Federal rules require covered employers to keep hiring records for set periods and to show how selection decisions affected different groups. This is general information about published regulations rather than legal advice, and obligations vary by state and by employer size.
How long you must keep application records
Personnel and employment records, including application forms and hiring records, must be preserved for one year from the date the record was made or from the personnel action involved, whichever occurs later [1]. For someone terminated the clock runs one year from termination, and a filed charge extends preservation of all relevant records until final disposition [1]. Coverage generally begins at 15 employees, or 20 for age [2].
Why applicant flow data is the hard part
The Uniform Guidelines on Employee Selection Procedures expect each user to keep records showing the impact its selection procedures have on employment opportunities by identifiable race, sex or ethnic group [3]. A selection rate for any group below four-fifths, or 80 percent, of the rate for the highest group is generally regarded by federal enforcement agencies as evidence of adverse impact [3]. Calculating that ratio means knowing how many applied and how many advanced, broken out by group, which is exactly what an email inbox does not produce.
The smaller-employer version
Employers with fewer than 100 employees may keep a simplified version, covering hires, promotions and terminations for each job by sex and, where appropriate, by race and national origin, plus applicant counts for hire and promotion in the same categories [4]. A disciplined spreadsheet can satisfy this, a genuine argument that a small employer does not need software for compliance alone. It becomes less comfortable once the person maintaining the spreadsheet leaves.
Candidate data is also privacy-regulated
California's exemption for employment-related personal information expired on December 31, 2022, so applicant data now falls under the CCPA for businesses meeting its thresholds, which start at gross annual revenue over $25 million [10]. Resumes scattered across personal inboxes and shared drives are hard to inventory, delete on request, or secure.