KVKK compliance is a must when processing candidate data (CV, application form, interview notes) in HR processes.
Legal Basis
- Establishment of an employment contract (Art. 5/2-c)
- Explicit consent for subsequent communication
- Explicit consent for special data (health, registry)
Disclosure
- Clarification at the application stage text
- Purpose of the data (interview, recruitment)
- Storage period
- 3. whether the person was shared or not
Retention Period
- Hired: employment contract duration + statute of limitations (5-10 years in total)
- Not hired: 6 months - 1 year (explicit consent to keep on the reserve list)
- Expired: destruction
Interview Notes
- Note about the candidate during the interview can be obtained
- Information must be provided
- Storage period is around 1 year after the interview
Record/Criminal Record
- Can only be requested if the position requires it
- Candidate's own consent is required
- Limited storage (destruction after use)
HR Data Violations
- Candidate CVs infiltration
- Access by unauthorized personnel
- 3. personal applications (unless there is special consent)
KVKK Board Decision
KVKK Board has made keeping a "reserve candidate list" in HR processes a condition of explicit consent, and considers keeping it without permission as a violation.
Practical Recommendations
- Clarification in the application form + optional consent
- Automatically accept expired CVs. destruction
- Authority limitation (HR personnel only)
- Encrypted storage
KVKK expert lawyer recommended.