Talent Pool Care Plan with GDPR Deadlines (Excel)

What's Included in This Talent Pool Care Plan

A talent pool does not fail when it is built. It fails over the following months, when addresses bounce, consents expire and nobody remembers which record had to be deleted when. This Excel workbook turns the upkeep of a pool into a plan with dates, so deadlines are visible before they are missed.

1. A deadline sheet per group: rejected applicants, pool entries with consent, people you found yourself and referrals, each with a retention period, a reminder and a note on the basis. You can change every value.
2. A records tracker for up to 200 entries: enter a short code, the group and the dates. The sheet calculates the delete-on date, the days left, the Art. 14 notice date and a status that turns red, amber or green.
3. 17 recurring upkeep tasks: monthly, quarterly, every six months and yearly, with the last date done, the next due date and an owner.
4. A statutory deadline overview: answering data subject requests, the Art. 14 notice, withdrawal of consent, reporting a breach and the claims period after a rejection.
5. A year calendar: which month brings the deletion round, the consent renewals and the review of your records of processing.
6. A short guide: five steps to get started in an afternoon.

Key Features That Save You Time

• Dates calculate themselves. Enter the start of the retention period and the group, and the sheet shows when the record has to go and whether that day is near.
• Statuses instead of guesswork. “Deletion overdue”, “Notice open” or “OK” in one column, with colours and a filter.
• Art. 14 built in. For people you found yourself and for referrals, the sheet shows the date by which they must be informed, one month after collection at the latest.
• No real names needed. A code or ID is enough, so the plan itself holds as little personal data as possible.
• Your values, not ours. Retention periods are marked as orientation, not statutory deadlines. Agree them with your data protection officer and change them in one place.

How to Use This Talent Pool Care Plan

1. Open the Deadlines sheet and set the retention period, the reminder and the Art. 14 flag for each group.
2. Enter your records in the Records sheet with a code, the group, the date collected and the start of the retention period.
3. Once a month, filter the status column and work through everything that is overdue or open.
4. Once a quarter, run the deletion round and delete the records marked “Deletion overdue”, in exports, side lists and backups as well.
5. Enter the date you last did each task on the Care plan sheet and use the year calendar to plan the months ahead.

Why This Talent Pool Care Plan Works

In our conversations with recruitment agencies and recruiting teams, the pool is usually an Excel sheet plus a folder of CVs, and the real worry is that it turns into dead data. Data protection is rarely the blocker. It becomes a check point once hosting, retention, deletion and consent are answered concretely. This plan turns those answers into dates.

The deadlines it rests on are few and clear. Requests from data subjects have to be answered without undue delay and at the latest within one month (Art. 12(3) GDPR). People whose data you did not collect from them have to be informed at the latest after one month or at first contact (Art. 14(3)). Consent can be withdrawn at any time (Art. 7(3)). For rejected applications, many companies keep the file for about six months, because claims under Section 15(4) AGG must be made within two months and a lawsuit must follow within three months of the written claim (Section 61b ArbGG). That is an orientation value, not a statutory deletion period.

For the reasoning behind retention periods, read talent pool data retention under the GDPR, and for the habits that keep a pool alive how to keep talent pools current.

A Closer Look: The Four Groups and Their Periods

The deadline sheet starts with four groups and preset values that you should check with your data protection officer.

• Rejected application without pool consent: 6 months from the end of the process, a reminder 30 days before, no Art. 14 notice because the data came from the person.
• Talent pool with consent: 24 months from consent or the last interaction, a reminder 90 days before. The file suggests renewing consent after 12 months.
• Found by you under legitimate interest: 6 months from collection or the last reply, a reminder 30 days before, Art. 14 notice required. Without a reply the record is deleted, or moved to the pool with consent if the person agrees.
• Referral without application: 6 months, a reminder 30 days before, Art. 14 notice required because the data came from a third party.

The values are orientation. None of them is a statutory deletion period, and your situation may call for shorter ones. The point of the sheet is that the period is written down once, applies to every record in the group and produces a date you can act on.

Who Should Use This

• Recruiters and agencies that run their pool in Excel and want deletion and consent under control.
• HR teams that keep silver medallists and need a plan their data protection officer can read.
• Data protection officers who want a simple tracker for the retention periods they have agreed.
• Anyone who has inherited an old candidate list and needs to decide what to keep.

If you want the pool to live in one place with import, notes and consent, see the talent pool software and, for the step from Excel, from Excel to a recruiting CRM.

FAQs

How long may I keep rejected applications?

The GDPR names no fixed period (Art. 5(1)(e)). In Germany about six months after the end of the process is a common orientation, because of the time limits in the AGG. Check it with your data protection officer.

Do I need consent to keep someone in a talent pool?

For rejected applicants, a separate and voluntary consent is the usual route. For people you found yourself, legitimate interest under Art. 6(1)(f) can apply, with a written balancing test and an Art. 14 notice.

Does the file delete records for me?

No. It shows what is due. You delete in your own system, and in exports, side lists and backups.

Can I use it for a pool in another tool?

Yes. The plan is tool-independent. Enter the record code from your system and the dates.

Is this legal advice?

No. It is a working aid. Retention periods are orientation values that you should settle with your data protection officer.

What if someone asks for deletion before the deadline?

Then the request wins over the planned date. Art. 17 GDPR gives the person a right to erasure, and you have to answer within one month (Art. 12(3)). Delete the record, in exports and backups too, and enter the date in the Done column of the tracker.

How do I handle a record that fits two groups?

Choose the group with the shorter period unless the person has consented to be kept longer, because the consent decides. If someone you found yourself replies positively and agrees to stay in the pool, move them to the group with consent and note the consent date.