TL;DR

The right to be forgotten - formally the right to erasure under GDPR Article 17 - gives individuals the right to request that their personal data be deleted. For recruitment platforms and staffing agencies, this right is frequently exercised by candidates and requires a defined, documented process that balances erasure obligations against legitimate retention requirements.

What the Right to Be Forgotten Means in Practice

GDPR Article 17 grants the right to erasure without undue delay when one of six grounds applies. The grounds are: the data is no longer necessary for the purpose it was collected; the individual withdraws consent and there is no other lawful basis; the individual objects under Article 21 and there are no overriding legitimate grounds; the data was unlawfully processed; erasure is required by EU or member state law; or the data was collected from a child for information society services. Each ground has specific conditions, and not all erasure requests qualify under Article 17.

Erasure requests that do qualify must be actioned "without undue delay" and in any case within one month. The one-month period can be extended by two further months for complex or numerous requests, but the individual must be notified of the extension and the reason within the first month. Failure to respond within the deadline is itself a violation, separate from any question about whether the erasure was correctly handled.

The right to erasure is not absolute. Article 17(3) lists exceptions: compliance with a legal obligation; performance of a task carried out in the public interest; public health grounds; archiving, research, or statistical purposes in the public interest; and the establishment, exercise, or defence of legal claims. For staffing agencies, the legal claims exception is practically important. If an agency is in a dispute with a former contractor about unpaid invoices or discrimination claims, it can retain the relevant data for the duration of that dispute - but not indefinitely, and not data beyond what is relevant to the specific claim.

Deletion in complex systems is harder than it sounds. A candidate's data may exist in the primary ATS database, in backup snapshots, in exported CSV files, in email threads, in a separate analytics database, in logs, and in data shared with sub-processors such as background check providers or video interviewing platforms. A complete erasure must address all of these locations. Most organizations cannot achieve truly complete erasure of historical backups without deleting entire backup sets - the practical approach is to document that the individual's data exists in backup only, will not be restored unless legally required, and will be overwritten when the backup retention period expires.

Why the Right to Be Forgotten Matters for Recruitment Teams

Supervisory authorities treat slow or refused erasure responses as significant violations. The Irish DPC fined TikTok €345 million in 2023 partly for failures in handling children's data requests. While that case involved different specifics, the principle is consistent: failure to handle data subject rights within GDPR's timeframes attracts regulatory attention. The UK ICO's enforcement action against companies for SAR (Subject Access Request) failures is even more active, with reprimands and fines issued regularly.

For staffing agencies, erasure requests create operational complexity because candidate data has multiple legitimate retention bases running simultaneously. A candidate who requests erasure may have payroll records that must be retained for six years under HMRC requirements, while their CV and interview notes are clearly erasable. The correct response is partial erasure: delete the data for which there is no retention obligation, retain only what is legally required, and document clearly what was retained and why. Blanket refusals ("we need all your data for our records") are not compliant.

Right-to-erasure requests from placed contractors who have left are particularly common. Agencies should anticipate a spike in requests following contract terminations and have a documented process that pre-identifies which data categories are erasable and which fall under the HMRC or immigration law retention exceptions.

The Right to Be Forgotten in Action

A job seeker applied for three roles through a [staffing agency](/glossary/staffing-agency) 18 months ago, was not placed, and now requests erasure of all their data. The agency's process maps the candidate's data across all systems: the ATS (CV, interview notes, communication history), the email system (recruiter correspondence), the video interview platform (recorded interviews), and the background check provider (they were screened for one role). The agency deletes the ATS records, deletes the email correspondence, requests deletion from the video platform per the sub-processor DPA, and requests deletion from the background check provider. The backup data exists in monthly snapshots but will not be restored. The agency responds to the candidate within 25 days confirming erasure, documenting what was deleted, from which systems, and on which dates.

Compliance Checklist