Employers face stricter hiring rules and a strict one-year destruction deadline for unsuccessful candidate profiles under new data protection regulations.
The Autorité nationale de protection des données à caractère personnel adopted deliberation no. 05 on Nov. 11, 2026, targeting personal data processing in curriculum vitae documents, horizons.dz reported. The text establishes binding rules for public and private organizations handling job applications.
Recruiters can no longer demand sensitive information without legal justification. Under law no. 18-07 of June 10, 2018, regarding the protection of natural persons in personal data processing, sensitive data includes racial or ethnic origin, political opinions, religious convictions, trade union membership, and genetic data.
Article 18 of the 2018 statute prohibits processing such details unless explicit legal exceptions apply. The regulatory authority emphasizes that a candidate mentioning sensitive points on a CV does not grant the employer automatic rights to exploit them.
Organisations must mask or discard unnecessary candidate details while maintaining strict file security. Paper applications and digital submissions through recruitment platforms face identical compliance standards.
For applicants not selected, organisations have a one-year retention limit starting from the end of the recruitment procedure. After this 12-month window, files must be securely destroyed or deleted to block future access, unless specific legal texts require a different duration.
| Parameter | Regulatory Requirement |
|---|---|
| Sensitive Data Rule | Prohibited without explicit legal justification |
| Regulatory Authority Control | Deliberation no. 05 enforced upon publication |
The authority retains full oversight powers to inspect recruitment data practices and initiate legal procedures for non-compliance.
Disclaimer: The information provided in this article is for educational and informational purposes only and does not constitute financial advice.
