kept.
The timing
Where you stand changes the answer, and the timing is yours.
Waiting on an answer: a request now lands on the same desk that is deciding your application. The right exists at any moment, and whether to use it before the answer is your judgment.
Rejected, or no response and you consider it closed: this is the clean moment. The file has done its job, you cannot check what remains, and a deletion request is the standard move. Whatever they claim in reply, the reply is theirs and the record is yours.
If you took the job you are no longer an applicant, and the employment file is its own fine print.
Their own policy is the one that binds them. Pin it down with a request, and keep the reply.