Our organisation has received an enquiry from a person who recently applied for a job with ourselves, but was unsuccessful. This person has requested that all his personal data we hold is destroyed. Does this mean we have to delete all of the personal data we hold, even though it is company policy to keep all job applications for x number of months and all expense details are kept for auditing purposes? We re-imbursed his travel expenses. I'd be most grateful for any help and comments. Thank you Sally Gibson SST ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ All archives of messages are stored permanently and are available to the world wide web community at large at http://www.jiscmail.ac.uk/lists/data-protection.html If you wish to leave this list please send the command leave data-protection to [log in to unmask] All user commands can be found at : - http://www.jiscmail.ac.uk/help/commandref.htm Any queries about sending or receiving message please send to the list owner [log in to unmask] (all commands go to [log in to unmask] not the list please) ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^