Staffing ATS data migration: how to move a candidate database without losing it or breaking the law

A staffing ATS data migration is a records management task before it is a software project. Candidate files, payroll records and Forms I-9 are subject to retention, privacy and disposal requirements that do not disappear when data moves to a new system. Before starting, establish three lists: what must be kept and for how long, what can be deleted, and what evidence you must retain to prove the migration was completed correctly.

Key takeaways

• Plan a candidate database migration around three lists: what must be kept and for how long, what may be deleted, and what you must prove afterwards.
• Under 29 CFR 1627.4 an employment agency must keep job applications and resumes, including those held for future referral, for 1 year from the date of the action the record relates to.
• California Government Code 12946 requires employment agencies to keep applications and employment referral records for a minimum of four years after they are created or received.
• Once a charge is filed, the EEOC says the relevant records must be kept until final disposition of the charge or any lawsuit based on it, so freeze those records before any purge.
• An employer may move Forms I-9 to a new electronic storage system only if existing forms stay in a system that remains fully accessible.

This guide is for owners of small staffing firms and VPs of Operations at larger agencies preparing to move years of candidate records out of an old applicant tracking system. It covers the federal recordkeeping rules that apply to staffing agencies, California requirements affecting candidates who live there, and state laws governing data disposal and breaches. It also provides a migration plan designed to preserve these obligations throughout the move.

Two important limitations apply. First, this is not legal advice. The rules are drawn from the relevant regulations, statutes and agency guidance, checked as in force in October 2026. The retention periods that apply to your agency depend on its size, contractual obligations, operating states and whether it acts as an employer, an employment agency or both. Have legal counsel confirm your retention schedule before deleting any records.

Second, no public study quantifying data loss during staffing ATS migrations could be found. This guide therefore makes no claims about loss rates, migration timelines or accuracy. Its focus is on planning and executing the move so that your records remain intact and your legal obligations continue to be met.

In this article

• Why is a candidate database migration a compliance project?
• Which federal rules say how long a staffing agency keeps candidate records?
• What changes when the agency is also the employer?
• What about federal contractors and their resume databases?
• What happens to records when a charge is filed?
• What does the Form I-9 rule require of a new system?
• How does California change the plan?
• Which other states reach the old system?
• How should the old system's data be destroyed?
• What does a bigger database cost if it is breached?
• What about candidates in the UK or EU?
• The migration plan, step by step
• What to prove after the cut-over
• Is it safer to keep everything?
• Conclusion: Move the data, not the risk
• Frequently asked questions

Why is a candidate database migration a compliance project?

Most staffing agency owners approach a migration as a technical task. They focus on mapping fields, transferring resumes and ensuring candidate notes survive the move. These details matter, and the guide to what a staffing firm's own database is worth explains the value of those records. However, a candidate database is also a legal archive. During migration, every record is potentially affected at the same time.

Three problems can arise, and only one is purely technical.

Records required by law can be lost. A field that fails to map, a status excluded by a filter or an attachment the new system cannot accept can silently remove a record the agency must retain. Rejected applicants are particularly vulnerable because migrations focused on active candidates may leave their records behind.

Records that should have been deleted can be carried forward. Copying everything into the new system can preserve records beyond their retention periods and create unnecessary duplicates. This increases the volume of personal information the agency must protect and potentially disclose if a data breach occurs.

The old system can retain data after the migration. The contract ends, the vendor archives the account or the agency retires a server. If the remaining data is not properly destroyed, the agency may still have an outstanding disposal obligation.

These problems may not become apparent when the new system goes live. They can surface months or years later when a discrimination charge is filed, an auditor requests records, a candidate submits a data request or a breach notification becomes necessary. A sound migration plan identifies and addresses these risks before the old system is decommissioned.

Which federal rules say how long a staffing agency keeps candidate records?

Federal law can treat a staffing agency as both an employment agency and an employer. Each role carries recordkeeping obligations that must be considered when planning a migration.

As an employment agency. Under the Age Discrimination in Employment Act (ADEA) regulations, an employment agency must retain job applications, resumes and other records identifying an individual's employment qualifications for one year. This applies whether the person is being considered for a specific vacancy or kept on file for future referral.

The distinction matters when migrating a staffing database. A resume retained for future opportunities remains an employment agency record. Its retention period is tied to the action to which the record relates, rather than automatically starting when the resume is first uploaded.

As an employer. The EEOC's general rule under 29 CFR 1602.14 requires employers to preserve personnel and employment records, including hiring records, for one year from the date the record was made or the relevant personnel action, whichever is later. Joint guidance from the EEOC and the Federal Trade Commission (FTC) similarly explains that application forms and other hiring records must be retained for one year after they were created or after the relevant personnel action, whichever occurs later.¹²

For selection procedures. The EEOC's Uniform Guidelines on Employee Selection Procedures tell employers and other users of selection procedures to maintain records showing the impact of their tests and other selection methods by race, sex and ethnic group.¹ If the old ATS contains screening scores, assessment results or answers to knockout questions, these records should be included in the migration scope.

One year may sound like a short retention period, but it is only a minimum. Other requirements discussed below may impose longer periods, and a discrimination charge can trigger an obligation to preserve relevant records beyond their normal retention dates.

What changes when the agency is also the employer?

A staffing firm that employs temporary workers or contractors directly and pays them through its own payroll must comply with the recordkeeping rules that apply to employers.

Under the ADEA regulations, an employment agency that also qualifies as an employer must meet both sets of requirements.¹ The employer rules require payroll and other records for each employee, including their name, address, date of birth, occupation, pay rate and weekly compensation, to be retained for three years.¹

The Fair Labor Standards Act (FLSA) imposes similar obligations. Employers must preserve payroll records for at least three years, while basic time cards, earnings records and wage rate tables must be kept for at least two years.¹³ The Department of Labor confirms these minimum periods in its recordkeeping guidance.

Employment tax records have a longer retention period. The IRS requires employers to keep employment tax records for at least four years after filing the fourth-quarter return for the relevant tax year.⁴

For migration planning, the key point is that a temporary worker's file contains several distinct record types. It may include a candidate profile, assignment history, timesheets, payroll records and Form I-9, each stored in a different module and subject to different retention requirements. Treating the worker as a single candidate record risks overlooking records that must be preserved for longer.

Source: The regulations, statutes and agency guidance identified above, consulted on eCFR, California Legislature and relevant agency websites, checked as in force in October 2026. These are minimum periods; an agency's own retention schedule may require longer periods.

What about federal contractors and their resume databases?

Staffing firms that hold federal contracts or subcontracts may face stricter recordkeeping requirements, including rules that apply specifically to internal resume databases.

Under the federal contractor recordkeeping rules, covered contractors must generally retain personnel and employment records for at least two years. A one-year period applies to qualifying contractors with fewer than 150 employees or no government contract worth at least $150,000.¹ The rules also specifically address internal resume databases. Contractors must retain records of each resume added, the date it was added, the position associated with each search, and the search criteria and date for every search.¹

These requirements create a specific migration risk. Resumes may transfer successfully while the search logs, original upload dates and records linking searches to particular vacancies are lost. This information often sits in database tables that are not included in standard exports. If the new ATS assigns today's date to every imported resume, it may overwrite the original dates that the regulations require the contractor to preserve.

The consequences of missing records can be significant. Where a federal contractor destroys or fails to preserve required records, a presumption may arise that the missing information would have been unfavourable to the contractor, unless the loss was beyond its control.¹ A migration decision made by the firm does not, by itself, establish that the loss was beyond its control.

What the desk does: If the firm holds federal contracts, export search histories and original resume-upload dates into separate files before migration. Then verify that the new ATS preserves those original dates rather than replacing them with import dates.

What happens to records when a charge is filed?

The hiring and personnel retention periods discussed above are subject to an important exception: once an EEOC charge or a California verified complaint is filed, the relevant records must be preserved until the matter is resolved.²

The EEOC requires relevant records to be retained until the final disposition of a charge or any lawsuit arising from it. Final disposition generally means the end of the 90-day period for filing a lawsuit after a right-to-sue notice, or, if litigation begins, the conclusion of the case, including any appeals.² The ADEA employment agency rules follow the same principle. When an enforcement action concerns a particular applicant, the agency must retain the related records until the matter is finally resolved.

California imposes a similar obligation. Once an employer or employment agency receives notice of a verified complaint, it must preserve all relevant records until the later of the end of the period for filing a civil action or the final resolution of the complaint and all related proceedings.⁵

Migration creates a particular risk because the people managing the technical work may not know which candidates are connected to open legal matters. A routine cleanup instruction, such as deleting records older than three years, could therefore remove records that must legally be preserved.

What the desk does: Before defining the migration scope, consult legal counsel and the agency owner to identify all open charges, complaints, demand letters and disputes. List the candidates and records connected to each matter, then include an explicit deletion freeze for those records in the migration plan before running any purge.

What does the Form I-9 rule require of a new system?

Form I-9 has specific federal requirements for retention and electronic storage. These rules are particularly important for staffing firms that directly employ temporary workers and must maintain their employment eligibility records.

The retention period is precise. An employer must retain each Form I-9 for three years after the employee's hire date or one year after employment ends, whichever is later.¹⁶ An employment recruiter or referrer for a fee who is required to retain the form must generally keep it for three years after the hire date. USCIS confirms the employer's retention requirements in its guidance.

The storage system must also meet specific standards. Electronic systems must have reasonable controls to prevent and detect unauthorized or accidental creation, addition, alteration, deletion or deterioration of stored forms.¹ They must also include periodic checks of stored records. USCIS similarly requires electronic systems used to retain completed Forms I-9 to support the integrity, accuracy and reliability of those records.⁶

The rules expressly allow employers to introduce a new electronic storage system, provided existing Forms I-9 remain fully accessible.¹ USCIS also permits employers to destroy original paper forms after they have been securely stored electronically, subject to the applicable requirements.⁶

Access is another critical consideration. Employers and others required to retain Forms I-9 must be prepared for inspection by the relevant US authorities. The rules provide for at least three business days' notice before an inspection, and records stored off-site must be made available at the location requested by the inspecting authority.¹⁶ Three business days is a short window if the forms are held in a system whose contract ended months earlier.

The same migration principles apply to related employment records. The guide to what a staffing agency must re-check on its I-9s now that the automatic EAD extension is over covers reverification requirements. A migration must preserve the associated reverification history alongside the relevant forms.

What the desk does: Treat Forms I-9 as a separate migration stream. Confirm that the new system has the required integrity controls, keep the old system fully accessible until every form has either been migrated and verified or legitimately reached the end of its retention period, and test whether individual forms can be retrieved and produced within three business days.

How does California change the plan?

California can affect a staffing firm through two separate sets of requirements, each with its own scope. Legal counsel should confirm which requirements apply to the business.

A four-year record rule. California law makes it unlawful for an employment agency to fail to maintain and preserve applications, personnel records, membership records, employment referral records and related files for at least four years after they are created or received.⁵ This is significantly longer than the federal minimum for many employment agency records and specifically covers referral records.

Privacy rights for applicants. The California Privacy Protection Agency confirms that the California Consumer Privacy Act (CCPA) grants privacy rights to California residents, including employees and job applicants.⁷ The exemptions for employee and business-to-business personal information under Civil Code Sections 1798.145(m) and (n) became inoperative on January 1, 2023.⁵

The CCPA applies to qualifying for-profit businesses that do business in California and meet at least one statutory threshold. These include annual gross revenue of USD 26.625 million or more, or buying, selling or sharing the personal information of at least 100,000 California residents or households.⁷ A staffing firm must assess its own figures and consult counsel to determine whether it is covered.

For firms subject to the CCPA, three requirements are particularly relevant to migration.

• Deletion. Consumers can request that a business delete personal information it has collected from them.⁵
• The legal obligation exception. A business may refuse a deletion request when retaining the information is reasonably necessary to comply with a legal obligation.⁵ This allows deletion rights to operate alongside mandatory retention periods. Records that must legally be retained stay in place, while records beyond all applicable retention periods may need to be deleted when requested.
• Retention limits. At or before collection, a business must disclose how long it intends to retain each category of personal information or the criteria used to determine that period.⁵ It cannot retain information longer than reasonably necessary for the disclosed purpose. The collection, use, retention and sharing of personal information must also be reasonably necessary and proportionate to those purposes.⁵

These requirements make migration an opportunity to review the agency's retention schedule. If its collection notice specifies how long candidate records will be kept, the new system should not carry those records beyond the disclosed period without a valid legal or operational basis.

California also requires businesses that own, license or maintain personal information about residents to implement reasonable security procedures and practices appropriate to the information involved.⁵ The state's AI and automated screening requirements are separate and are covered in the guide to California SB 947 and the staffing agency.

What the desk does: Tag candidate records by state of residence before migration. Retain California applicant and referral records for at least four years, subject to any longer applicable requirement or legal hold. Route deletion requests through a documented check for legal retention obligations, and ensure the retention periods in the collection notice match the new system's settings.

Which other states reach the old system?

State laws can govern both the security of candidate information and how it must be destroyed when it is no longer needed. The states below illustrate relevant requirements identified for this guide. They are not a complete survey of every state's laws.

Connecticut. Connecticut requires employers to obtain and retain employment applications securely and to destroy them or make them unreadable when disposing of them. Violations can carry a civil penalty of USD 500 per violation, up to USD 500,000 for a single event.⁸

New York. Businesses that own or license computerized data containing a New York resident's private information must maintain reasonable safeguards, including appropriate disposal practices.⁹ These safeguards include disposing of private information within a reasonable period after it is no longer needed and erasing electronic media so that the information cannot be read or reconstructed.⁹

Maryland. Businesses destroying records belonging to customers, employees or former employees that contain personal information must take reasonable steps to prevent unauthorized access to or use of that information.¹⁰

Florida. Covered entities must dispose of customer records containing personal information when those records are no longer required to be retained.¹¹ Acceptable methods include shredding, erasing or otherwise making the information unreadable. Because the statute refers to customer records, counsel should confirm whether and how it applies to a particular firm's candidate records.

Washington. Washington requires businesses to notify affected consumers of qualifying data breaches as promptly as possible and no later than 30 calendar days after discovering the breach, subject to applicable exceptions, including law enforcement delays. A migration that exposes personal information through a misconfigured export or unsecured copy can trigger a breach response and notification obligations.

Virginia. Not every state privacy law covers applicant information. Virginia's Consumer Data Protection Act exempts certain data processed or maintained in connection with an individual applying to or working for a controller, to the extent the data is collected and used within that role.¹² This is why agencies must examine the specific law rather than assume that applicant data is always covered or always exempt.

What the desk does: Identify the states in which the firm's candidates reside, review the applicable disposal and breach-notification requirements, and document the strictest applicable disposal method for the old system.

How should the old system's data be destroyed?

Switching off the old ATS does not mean its data has been destroyed. Where the disposal rules below apply, staffing agencies must ensure that information they no longer need is disposed of securely.

The FTC's Disposal Rule requires businesses that possess consumer information obtained from consumer reports for business purposes to take reasonable measures to prevent unauthorised access during disposal.¹³ This includes destroying or erasing electronic media so that the information cannot reasonably be read or reconstructed. The FTC also states that employers must securely dispose of consumer reports and related information when they no longer need them.¹⁴ Background check reports stored in an old ATS fall within this category.

NIST provides guidance on how to destroy electronic data securely. It defines media sanitisation as a process that makes access to the targeted data infeasible for a given level of effort.¹⁵ NIST recommends completing a certificate of sanitisation for each medium in accordance with the organisation's policies.¹⁵ The organisation should also verify the sanitisation results to confirm that the process was successful.

With a cloud-based ATS, the vendor controls the underlying storage media. The staffing agency should therefore request written confirmation that the vendor has deleted the old account and its backups, along with details of the method used and a certificate or other suitable evidence. The agency should establish what its contract permits it to export, delete and certify before giving notice to terminate the service.

What the desk does: Before terminating the old ATS, ask the vendor in writing how it deletes customer data and backups and what proof it provides. Delete the old data only after all records that must be retained have been migrated and verified. Keep the vendor's certificate or written confirmation with the migration records.

What does a bigger database cost if it is breached?

Deleting records that no longer need to be retained can reduce the amount of personal information an agency must protect and the potential consequences of a breach.

IBM's 2025 Cost of a Data Breach report placed the average cost of a breach in the United States at USD 10.22 million.¹⁶ This figure reflects the organisations included in IBM's research, not the staffing industry specifically. It does not predict what a breach would cost a small agency or establish how costs change with database size. It provides context, not a forecast.

California law creates another potential financial exposure. When a consumer's nonencrypted personal information is breached because a business failed to maintain reasonable security, the consumer may seek statutory damages of USD 100 to USD 750 per incident, or actual damages if greater, subject to the statute's inflation adjustments and applicable legal requirements.⁵ For an agency holding records on tens of thousands of California candidates, retaining unnecessary information can increase its potential exposure.

A larger database can also create avoidable data quality problems. A 2024 scoping review published in BMJ Open found that duplicate records in pharmacovigilance databases can undermine risk assessments and decision-making.¹⁷ The researchers recommended consistent unique identifiers to link records correctly. Although the study concerned drug safety rather than staffing, the underlying lesson is relevant: duplicate candidate profiles can contain conflicting contact details, outdated information and inconsistent recruiter notes. Migration provides an opportunity to identify and resolve these duplicates before they affect recruitment decisions.

What about candidates in the UK or EU?

The UK GDPR or EU GDPR may apply to candidate records held by a US staffing firm, depending on its activities and the circumstances of its data processing. A firm recruiting in the UK, for example, should obtain legal advice to establish whether the UK GDPR applies to its operations.

Under the UK GDPR's storage limitation principle, personal data must not be kept in an identifiable form for longer than necessary for the purpose for which it is processed.¹⁸ The UK Information Commissioner's Office (ICO) advises organisations to set appropriate retention periods, review stored information regularly, and erase or anonymise data when it is no longer needed.¹⁹ The ICO's guidance has been marked for review following changes to UK legislation, so firms should check the current requirements before relying on it.

For a migration, this means documenting how long each category of candidate data needs to be retained and why. Records that are no longer necessary should be erased or anonymised where legally appropriate before the remaining data is transferred to the new ATS. Copying everything first and reviewing retention later risks carrying unnecessary personal information into the new system.

The migration plan, step by step

The following steps put the legal and recordkeeping requirements into the order a staffing ATS migration should follow. Each step should have a clearly assigned owner and documented evidence of completion.

1. Inventory the record classes. List everything stored in the old system, including candidate profiles, resumes, recruiter notes, assessment and screening results, background check reports, assignment histories, timesheets, payroll records, Forms I-9, consent records and search logs. Record which module holds each type of information and who is responsible for it.

2. Write the retention schedule. Identify the applicable retention period for each record class, using the strictest relevant requirement. The earlier table provides a starting point, but the correct period depends on the firm's circumstances. Have legal counsel review and approve the schedule before proceeding.

3. Identify records under legal holds. Ask the agency owner and legal counsel to identify every open charge, complaint, demand letter and dispute. Document the records connected to each matter and freeze them against deletion.

4. Tag records by state and role. Record each candidate's state of residence so counsel can assess whether California's four-year retention rule, the CCPA, other state disposal laws or UK requirements apply. Also identify whether each record relates to the agency's role as an employment agency, an employer or both.

5. Clean the data before copying it. Merge duplicate profiles, remove records that have passed every applicable retention period and are not subject to a legal hold, and process outstanding deletion requests after checking for legal retention obligations. Where possible, complete this work in the old system so the new database starts with clean, appropriately retained records.

6. Map legally important fields. Ensure original creation dates, relevant action dates, resume upload dates, search logs and Form I-9 dates survive the migration. Preserve these as distinct fields rather than allowing the new system to replace them with import dates.

7. Test a sample migration and compare counts. Transfer a sample from every record class. Compare the counts before and after, then open a selection of records to confirm that attachments, dates and notes have transferred correctly.

8. Complete the migration and reconcile the counts. Transfer the full database and compare record counts by class. Document and explain every discrepancy before making changes to or decommissioning the old system.

9. Keep the old system accessible until verification is complete. Federal Form I-9 rules require existing forms to remain fully accessible during a system change. Apply the same principle to other record classes until reconciliation is complete and formally approved.

10. Destroy the old data and retain proof. Follow a documented disposal schedule and use an appropriate sanitisation method or obtain written confirmation from the vendor. File the certificate or confirmation with the migration records.

What to prove after the cut-over

A migration must be supported by evidence that the records transferred correctly and that the agency met its retention and disposal obligations. These records are straightforward to produce during the migration but can be difficult to reconstruct later.

Counts by class. Keep the number of records in each class before and after the migration, with every difference explained. Counting candidate profiles alone can conceal missing attachments or entire categories of records.

Dates. Retain samples showing original creation dates and relevant action dates. For federal contractor records, include the original date each resume was added and the associated search logs.

Forms I-9. Test retrieval of a sample of Forms I-9 from the new system and record how long it takes to produce them. Confirm that they can be made available within three business days when required for inspection.

Legal holds. Maintain a list of all records subject to a hold and confirm that each has been transferred intact into the new system.

Disposal. Keep the certificate of sanitisation or the vendor's written confirmation covering the old system and its backups.

The schedule. Retain the approved retention schedule and update the privacy notice at collection where necessary to reflect applicable California or UK requirements.

Store all this evidence together as the migration record. The same principle that makes a reference check hold up when a client asks for proof also applies to a database migration: document what was done while the evidence is still available.

Is it safer to keep everything?

Many owners prefer to migrate every record and delete nothing. Storage is cheap, and keeping a record means it cannot be lost through premature deletion. That instinct is understandable, but it is only partly right.

Deleting too soon can be the more dangerous mistake. If a record is deleted before its retention period ends or while a legal hold applies, the firm may be unable to produce it when required. For federal contractors, missing records can also trigger a presumption that the information would have been unfavorable. When choosing between keeping a record temporarily and deleting it too early, keeping it is generally safer.

However, keeping everything forever is not a sound policy. California law limits retention to what is reasonably necessary for disclosed purposes, and the UK GDPR follows a similar principle. Connecticut and New York also require secure destruction or erasure when records are disposed of. Keeping unnecessary records creates additional information to protect in the event of a breach. Even for US firms without California, UK or EU candidates or federal contracts, every retained record still carries a security responsibility.

The answer is a written retention schedule, not a blanket decision to keep or delete everything. Preserve records within their required retention periods and those covered by legal holds. After migration, delete records that have passed every applicable retention period, following a documented schedule. Migration is the ideal time to establish that schedule because the entire database is already being reviewed.

Conclusion: Move the data, not the risk

A staffing ATS migration is not complete when the new system goes live. It is complete when the agency can prove that required records survived, legal holds remained intact, retention periods were respected, and unnecessary data was securely disposed of. Getting that sequence wrong can leave a firm facing missing evidence, avoidable privacy exposure or a compliance problem that outlasts the migration itself.

The safest approach is to treat the move as a controlled records exercise, not simply a software upgrade. Inventory what exists, confirm what must be kept, identify what can be deleted, test the transfer, reconcile the results and document every decision. Keep the old system accessible until the checks are complete, and never let a migration deadline override a legal obligation.

For agency owners, the goal is not to carry every old record into a new platform. It is to arrive with the right records, the right protections and the evidence to show that the move was handled properly. Build the retention schedule before the transfer, involve counsel where the rules are unclear, and make the final sign-off a documented decision rather than an assumption.

The best migration is not the one that moves the most data. It is the one that leaves the agency able to find, protect, produce and lawfully dispose of the records it holds.

Where Hivemind fits on a staffing desk

The retention schedule, the holds and the disposal decisions in this guide stay with the agency and its counsel. No system decides how long a firm must keep a record, and nothing here says one does.

What a new system changes is where the daily work happens after the move: sourcing, screening, interviews, offers, and the admin around them. Hivemind is the hiring OS: manage every candidate from inbound to offer in one unified workflow. A team can run Hivemind end to end, connect your existing tools, or mix and match both, and Hivemind has 15 Native Modules and 275 Integrations, so a desk can build the exact pipeline its team deserves.

Book a demo.

Frequently asked questions

How long must a staffing agency keep candidate resumes?

Under federal ADEA rules, an employment agency must generally keep applications and resumes, including those held for future referral, for one year from the date of the action the records relate to.¹ California requires employment agencies to retain applications and referral records for at least four years after they are created or received. If a charge is filed, relevant records must be kept until the matter reaches final disposition. Ask counsel to confirm the requirements for your states and contracts.

Can a staffing agency delete candidate data when someone requests it under the CCPA?

The CCPA gives California residents, including job applicants, the right to request deletion of their personal information when the business is covered by the law. However, a business does not have to delete information it must retain to comply with a legal obligation. Records still within a required retention period or subject to a legal hold must be preserved; eligible remaining data can be deleted.

Does the CCPA apply to a small staffing agency?

The CCPA applies only if a business meets at least one of its legal thresholds. These include gross annual revenue of USD 26.625 million or more, or buying, selling or sharing the personal information of at least 100,000 California residents or households. Separately, California Government Code Section 12946 sets a four-year retention requirement for employment agencies. Consult counsel about both obligations.

How long must Forms I-9 be kept after a migration?

Employers must retain each Form I-9 for three years after the employee's hire date or one year after employment ends, whichever is later. Electronic storage is permitted if the forms remain accessible and the system has controls to prevent and detect unauthorized or accidental changes. Inspectors must generally provide at least three business days' notice before an inspection.

What should a federal contractor carry over from its resume database?

Under 41 CFR 60-1.12, contractors should preserve each resume added, its original entry date, the position associated with each search, and the search criteria and date. Personnel records generally must be retained for at least two years, or one year for qualifying contractors with fewer than 150 employees or no contract worth at least USD 150,000.

How should a staffing agency destroy data in its old ATS?

Use a method that makes the data unreadable and keep evidence of the disposal. The FTC's Disposal Rule requires reasonable measures to protect information derived from consumer reports, including erasing electronic media so the information cannot practicably be read or reconstructed.¹ NIST recommends documenting sanitization with a certificate. For hosted systems, request written confirmation from the vendor that the agency's data and relevant backups have been deleted.

Should we migrate inactive candidates?

Yes, if their records are still within a required retention period or subject to a legal hold. A candidate's inactive status does not automatically remove the agency's duty to preserve their records. Data that has passed every applicable retention period and is not subject to a hold can be securely deleted before migration, provided the decision is documented.

Sources

1. Electronic Code of Federal Regulations: 29 CFR 1627.3, 29 CFR 1627.4, 29 CFR 1602.14, 29 CFR 1607.4, 29 CFR 516.5, 29 CFR 516.6, 41 CFR 60-1.12, 8 CFR 274a.2 and 16 CFR 682.3 ↩
2. US Equal Employment Opportunity Commission: Recordkeeping requirements and, with the FTC, Background checks: what employers need to know ↩
3. US Department of Labor, Wage and Hour Division: Fact Sheet 21, recordkeeping under the FLSA ↩
4. Internal Revenue Service: Employment tax recordkeeping ↩
5. California Legislature: Government Code 12946, Civil Code 1798.100, 1798.105, 1798.145, 1798.150 and 1798.81.5 ↩
6. US Citizenship and Immigration Services: Handbook for Employers M-274, Retaining Form I-9, Form I-9 and storage systems and Inspection ↩
7. California Privacy Protection Agency: Frequently asked questions ↩
8. Connecticut General Assembly: General Statutes chapter 743dd ↩
9. New York State Senate: General Business Law 899-bb ↩
10. Maryland General Assembly: Commercial Law 14-3502 ↩
11. Florida Legislature: Section 501.171, Florida Statutes ↩
12. Virginia Legislative Information System: Code of Virginia 59.1-576 ↩
13. US Government Publishing Office, United States Code: 15 U.S.C. 1681w ↩
14. Federal Trade Commission: Using consumer reports: what employers need to know ↩
15. National Institute of Standards and Technology: SP 800-88 Rev. 2, Guidelines for Media Sanitization and the full text ↩
16. IBM: Cost of a Data Breach Report 2025, press release ↩
17. Kiguba and co-authors, BMJ Open: Duplication in pharmacovigilance databases, a scoping review (2024) ↩
18. legislation.gov.uk: UK GDPR Article 5 ↩
19. UK Information Commissioner's Office: Principle (e): storage limitation ↩
20. Washington State Legislature: RCW 19.255.010