Create multiple data retention rules for flexible compliance control

You can now create multiple data retention rules in Ashby, so your team can define different retention policies for different scenarios spanning inactivity (Applicants, Leads) and data consent.

Organizations with global hiring operations, multiple compliance needs, or varied internal retention policies often need different rules for different candidate populations. Each retention category now supports multiple rules, each with its own filter set and configuration.

Often this means regional compliance: a team hiring across the EU and US can apply a 12-month retention period for EU-based candidates to satisfy GDPR while keeping US-based candidate data for 24 months under more permissive local regulations, each with its own consent language.

And it works in both directions, some regulations require you to retain data longer, not shorter. A team with California-based job locations might need to keep records for a minimum period to satisfy state requirements, even when their default policy would anonymize sooner.

Configure rules within each retention category

• Lead Inactivity
• Applicant Inactivity
• Consent

Each rule uses its own filter set to target the job location and candidates it applies to.

When multiple rules match the same candidate, we'll select the rule with the latest retention date. For example, if a global applicant inactivity rule and a California specific applicant inactivity rule both apply, we'll apply the rule with the latest retention date.

This eliminates the need to manually track which policy takes precedence for individual candidates, and ensures you're not prematurely flagging data you're meant to retain.

Trace compliance directly in your reports

New reporting fields show which "winning" rule applies to each candidate in your system. Filter by rule, pull reports for specific policies, and generate audit-ready documentation directly in Ashby.

During audits, you can filter by the specific retention rule and pull a report showing every candidate it applies to, along with their retention dates.

Getting started

Multiple data retention rules are available today for all customers. The Data Privacy & Compliance admin settings have been redesigned with a tabbed layout to keep your rules organized as they grow. Head to Admin > Data Privacy & Compliance to create your first additional rules, and check out our knowledge base article for full configuration details.