The management and processing of curricula vitae (CVs) by employers, whether public or private, are now subject to a new regulatory framework. The National Authority for the Protection of Personal Data (ANPDP) has established the conditions governing the collection and archiving practices of application files, placing a particular emphasis on safeguarding sensitive information.
This provision, outlined in a deliberation dated November 11, 2026, aims to curb abuses observed during hiring procedures. The Authority reminds entities that all data processing operations involving information contained in resumes fall under the oversight of the regulatory framework. Any breach of the rules in force exposes offenders to penalties prescribed by law.
Information appearing on a resume is not limited to a candidate’s identity, degrees, and professional experience. It can also disclose highly sensitive details, notably racial or ethnic origin, political opinions, religious beliefs, union membership, or even genetic data. Such information is strictly governed by Article 18 of Law No. 18-07 concerning the protection of individuals in the processing of personal data, as amended and supplemented.
The Authority stresses the general principle prohibiting the processing of this data, except in exceptional situations expressly authorized by law and subject to compliance with stipulated conditions and safeguards. In this regard, it specifies that the mere presence of sensitive details in a resume, whether provided voluntarily by the applicant or requested by the hiring organization, does not constitute sufficient legal justification for processing them.
In other words, employers cannot systematically gather all information appearing in application files on the pretext that it was submitted by applicants. Processing must be restricted to relevant data strictly necessary for achieving a legitimate and clearly defined purpose, while respecting the fundamental rights and freedoms of the individuals concerned.
Under this deliberation, the National Authority imposes several obligations on those responsible for handling resumes. They must not require applicants to disclose sensitive information unless justified by a legal provision. They are also obligated to delete or redact sensitive details that serve no purpose in the hiring process, while ensuring the security and confidentiality of the files.
The Authority thus warns against the risk of turning the resume into a tool for gathering personal details unrelated to job requirements. It calls upon recruiting organizations to adopt preventive measures so that only data indispensable for evaluating candidates’ skills and qualifications are collected and utilized.
At the same time, it advises applicants to exercise caution when preparing their resumes and to avoid including sensitive information that is unnecessary for demonstrating their skills or meeting specific legal conditions tied to the targeted position.
The other major point of this deliberation concerns the retention period for application files. This is now set at one year for the resumes of unsuccessful candidates, starting from the closing date of the recruitment or professional selection procedure.
This duration may nevertheless differ when a legal text provides for or justifies a specific retention period. Beyond the established deadline, data controllers are required to erase the resumes and the personal information they contain or proceed with their secure destruction, so as to prevent any subsequent recovery or consultation.