Can an Employer Keep CV Data of Rejected Candidates in North Macedonia?

Recruitment is expensive, and it is tempting for employers to keep a pool of CVs for future positions. But under North Macedonia’s Law on Personal Data Protection, retaining the personal data of candidates who were not selected — once the position has been filled — requires a clear legal basis. Without one, the employer is in breach of the law. This article answers a question we frequently receive in our employment law practice: can the employer lawfully keep the CV of a rejected candidate?

The recruitment process for many companies is expensive and complex. They might receive a large number of CVs but ultimately decide on only one candidate. It is not always an easy decision, and if it does not work out with the chosen candidate, the employer would naturally want to contact the other candidates who were not selected.

Sometimes this is welcome news for the person who applied. But is it legal for the employer to call an unsuccessful candidate six months or a year later — essentially admitting that it did not work out with the person selected instead?

The Legal Framework: Lawfulness of Processing

The answer lies in the Law on Personal Data Protection of North Macedonia and, specifically, in the basic principle of lawfulness of processing set out in Article 10 of the Law. This principle clearly states that processing shall be lawful only if and to the extent that at least one of the following conditions applies:

• The data subject has given consent to the processing of his or her personal data for one or more specific purposes;
• Processing is necessary for the performance of a contract to which the data subject is party, or in order to take steps at the request of the data subject prior to entering into a contract;
• Processing is necessary for compliance with a legal obligation to which the controller is subject;
• Processing is necessary in order to protect the vital interests of the data subject or of another natural person;
• Processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller;
• Processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child.

Applying the Law to Rejected Candidates

When it comes to job candidates and the personal data included in a job application, the relevant question is: is the processing of this personal data necessary for the performance of an agreement to which the data subject is party, or in order to take steps at the request of the data subject prior to entering into a contract?

The answer is clear: once the recruitment process is concluded and the position is filled, there is no longer a pre-contractual basis for retaining the data of unsuccessful candidates. The purpose for which the data was originally submitted — the specific recruitment procedure — has ended. For candidates who were not chosen, continuing to hold their personal data has no valid legal basis under the remaining conditions of Article 10, unless a separate legal ground can be identified.

Accordingly, if the controller still wishes to retain the personal data of unsuccessful candidates after the position has been filled, a separate consent from the data subject is required. Article 11 of the Law further provides that the controller must be able to demonstrate that the data subject has consented to the processing of his or her personal data.

In practical terms: if you want to be able to contact candidates who were not selected, make sure you have their written consent — and make sure that consent is specific, documented and demonstrable.

Practical Checklist

For employers running recruitment processes in North Macedonia: (1) Do not retain rejected candidates’ CVs without consent — once the position is filled, the pre-contractual legal basis for processing expires. Continuing to hold the data without a new legal basis is a breach of the Law on Personal Data Protection. (2) Ask for consent at the end of the process — the cleanest approach is to include a written consent request at the close of the recruitment process: ‘Do you consent to us retaining your CV for future positions? If so, for how long?’ Consent must be freely given, specific and documented. (3) Consent must be specific and demonstrable — under Article 11, the controller must be able to demonstrate that consent was given. A checkbox on a form, a signed statement or a reply email all work — verbal consent does not. (4) Set a retention period — if consent is obtained, define how long the data will be kept. Indefinite retention is not compatible with data minimization principles. One year is a common and defensible period for CV retention. (5) Delete data when consent expires or is withdrawn — once the retention period ends, or if the candidate withdraws consent, the data must be deleted. Maintain a deletion log. (6) For advice on data protection compliance in recruitment, contact our employment lawyers.

Frequently Asked Questions

Is there any lawful basis other than consent for keeping rejected candidates’ CVs?

In most cases, no. Once the recruitment process is concluded and the position has been filled, the pre-contractual legal basis (Article 10(2)(b)) no longer applies. The remaining bases — legal obligation, vital interests, public task, legitimate interests — are unlikely to apply to standard private sector recruitment. Consent under Article 10(2)(a) is therefore the only realistic lawful basis for continuing to hold rejected candidates’ data.

Can the employer rely on ‘legitimate interests’ instead of consent?

This is possible in principle, but the legitimate interests basis requires a balancing test: the employer’s interest in retaining the data must not be overridden by the candidate’s interests or fundamental rights. Given that the candidate submitted their data for a specific purpose (a specific job application) that has now been concluded, it is difficult to argue that continued retention is proportionate without their knowledge and agreement. Obtaining consent is a more legally secure approach.

What form must the consent take?

The Law does not prescribe a specific form for consent, but Article 11 requires the controller to be able to demonstrate that consent was given. In practice, this means written consent — a signed form, a checkbox in an online application, or a written reply confirming agreement. Verbal consent cannot be demonstrated and should not be relied upon.

Can a candidate withdraw consent after giving it?

Yes. Under the Law on Personal Data Protection, data subjects have the right to withdraw consent at any time. Upon withdrawal, the employer must stop processing the data and delete it. The withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal.

How long can the employer retain rejected candidates’ CVs with consent?

The Law requires that personal data be kept for no longer than necessary for the purpose for which it was collected. If the purpose is ‘consideration for future positions’, a retention period of one year is generally considered reasonable and defensible. The consent should specify the retention period, and the data must be deleted when that period expires.

Last updated: July 2026

Note: The above does not constitute legal advice and in no way can be accepted or understood as an instruction to act in a specific case. Each legal situation has its own characteristics that should be reviewed at separately, and for that reason we recommend that you contact a professional – a lawyer – for legal advice.