Records, Retention and Challenges

General orientation, not legal advice.

Putting the safeguards in “Records, Retention and Challenges” into practice also requires a documented operating routine. Teams can use remote work time tracking to understand where assessment work consumes time and to keep a consistent audit trail, while treating activity data as process evidence rather than as a proxy for candidate ability; proportionality, access controls and human review still come first.

For an independent benchmark, compare the process with ICO employment data guidance; the useful test is whether the local method remains job-related, proportionate and explainable.

Most hiring decisions are never questioned. The ones that are tend to be questioned months later, by which time the records either exist or do not.

What a challenge looks like

An informal query: why was I rejected.

A formal complaint to the organisation.

A data access request, which is frequently the first step in a dispute.

And occasionally a claim, which is rare and expensive.

Each is handled better with contemporaneous records than with recollection.

What to keep

The job analysis and the criteria, which justify the requirements.

The assessment materials used.

Individual assessor scores with evidence notes.

The decision and its stated reason.

Adjustment records, kept separately.

And your adverse impact monitoring, which demonstrates that you looked.

How long

Beyond the limitation period for claims in your jurisdiction, which is commonly months to a couple of years.

Know the number rather than guessing.

And balance it against data protection, which requires deletion when the purpose ends. The two obligations point in opposite directions and the resolution is a stated, defensible period.

Responding to an informal query

Promptly and specifically, against the criteria.

The feedback note covers the form.

Most queries end here when the answer is specific and job-related.

Responding to an access request

There is a statutory period in most systems; find yours.

Provide the assessor notes and scores, redacting third-party information.

Do not edit anything. Altering records after a request is a serious matter and is usually detectable.

And take advice if the request arrives with a complaint attached.

Responding to a formal complaint

Investigate before responding, using the records rather than asking people to remember.

Answer the specific point raised rather than defending the process generally.

Acknowledge anything that was wrong, which is both right and a better position than a blanket denial.

And take advice where a protected characteristic is mentioned.

What weakens your position

Scores with no evidence.

Notes written after the challenge arrived.

Requirements nobody can justify.

Inconsistent treatment between candidates, which is what unstructured processes produce.

And no monitoring, which makes "we had no idea" the only available answer.

The useful reframe

Everything that protects you in a challenge is also what makes the assessment work.

Records, structure, justified requirements, measurement.

Which means this is not a compliance overhead bolted onto the process — it is the process, and organisations that treat it as separate do both badly.

What to check

Do you know the limitation period in your jurisdiction?

Could you produce the full record for a candidate from a year ago?

Has anybody rehearsed responding to an access request?

And would your records support or undermine you?

The point

Everything that protects you in a challenge is also what makes the assessment work: records, structure, justified requirements, measurement..

Underlying all of this

Almost everything in this collection reduces to one discipline: write down what the job requires, assess that thing directly, record the evidence, and look at your own outcomes afterwards. None of it requires buying anything, and organisations that do those four things consistently outperform ones running longer processes built from instruments chosen before the requirements were known.

The recurring pattern

The recurring failure across every section here is the same: measuring what is convenient rather than what matters, then never checking whether it predicted anything. The check is an afternoon of work once a year, and it is the step that separates a process that improves from one that merely persists.