Yes, most companies do keep your resume on file after you apply, and for employers of any real size federal law requires it. Under EEOC rules, employers with 15 or more workers must preserve applications and resumes for at least one year from the date of the hiring decision. Many go further and hold them for two to three years as a ready-made talent pool, and a growing number of states now give you the right to ask that your data be deleted.
The One-Year Federal Floor
The baseline rule comes from 29 CFR 1602.14, an EEOC regulation covering employers subject to Title VII and the Americans with Disabilities Act. Any personnel or employment record, including application forms, resumes, and test results, must be preserved for one year from the date of the record or the hiring decision, whichever is later.1eCFR. 29 CFR 1602.14 – Preservation of Records Made or Kept The clock starts when the company fills the position, not when you submitted your application.
The Age Discrimination in Employment Act adds a parallel one-year requirement for employers with 20 or more workers, covering job applications, resumes, and records tied to hiring, promotion, or termination decisions.2eCFR. 29 CFR Part 1627 – Records to Be Made or Kept Relating to Age Most mid-size and large employers are covered by both rules at once, so the one-year minimum is nearly universal above a small-business threshold.
The reason for the rule is enforcement. If a rejected candidate files a discrimination complaint, investigators need to compare qualifications across applicants. Without the records, that comparison is impossible, which is why the regulation specifically reaches interview notes and test results alongside the resume.
Two Years for Federal Contractors
If you applied to a federal contractor, your resume falls under the Office of Federal Contract Compliance Programs and stays on file longer. Contractors with 150 or more employees or a government contract worth at least $150,000 must keep personnel and employment records, including resumes and application materials, for a minimum of two years from the date of the record or the hiring decision. Smaller contractors follow the one-year floor.3eCFR. 41 CFR 60-1.12 – Record Retention
The OFCCP rule is unusually specific about digital records. Contractors must log every search run against an internal resume database, including the criteria used and the date. The same tracking obligation applies to external resume databases they subscribe to. Your resume isn’t just sitting somewhere; the contractor also has to document every time a recruiter surfaced your profile for a different role.
What “On File” Actually Means Inside an ATS
The physical filing cabinet is gone. Nearly all mid-to-large employers use an Applicant Tracking System that parses your document on submission, pulling out job titles, skills, employers, and years of experience into a structured database. Once that extraction happens, your resume is no longer a document. It’s a searchable profile.
A resume submitted for a marketing role can resurface months later when a recruiter searches for someone with project management experience. Algorithms rank candidates by keyword relevance, so profiles with the strongest match appear first. Even applicants who were never interviewed remain discoverable for future openings, which is why keyword choices on the resume you sent still matter long after you sent it.
Many ATS platforms now layer predictive analytics or AI scoring on top of keyword matching, evaluating candidates against patterns from past hires. Several states have begun requiring employers to notify candidates when AI tools play a role in hiring decisions, including what data the system collects and how it influences outcomes. Some of those laws also give candidates the right to request human review of an AI-driven decision. This area is moving fast, with multiple state laws taking effect in 2025 and 2026 and a federal framework under consideration.
How Long Companies Actually Keep It
Legal minimums are floors, not targets. Most companies keep resumes for two to three years because searching their own database is cheaper than posting fresh job ads. Cost-per-hire from an internal talent pool runs well below external sourcing, so there’s a direct financial reason to hold on to profiles.
The tradeoff is data decay. After a year or two, people change jobs, learn new skills, and move. A resume from 2023 tells a recruiter very little useful in 2026. Many companies set automated purge cycles that archive or delete profiles inactive for 18 to 24 months. Oversized databases also slow search performance and expand the attack surface for data breaches, and IT and legal teams generally agree the risks of hoarding stale data eventually outweigh the recruiting upside.
Federal contractors tend to sit on the longer end of the range, since their regulatory floor is already two years and their search-logging requirements make extended retention easier to justify. Private-sector employers without government contracts usually stay closer to one to two years unless a specific business reason pushes them longer.
How to Get Your Resume Deleted
A growing number of states have passed comprehensive privacy laws that let residents request deletion of personal data held by businesses, including resumes and application history. These laws typically give companies 45 days to respond, with a possible 45-day extension if they notify you. The right reaches data in active systems, databases, and backups, though companies may retain information they need to comply with legal obligations such as the federal recordkeeping rules above. In other words, a deletion request can’t override the one-year EEOC floor or the two-year OFCCP window, but it applies to everything the company is keeping beyond that.
To exercise the right, look for a privacy request portal on the company’s website, or contact its data privacy officer or HR department. Most large employers now maintain a dedicated email address or online form for data requests. You’ll usually need to verify your identity before the company processes the deletion. If a company ignores a valid request, statutory damages in states with these laws can range from a few hundred to tens of thousands of dollars per violation, depending on the state and whether the failure was intentional.
If you applied to a company with European operations, the General Data Protection Regulation offers a similar right. Under the GDPR, a company must delete personal data when it’s no longer necessary for the purpose it was collected, or when you withdraw consent. The GDPR carves out exceptions for data needed to defend legal claims or comply with a legal obligation, so a company can’t be forced to erase records it’s required to keep under employment law.4GDPR Info. Art. 17 GDPR – Right to Erasure (Right to Be Forgotten)
Update Instead of Delete?
Deletion isn’t always the right move. If you’re still open to roles at the company, keeping a current resume in the system means recruiters will find your latest qualifications when they run a search. Most ATS platforms let candidates log back in to update the profile, upload a new resume, or change contact details.
Deletion makes more sense when you’ve left an industry, when the company holds information you’d rather not have sitting in a corporate database, or when you’re trimming your digital footprint on principle. Once your profile is gone, you’ll generally start from scratch if you apply there again, including re-entering everything and re-consenting to any background check authorizations.