The rejection arrives, and near the end there is a sentence meant to soften it. We'll keep your CV on file. We'll be in touch if something suitable comes up.
In the United States, that sentence describes something the employer has to do anyway. In the UK, it describes something they are only allowed to do if they have told you what they are doing, for how long and on what basis. Neither version is a plan to contact you.
In the United States, they are keeping it either way
An employer covered by Title VII, the Americans with Disabilities Act or GINA has to preserve your application. For a private employer the rule is one paragraph long. Any personnel or employment record made or kept by an employer, "including but not necessarily limited to requests for reasonable accommodation, application forms submitted by applicants and other records having to do with hiring", must be preserved "for a period of one year from the date of the making of the record or the personnel action involved, whichever occurs later".1
Applicants are named in that list, so the duty does not stop at people who got the job. And if anyone files a discrimination charge, the clock is replaced entirely: the employer must keep all records relevant to the charge until the matter is finally disposed of, and the regulation spells out that relevant records include "application forms or test papers completed by an unsuccessful applicant and by all other candidates for the same position as that for which the aggrieved person applied and was rejected".1
That is what your rejected application is for as far as the regulation is concerned. It is the comparison — the record of who applied, who was considered and who was picked. The duty is a floor rather than a motive, and the two sit together perfectly well: an employer that genuinely means to reconsider you is also complying with it. Which is the narrower point worth keeping. The file's existence tells you nothing either way, because it would be there either way.
One year is the general figure. Part 1602 runs a second set of near-identical sections that say two, for particular kinds of employer. A political jurisdiction — a state or local government — must preserve the same records, applicants included, for two years. So must a public elementary or secondary school system, district or individual school. So must an institution of higher education, which for this purpose means every college or university with 15 or more employees, "whether public or private".6 If you applied to a city, a state agency, a public school or any university, the federal minimum doubles.
Minimum is the word. Part 1602 says how long these records must be preserved, not when they must go: the end of the period is the end of the federal duty to keep your application, not a date on which anything is deleted.
The sections are all titled "Preservation of records made or kept".16 Preservation is the whole of them. Nothing in them asks anyone to look at the file again, tell you it exists, or consider you for anything.
In the UK, keeping you needs a reason you were told about
The Information Commissioner's Office takes the opposite starting point. Its draft guidance on recruitment records — draft matters, and I will come back to it — says that under data protection law "you must not keep information for longer than you need to", and then concedes something that a lot of advice gets wrong: the law "does not specify timescales for keeping recruitment records".2
There is no six-month rule. What the ICO offers instead is a default, in a worked example about a restaurant with fifty applications: unless there is a clear business reason, an employer "should not keep recruitment records for unsuccessful candidates beyond the statutory period in which an applicant can bring a claim arising from the recruitment process".2 That period is not one number either. The guidance sends employers to the Limitation Act 1980 and its Scottish and Northern Irish equivalents, and says the period "varies depending on the nature of the claim, and may be a number of years".2
The part that bears directly on the sentence in your rejection email is elsewhere on the page. Keeping your details for a vacancy that has not happened yet is a new purpose, and the guidance is specific about what a new purpose requires. The employer must review whether it needs a different lawful basis, must destroy what it does not need, and must "have previously informed candidates that you will keep their information for another purpose, and explained what this purpose is".2
Previously does not have to mean before you applied. Article 13(3) fixes the deadline at the further processing rather than at the original collection: where a controller intends to use personal data for a new purpose, it must give you information about that purpose "prior to that further processing", along with the further information listed in Article 13(2).3 A rejection email is not too late to be that notice.
What the notice has to contain is more than the purpose, though. Article 13(3) asks for that purpose plus "any relevant further information as referred to in paragraph 2", and paragraph 2 is a list whose relevant parts depend on what the employer is doing. Among them: the period the data will be stored for or the criteria used to set it, the existence of your rights of access, rectification, erasure, restriction, objection and portability, the right to withdraw consent where consent is what the keeping rests on, and the right to complain to a supervisory authority.3 How much of that has to appear in the rejection email depends on what you were told earlier, because Article 13(4) disapplies the duty "where and insofar as the data subject already has the information".3 An employer whose application-stage privacy notice already gave you a retention period and your rights has largely done the work. One that gave you nothing then, and eight words now, has not.
The ICO's own example of doing this properly makes the difference concrete. A law firm hiring one assistant solicitor expects more vacancies within six months, so it tells candidates on the application form that it will keep the records of the ten highest scorers for six months in case further roles open up.2 A purpose, a group and a period, stated before anyone was turned down.
Two caveats on all of this. It is the regulator's guidance, not the statute, and it is still draft: the consultation has closed, the final version has not been published, and the page now carries a notice that the guidance is under review because of the Data (Use and Access) Act.2 Treat it as the best current statement of what the ICO expects rather than as settled law.
What actually brings an old application back
Old applications do get reopened, and employers buy software built to do it. How often it ends in a hire is not something the vendors publish in a form worth citing, so treat the mechanism as real and the odds as unknown. What the documentation does show is how the reopening works, and that is the useful part, because it is a filtered search rather than an act of memory.
Greenhouse sells the feature under a name that says exactly what it is. "Talent rediscovery lets you easily filter and search prospects and past applicants to find qualified candidates for current roles."4 When a recruiter searches past applicants, the documented filters include milestone reached, interview stage, rejection reason and overall scorecard rating, alongside tags, last active date, education, custom fields, department and office. On top of that they can keyword-search résumés and notes, with preferred keywords combined as OR and required keywords as AND, and the product will suggest keywords from the job post.4
You know how far you got. The other two axes you are filed along — the reason recorded against your rejection, and the score the interviewers gave you — are written about you and not shown to you, unless you are somewhere you can ask for them. This is the same asymmetry as what happens to a live application while it is being screened, except that here it persists after the process ends. It also changes what an interview is worth after you have lost it. Every past applicant is filterable, but an interview leaves more to filter on. A rejected finalist has a milestone, a stage and interviewer scores; someone rejected at screening has a rejection reason, a résumé and not much else. Neither is invisible. One is much easier to find on purpose.
The feature is not universal even inside one vendor. Greenhouse lists talent rediscovery on its Plus and Pro tiers, and it needs job-admin permissions or above.4 A smaller employer on a cheaper plan may not have it at all.
Workable is worth putting beside that, because its architecture makes the same point from another direction. Its Talent Pool is "a place to upload and store candidates who do not fit in an active job but who you'd like to consider for future roles/openings", and the four ways in are a recruiter uploading a résumé, a recruiter adding you through the product's search, a CV emailed to the pool's own address, or a recruiter typing you in.5 The pool is a separate place from the database of people who applied to a job, and applying to an advertised role does not put you in it: a recruiter has to move you. There is one route in that you control, and it is the third of those four: a CV sent to that address arrives in the pool directly, filed as an applied candidate, without anybody having decided to keep you.5
So "on file" can mean two quite different things: sitting in an applicant record that exists because a rule says it must, or sitting in a pool built for the purpose of being searched. The second is the one worth being in. Being in it still is not the same as having been chosen for it.
What to ask, and what you can ask for
If you want to know which of these you are in, ask. A short, specific question in reply to a rejection is normal and occasionally gets a straight answer: are you keeping my details for future roles, for how long, and what would I be searchable under?
In the UK and the EU there is more than politeness behind that. Article 15 of the GDPR gives you the right to confirmation of whether your data is being processed and, where it is, to the purposes of the processing and to "the envisaged period for which the personal data will be stored, or, if not possible, the criteria used to determine that period".3 That is the exact question this article started with, and an employer is obliged to answer it. The same article covers who your data has been disclosed to. It touches automated decision-making as well, but that part is narrower than it sounds and, in the UK, currently moving: the ICO has its recruitment guidance under review because of changes made by the Data (Use and Access) Act.2 What you can ask about automated screening is its own article.
If the answer is that they are keeping you and you would rather they did not, Article 17 lets you ask for erasure where the data is "no longer necessary in relation to the purposes for which they were collected", or where you withdraw consent and there is no other basis.3 It is not absolute. The employer can refuse to the extent that keeping the record is necessary to comply with a legal obligation, or "for the establishment, exercise or defence of legal claims" — which is exactly what an employer defending its hiring decisions will cite.3 Expect that answer, and note that it is a reason for a defined period, not for keeping you forever.
If you are applying in the United States, none of these rights come from that regulation. Some state laws create their own, and this article is not the place to map fifty of them.
What the sentence is worth
Being kept on file is a filing status. It is compatible with genuine interest and it is compatible with a compliance obligation, and the sentence itself does not tell you which one you got.
That does not make it worthless. It makes it something to convert into a fact: an answer about the storage period, a name in a talent pool, or a reason to reapply in three months to a role you would otherwise have skipped. What it is not is a reason to wait. The version of that promise you can rely on is the one where the watching is yours.
