What data you may collect in the first place

The benchmark is not in the Federal Act on Data Protection (FADP), it is in the Code of Obligations. Article 328b CO states that an employer may process data about an employee only insofar as it concerns their suitability for the job or is necessary for performing the employment contract.

The wording refers to employees. The Federal Data Protection and Information Commissioner (FDPIC), the federal supervisory authority for data protection, however, applies the same benchmark to the application stage: before the employment relationship begins, only those personal data of candidates that concern their suitability for the job may be processed.

In practice: every question in your application form has to stand up to that test. If you are hiring a lorry driver, you may ask about the driving licence. Nobody asks about marital status, family planning or religion unless the job strictly requires it. A set of criteria fixed before the job goes live helps twice over: it keeps data collection lean and makes the selection traceable.

Duty to inform: what candidates need to know

If you request application documents as part of a recruitment process, you must inform the people concerned. Among other things, you must state the purpose of the processing, who is responsible, and how that party can be reached.

In the Refline applicant management solution, a privacy notice sits directly on the application form. Alternatively it lives on your website, linked at the point where the application starts. Leaving the information out risks a fine.

Obligation to delete: how long you may keep an application file

Application documents may only be kept for as long as the original purpose exists: filling this position. If the position goes to someone else or is not filled at all, that purpose falls away.

That does not settle the question yet. The FADP names no fixed retention period, and the FDPIC states expressly that the duration has to be set for each category of data. Alongside the original purpose, further duties and interests can justify keeping documents longer: a possible claim over a discriminatory rejection, evidence for SECO or the regional employment centre, or a legitimate interest of the company that you can explain.

What follows from this is not a number but a decision: define for each category of data how long you need it, record the reason, and delete after that. Anyone who clings to a single figure in months without looking at their own case ends up either too short or too long.

On top of that comes a duty that often goes unnoticed: once the selection procedure is complete, the documents of rejected candidates must be returned and any copies destroyed. You may keep only what belongs to you, meaning the letter of application, the personnel questionnaire and information obtained from reference checks.

Why this barely works over email

When an application arrives by email and is then forwarded internally, commented on and filed somewhere, it leaves a data trail across several mailboxes and drives. Finding and deleting all of it months later rarely succeeds. Yet that is exactly what the law requires.

With an e-recruiting solution such as Refline, every application sits in one place. The deletion periods you have defined run automatically, and you archive applications and job postings in a data protection compliant way with one click. Instead of searching and chasing, you are left with a deadline that takes care of itself.

Talent pool: when you may keep a file for longer

Keeping a file after a rejection is allowed, provided the person consents.

That consent has to be explicit, and it needs a clear deadline: until when the file will be kept. «Until further notice» is not enough. For the consent to be valid it must also be given voluntarily, for a specific processing operation, and after adequate information.

In practice that means: every file in the talent pool has an expiry date, and the person knows about it because they agreed to it. A pool without an expiry date is the most common quiet breach of the deletion duty.

Right of access: 30 days, free of charge, cannot be waived

Anyone may ask whether data about them is being processed. Candidates are entitled to complete and accurate information. The act lists what must be provided: the identity and contact details of the controller, the personal data processed, the purpose, the retention period or the criteria for it, available information on the origin of the data, the recipients, and, in the case of an automated individual decision, the logic on which it is based.

Three points where things go wrong in practice:

The deadline. The information must be provided within 30 days of the request being received. If you cannot manage that, you must inform the person within the same period and tell them by when they can expect the information. The same applies if you want to restrict or refuse the information.

The cost. The information is free of charge. Only where the effort is disproportionate may a reasonable contribution of no more than 300 francs be requested, and that must be communicated in advance.

Waiver. Nobody can waive the right of access in advance. A clause in an application form that attempts this has no effect.

If you use an applicant tracking system from a provider, the duty to provide information still sits with you. The provider is a processor, not the addressee of the request.

Where candidate data sits

As soon as a provider’s applicant tracking system is involved, that provider processes the data on your behalf. You remain responsible for it and must satisfy yourself that the provider ensures data security. If the data sits abroad, additional requirements apply.

The shortest answer to that question is not having to ask it. Refline operates all applications in Switzerland, including the CV parser module and the AI applications. The data centres are ISO 27001 certified.

AI in pre-selection: what the law says, and what it does not

As soon as a system scores applications automatically, two terms come into play.

Profiling is the automated processing of personal data in order to evaluate personal aspects, such as work performance, reliability or behaviour. Scoring applications falls under that wording. High risk profiling exists where linking the data allows an assessment of essential aspects of a person's personality. Two consequences follow: where consent is required, it must be express. And the exemption from keeping a register of processing activities falls away, including for smaller companies.

Automated individual decision is the second term. If a decision is based exclusively on automated processing and has a legal consequence for the person or significantly affects them, you must inform them about it. The person may state their position and request that a human review the decision. The decisive word is "exclusively": if a person reviews the suggestions and decides for themselves, the provision does not apply on its wording.

And now the part many guides leave out: there is no official Swiss threshold for when AI screening in recruiting becomes high risk profiling. Anyone who gives you a clear threshold is interpreting rather than citing. Only the reverse inference is solid: the more a system decides by itself, and the more attributes it links to do so, the more likely you are in regulated territory. Anyone using an AI tool in the application process should therefore document what role it plays and who carries the decision.

When something goes wrong: notification and fines

If a breach of data security is likely to result in a high risk to the personality or fundamental rights of the person concerned, you must notify the FDPIC as quickly as possible. Unlike the GDPR, Swiss law names no 72 hour deadline. The notification states at minimum the nature of the breach, its consequences and the measures taken or planned. You inform the person concerned where this is necessary for their protection or where the FDPIC requires it.

Fines run up to 250,000 francs and fall on the responsible natural person, not on the company. They require intent. Where a fine of no more than 50,000 francs is in question and identifying the responsible person would take disproportionate effort, the authority may sentence the business operation instead.

Frequently asked questions on data protection in recruiting

The questions Swiss HR teams ask us most often about data protection.

How long may I keep application documents?

The FADP names no fixed period. What counts is the purpose: once the position is filled, the original purpose falls away. Alongside that, further duties and interests can justify keeping documents longer, such as a possible claim over a discriminatory rejection, evidence for SECO or the regional employment centre, or a legitimate interest of the company that you can explain. You therefore set the duration for each category of data yourself and record the reason.

May I move a file into the talent pool without consent?

As a rule, no. The clean route is explicit consent, combined with a clear deadline for how long the file will be kept. Without that consent, the talent pool is not the right place for the file.

How quickly must I answer a request for access?

Within 30 days of receipt. If that is not enough time, you must inform the person within the same period and tell them when the information will follow. The information is free of charge; only where the effort is disproportionate may a contribution of no more than 300 francs be requested, announced before the information is provided.

Does my company need a register of processing activities?

Companies employing fewer than 250 people on 1 January of a given year are exempt from this duty. The exemption falls away as soon as sensitive personal data is processed on a large scale or high risk profiling takes place.

Conclusion: data protection in recruiting is a question of process

None of the obligations in this article is difficult on its own. It gets difficult when applications are scattered across mailboxes, drives and notes. Then the deletion deadline fails at the searching stage, and providing information within 30 days turns into a night shift. Anyone who keeps applications in one place has done the largest part of the work before the first deadline even starts running.

Data protection obligations solved cleanly, with Refline

With the e-recruiting solution from Refline, the data protection functions sit inside the application process itself. From consent on the form to the automated deletion deadline. Operated in data centres in Switzerland.