Is it okay to contact candidates who applied a long time ago?
Yes, in most cases, as long as you still have a legitimate reason to hold their data and your outreach relates to a genuine job opportunity. When someone applies to your company, they generally consent to your company considering them for future roles, not just the one they applied for. Reaching out about a new, relevant opening usually falls within that original consent.
The exception is data retention limits. Under GDPR and similar privacy laws, you can only keep candidate data as long as you have a lawful reason to hold it. If your retention policy says you delete applicant data after 12 months, reaching out to someone whose data should already be gone creates a compliance problem, even if they would welcome the message.
Before contacting an old applicant, check three things:
- Your retention policy. Confirm the candidate's data still falls within your stated retention window.
- The original consent scope. Most standard application consent covers future roles at your company, not just the one they applied for.
- Applicable regional law. GDPR, CCPA, and similar frameworks give candidates the right to request deletion or object to further contact at any time.
Reaching out to someone from six months ago is standard practice in recruiting. Reaching out to someone whose data you should have already deleted is not.