Field note
PDPA and the unsuccessful applicant sitting in last year’s drive
Malaysia’s Personal Data Protection Act 2010 does not vanish because someone did not get the job. An unsuccessful application still carries a name, a phone number, often a copy of an identity card, and whatever extra the form invited.
We keep finding last year’s packs in shared drives named after the hiring manager who left. The notice on the form said six months. The folder says 2023. Nobody is being sly. Nobody owns the deletion.
A retention story you can tell out loud is simple. Why you keep unsuccessful files. For how long. Who can open them. What happens at the date you named. If you truly want a talent pool, say so on the form and keep only what that pool needs — not the identity-card scan you collected for the people you actually appointed.
We are not your Data Protection Officer unless you appoint us in a separate letter. In an application audit we still record the mismatch, because a hiring file that cannot be closed is a hiring file that cannot be defended.