Candidate data deletion request evidence for Philippines recruiting support

Decision and scope. Recruiting systems distribute candidate information across an applicant tracker, email, scheduling, assessment, sourcing, background-check, and talent-community tools. The staffing question is whether a Philippines recruiting coordinator can receive a deletion request, establish its system scope, and maintain evidence through disposition without deciding what the organization is legally required to retain. The study distinguishes request intake, identity handling, data mapping, owner decision, system action, vendor confirmation, and communication. Coordinators can administer a defined workflow. Privacy, legal, records, security, and recruiting owners decide eligibility, holds, exemptions, retention periods, and the meaning of deletion in backups or legally required records. This is an operational study, not a statement of any applicant’s legal rights.

Population and unit. Freeze all candidate contacts in a closed interval requesting deletion, erasure, account closure, withdrawal, removal from a talent pool, marketing opt-out, correction plus deletion, or an explanation of retained records. Include requests from unsuccessful and hired candidates, agency submissions, duplicate profiles, inaccessible accounts, former workers, and messages later found to concern another privacy right. One person-request episode is the unit, linked across duplicate identities and systems without exposing unnecessary personal data in the research extract. State recruiting entities, geographies, systems, vendors, channels, policy versions, timezone, and cutoff. Sampling only completed deletion tickets would conceal intake misses, identity dead ends, and requests recategorized outside recruiting.

Data map and evidence. Record a protected request identifier, channel and receipt time, identity-verification state, asserted identifiers, matched candidate profiles, recruiting stage, systems searched, vendors involved, consent or preference records, retention schedule reference, legal-hold check result, owner decision and rationale code, action tickets, deletion or restriction events, failed actions, vendor responses, completion review, communication, appeal or follow-up, and later profile reappearance. Keep full resumes, assessment results, government identifiers, and background information out of the analytical ledger. Use restricted pointers where review is authorized. Separate the candidate’s statement, system matches, policy decision, and technical outcome. “Ticket complete” is not the same as “data removed,” while “record retained” is not automatically a failure if an authorized exception applies.

Method. Search inbound recruiting channels as well as privacy queues, select requests before disposition, and stratify by region, source, candidate stage, hired status, duplicate-profile count, vendor footprint, and decision class. Trace requests forward across each in-scope system, then sample deletion events and suppressed profiles backward to an authorized request. Two reviewers independently assess request recognition, minimum identity handling, scope completeness, policy version, owner authorization, action evidence, vendor follow-up, and response accuracy. Preserve disagreements. Test workflows with synthetic profiles rather than deleting real records for research. Confirm that test data cannot contaminate production recruiting metrics or send messages to actual candidates.

Measures and interpretation. Report denominators for detected requests, verified or safely unmatched identity, complete system map, timely owner decision, completed authorized actions, vendor confirmation, exception documentation, accurate response, later reappearance, and unresolved aging. Show elapsed time by intake, identity, owner, internal system, and vendor phases. A high deletion percentage is not a quality measure because some records may require restricted retention; a low percentage is equally ambiguous without decision reasons. Fast closure can mean only the applicant tracker was checked. Compare outcomes by system footprint and request complexity rather than ranking coordinators by raw duration. The defensible outcome is a reproducible disposition for each system, with uncertainty and unavailable evidence visible.

Identity and minimization. Identity proof should be proportionate and prescribed by the accountable privacy owner. Asking a candidate to resend sensitive documents can create more risk than it resolves. Examine whether existing authenticated access, known contact channels, or limited matching fields suffice under the approved process. If identity remains ambiguous, record the safe pending state and owner path; do not reveal whether a particular profile exists. During system search, expose only what the coordinator needs. Research extracts should use pseudonymous identifiers and access logs. A request to remove recruiting marketing may be executable even when a broader deletion decision remains open, but only if the policy clearly separates those actions.

Failure modes and boundaries. Common gaps include duplicate profiles under alternate emails, exported resumes in shared drives, interview notes in calendars, assessment vendors omitted from the map, deleted profiles recreated by sourcing imports, and communications that overstate what happened to backups. A coordinator may classify the request, perform approved matching, maintain the checklist, create restricted vendor tasks, apply an authorized suppression, and send owner-approved status text. They must not promise total erasure, decide a legal hold, invent a retention period, access background data without need, remove an audit record, or disclose profile existence to an unverified contact. Owners must resolve conflicts among recruiting, employment, litigation, fraud, tax, and privacy requirements.

Sources and boundary. The U.S. Equal Employment Opportunity Commission publishes federal recordkeeping guidance for employment records, while the FTC provides business privacy and data-security guidance. NIST’s Privacy Framework offers a voluntary approach to identifying and managing privacy risk. These materials establish useful context but do not provide one deletion rule for every candidate, employer, jurisdiction, or system. The study’s workflow and measures are operational inferences. Applicable privacy laws, employment rules, litigation holds, contracts, consent terms, and cross-border transfer requirements require qualified review. The report must not tell a coordinator that a request is legally valid or that a particular record may be destroyed.

Limitations and decision rule. System APIs may report success while retaining backups, logs, or downstream copies. Vendor attestations vary in detail. Email search can be incomplete, and candidate matching can create false positives. A later reappearance may result from a new application rather than failed deletion. De-identification can hide duplicate clues; broad access can create unnecessary exposure. Delegate administration only when request signals, identity method, system inventory, retention authority, hold checks, action permissions, vendor ownership, response language, and reappearance controls are explicit. Pause expansion after scope omissions, unsupported deletion claims, excess-data collection, coordinator-made legal decisions, or records recreated without explanation. The reader outcome is a privacy-aware coordination role with consequential judgments reserved to authorized owners.

Worked scenario and retest. An unsuccessful candidate asks to delete “my application and stop all recruiting messages.” Search finds an applicant profile, talent-community record, calendar entries, and an assessment-vendor reference. Marketing suppression may follow a preauthorized path while deletion awaits the owner’s retention decision. The coordinator records each system separately, avoids copying the resume, sends a vendor task only after authorization, and does not promise removal from backups. A possible second profile remains a restricted identity question. Review unmatched requests, profiles rediscovered by sourcing, vendor tasks without confirmation, and unsupported absolute language. Effective-date the system inventory; adding a tool must add a disposition step before candidate data enters it. Synthetic profiles should test search, suppression, authorized deletion, audit retention, and reimport. Privacy and recruiting owners jointly review results, while training emphasizes minimum data and neutral status language.

Primary and authoritative sources. “Recordkeeping Requirements,” U.S. Equal Employment Opportunity Commission, eeoc.gov “Protecting Personal Information: A Guide for Business,” Federal Trade Commission, ftc.gov “NIST Privacy Framework,” National Institute of Standards and Technology, nist.gov Checked October 5, 2026. Retest with a synthetic new application after synthetic deletion to distinguish fresh intent from unauthorized restoration. Review every supported-language response, authorization identity, policy version, remaining restricted record, and control preventing a sourcing import from silently recreating the old profile.