Swiss Recruiter Keeps Your CV? Request Access, Correction or Deletion

If a Swiss recruiter keeps your CV or interview notes after a hiring process ends, start by asking a focused question: which organization controls the file, what personal data is being processed, for what purpose, who receives it, and how long is it expected to be kept? Under Switzerland’s revised Federal Act on Data Protection (FADP), a person can request information about personal data being processed. That does not mean every rejected candidate can demand immediate deletion of every record in every circumstance.

The Federal Data Protection and Information Commissioner (FDPIC) explains how applicant and employee data should be handled during recruitment and employment. Its guidance says applicant information should relate to suitability for the role. At the end of a process, application documents should generally be returned or copies destroyed, subject to circumstances such as the applicant agreeing to a defined retention period for future opportunities or an overriding interest. The same guidance recognizes that some essential employment records may need to be retained after a relationship ends.

The governing statute is the Federal Act on Data Protection (FADP), SR 235.1. Article 6 sets processing principles, including good faith, proportionality and purpose limitation. Article 25 provides a right to request information about personal data being processed. Article 32 addresses claims where processing infringes personality rights, including requests for correction, deletion, or cessation in the circumstances specified there. These are not an unconditional “delete everything immediately” button: legal duties and overriding interests may matter.

This guide is about Swiss private-sector recruitment and the federal FADP. Public bodies can have additional or different rules. A recruitment agency, the hiring company and a group company may each hold different data and may have distinct controller roles. A request should identify the organization and account you used, and should not assume that one HR inbox controls every copy.

First identify the organization and the data

List the people and organizations that interacted with you: the recruiter, agency, hiring company, background-check provider, assessment vendor and any group company. A recruiter may be a processor acting for an employer, a controller for its own talent pool, or both in different activities. Ask the recipient to confirm whether it is responsible for the relevant processing and, if not, to identify the appropriate contact where it can.

Describe the record categories rather than demanding “all data” in a way that is hard to process. Useful categories include:

Do not send a passport, complete personnel file or sensitive documents just to prove your identity unless the controller reasonably needs a proportionate verification step. Ask how to provide any verification securely. Never attach confidential documents belonging to a former employer or another candidate.

Make a clear FADP access request

The FDPIC’s official guidance on asserting data-protection rights explains that an individual can approach the controller and request information about the processing. The request should be specific enough for the organization to locate the file, while covering the information you need to understand it.

For example, a request can ask the controller to confirm whether it processes personal data about you; provide the data and information required by the FADP; explain the recruitment purpose, categories, recipients and retention approach; and describe how to submit a correction or deletion request. If there are multiple entities, send a separate request to each one that appears to control a distinct database.

Keep the tone neutral. Do not state that the organization has violated the law merely because it has not replied to an informal message or because you suspect it retains a CV. Record the sent date, recipient, delivery evidence and any response. If the controller asks for clarification or identity verification, respond through its secure channel and keep a copy.

The FADP contains rules about the timing and form of a response. The exact application can depend on the request, the identity check and statutory grounds for restriction or refusal. Do not rely on a general online template that promises a particular deadline or a guaranteed complete export. If a material response deadline is missed, check the current statute and FDPIC guidance before escalating.

Separate access, correction, objection and deletion

These requests solve different problems. A person may want to know what is stored, correct a wrong phone number, stop an old profile from being used for new roles, or ask for unnecessary records to be erased. Combining them into one vague demand can make it harder to identify the desired outcome.

Access asks what data and processing information the controller holds. Correction identifies a concrete factual error, such as the wrong employment date or an assessment score attached to another person. Deletion asks that data no longer needed or unlawfully processed be erased, subject to applicable retention grounds. Restriction or objection can be relevant where continued use is disputed or the purpose has changed. The precise legal basis and remedy should be assessed under the FADP, not imported from the EU GDPR by analogy.

An interview comment such as “candidate seemed uncertain” may be an evaluative note rather than a simple factual error. You can explain why it is inaccurate or incomplete and ask that your response be associated with the record. Whether the original must be changed or removed depends on its context, accuracy, purpose and legal grounds. Do not silently edit a copy of the recruiter’s record and present it as the original.

Why retention may continue after rejection

The FDPIC’s page on different phases of the employment relationship describes recruitment-specific handling. It says applicant data should be relevant to suitability and that, at the end of the process, files should generally be returned and copies destroyed. It also recognizes an applicant’s consent to retain a file for a defined period to consider the person for later positions, and an overriding-interest exception in appropriate circumstances. A recruiter should be able to explain the purpose and period rather than retaining an open-ended profile by default.

For employees, the same FDPIC guidance explains that some records can be kept for legal, tax, insurance, dispute or reference purposes, while other information should not be retained after it is no longer needed. A rejected applicant is not automatically an employee, and a candidate file is not the same as payroll, tax or workplace safety records. Ask the organization to separate the record types and explain the ground for each continued retention.

The FADP’s proportionality and purpose principles do not mean every copy disappears as soon as you ask. A company may need a limited record to respond to a concrete legal claim or comply with a retention duty. If it keeps a minimal record for that purpose, it may also need to restrict access and avoid repurposing it for unrelated recruiting. Ask whether the data is still actively used, archived with restricted access, or scheduled for destruction.

Request a practical resolution

If your main concern is unwanted future contact, say so separately from deletion. You might ask the recruiter not to contact you for future roles, to remove your profile from an active search database, and to explain whether a minimal suppression record must remain so the organization can honor your preference. A request not to be contacted may be operationally useful even if some records are retained for a lawful reason.

If a particular document is inaccurate, quote the field or sentence, provide the correct information and attach only supporting material necessary to establish the correction. If the correction concerns a sensitive matter, ask for a secure upload mechanism. Do not email identity documents to an unverified address.

If a recruiter says it cannot delete a record, ask it to identify the record category, purpose, applicable legal or overriding interest, expected retention period, access restrictions, and whether the record can be made inactive or corrected. A clear explanation can distinguish a valid retention need from a stale candidate profile still being used for recruitment.

Fictional example: a candidate’s old profile

Suppose Léa applied through an agency for a finance role in Zurich. She was rejected, then later received an unrelated job alert from the same agency. She wants to know whether her CV was shared with the hiring company and does not want her profile used for future roles.

Léa first identifies the agency’s privacy contact and the employer’s contact from the application materials. She sends each a tailored access request for records each organization controls, asks about recipients and the stated retention period, and requests that the agency stop using her profile for new opportunities. She separately asks the agency to delete documents that are no longer necessary and to explain any limited records it must retain. She does not claim that the job alert itself proves an unlawful disclosure. If the agency explains it retains a minimal suppression record to prevent further contact, she can ask it to confirm that the record is not used to match her to roles. This example illustrates a process, not an outcome guaranteed by law.

What if the controller refuses or gives an incomplete answer?

Read the response carefully and identify what is missing: the data itself, the recipient list, the purpose, the retention explanation, or the answer to a particular correction/deletion request. Reply with a short numbered list and a reasonable request for clarification. Keep the original request and response together.

The FDPIC’s rights guidance explains options for asserting rights and notes that a controller may have grounds to refuse or limit a request, including legal duties or overriding interests. If the disagreement remains material, consult the FDPIC’s current process and consider Swiss counsel. The FDPIC’s role and available remedy are not identical to a court judgment in an individual dispute.

If the issue is instead an actual security incident, distinguish it from ordinary retention. The organization should assess what happened, what data was affected, who received it, whether access continues, and whether FADP notification duties are triggered. A recruiter’s internal email containing a candidate’s name is not, by itself, enough to conclude a reportable data breach occurred. Do not threaten criminal prosecution or claim a regulator must be notified without facts and a legal basis.

Common mistakes

• Treating Swiss FADP rights as identical to the EU GDPR or assuming a universal immediate-erasure rule.
• Sending one request to an agency and assuming it reaches every employer and vendor.
• Demanding deletion without identifying which data, purpose or record is involved.
• Calling every interview note objectively false when it may be evaluative or incomplete.
• Assuming the hiring company, recruiter and background-check provider share one controller role.
• Treating a job alert as proof that confidential information was disclosed unlawfully.
• Sending sensitive identity documents over ordinary email without verifying a secure channel.
• Assuming a retained file is unlawful without asking its purpose, period and access limits.
• Treating any internal email as a reportable incident without risk and trigger analysis.
• Copying GDPR templates that promise a remedy or deadline without checking Swiss law.

Candidate-data request checklist

1. Identify the recruiter, hiring company and relevant vendors from the application record.
2. Determine which organization controls each recruitment file or talent pool.
3. List the records you want to locate and provide an application reference or date range.
4. Ask for access information under the Swiss FADP and confirm the secure response channel.
5. State separately whether you want correction, no future contact, profile deactivation or deletion.
6. For a correction, quote the exact field and supply proportionate evidence.
7. For deletion, ask which records are no longer needed and what basis supports any retention.
8. Ask whether retained data is active, restricted, archived or scheduled for destruction.
9. Preserve requests, delivery records, identity verification and responses.
10. Check current FDPIC guidance or obtain Swiss advice if access or deletion is refused.

Questions about recruiter-held data

Does Swiss law give me access to my recruiter file?

The FADP provides an information right concerning personal data being processed. Address the request to the controller, identify yourself proportionately and ask for the information described by the statute. The exact extent can depend on the records and lawful grounds for restriction.

Must a recruiter delete my CV as soon as I am rejected?

Not necessarily immediately in every case. FDPIC guidance says application files should generally be returned and copies destroyed after the process, while recognizing defined retention with consent or an overriding interest in appropriate circumstances. Ask for the actual purpose and period.

Can I stop an agency from contacting me about jobs?

You can tell it not to use your profile for future opportunities and ask it to confirm the operational change. The agency may need a minimal record to honor that request or satisfy another duty; ask how it will restrict use.

Can I ask the recruiter to correct interview notes?

Yes, make a specific request and distinguish a verifiable factual error from an evaluative opinion. Explain the correction and provide relevant evidence. The controller must assess the request under the FADP and surrounding context.

Can the recruiter keep records for a discrimination complaint?

A concrete legal claim or overriding interest may justify retaining limited records, but that does not justify indefinite, unrestricted use of an entire candidate profile. Ask which records are retained, for what purpose and how access is limited.

Is a Swiss recruiter required to answer within 30 days?

Do not rely on a generic GDPR template for a Swiss deadline. Check the current FADP and official FDPIC guidance for the specific request, identity verification and any statutory extension or refusal basis.

Does the FADP apply to a US recruitment platform used by a Swiss employer?

Territorial application and controller/processor roles depend on facts, including the organization’s activities and processing. A Swiss employer’s use of a foreign vendor does not remove the need to assess the Swiss employer’s own duties. Cross-border transfer questions require separate analysis.

Is an internal email about my application a data breach?

Not automatically. A controller must assess the event, data sensitivity, recipients, access, risk and legal notification triggers. A routine internal discussion may be ordinary processing; a misdirected message could require a different assessment.

For a broader file-handling process, see Gotham’s guide to preparing legal documents for external sharing. For the separate Swiss employment-certificate question, see the Arbeitszeugnis request guide. The Swiss electronic filing guide discusses secure document transmission, while the Swiss employment non-compete guide covers a different employment-document review. These articles explain document workflows and do not replace Swiss legal advice. If your team needs a repeatable way to collect, review and route documents, explore Gotham workflows or contact the team.

Questions about recruiter-held data in Switzerland

Can I ask a Swiss recruiter what data it holds about me?

The Federal Act on Data Protection (FADP) provides a right to request information about personal data being processed. Address the request to the controller that decides the purposes and means of the recruitment file.

Can I always force a recruiter to erase my application?

No blanket answer applies. Data no longer needed should generally be destroyed or anonymised, but legal duties, a concrete claim, or another overriding interest can justify retention.

Does rejection mean a recruiter must delete my CV immediately?

Not necessarily. The FDPIC describes limited retention in some circumstances, including a defined period with the applicant’s consent or a justified overriding interest. Ask what basis and period apply.

Can I ask for inaccurate interview notes to be corrected?

You can request access and make a precise correction request. The FADP provides rights concerning inaccurate data, but whether a note is factually wrong or an opinion may require context.

Is a recruiter’s internal email about me automatically a reportable data breach?

No. An internal email is not automatically a reportable breach. The controller must assess the incident, affected data, recipients, risk and applicable notification duties.

This article is general information about Swiss private data protection and recruitment records, not legal advice. Public-sector rules, cross-border processing, disputes and retention duties can change the result. Official German, French or Italian law controls over translations.
How Gotham researches and reviews field guides