--- title: Data Privacy and Compliance: Configuration slug: data-privacy-and-compliance-configuration docTags: czhpvQugEsoqhh-gRkpFc,FmsIeUZsXc2_FRZdljBLJ,j-Q43YPgjgo_vYDXeM4Ss createdAt: 2025-07-10T11:57:32.686Z --- Ashby provides tools to help you maintain compliance with local and federal data privacy regulations when storing candidate data. You can configure these tools in [Admin > Data Management > Data Privacy & Compliance](https://app.ashbyhq.com/admin/organizational-settings/data-compliance). :::hint{type="info"} See [Managing Data Compliance Violations](docId\:jj31HxT9xxqN4x2Xfv47k) for more information on viewing candidates' data retention status and taking action on candidates in violation. ::: # Permissions & access Data privacy and compliance rules are available on all plans: | Foundations | Legacy Plus | Plus | Enterprise | | ----------- | ----------- | ---- | ---------- | | ✅ | ✅ | ✅ | ✅ | Only Organization Admins can configure data compliance rules in Ashby. # Data compliance: inactivity and consent rules You can use a combination of inactivity and consent-based rules to put a flexible policy in place that helps you track which candidate data should be removed from your system. On the **Data Privacy and Compliance** page, you have access to three tabs: - [Inactivity Rules](https://app.ashbyhq.com/admin/organizational-settings/data-compliance/inactivity) - [Consent Rules](https://app.ashbyhq.com/admin/organizational-settings/data-compliance/consent) - [Privacy & Legal](https://app.ashbyhq.com/admin/organizational-settings/data-compliance/settings) ![The Data Privacy and Compliance rule configuration page in Ashby. The Inactivity Rules tab is selected.](https://api.archbee.com/api/optimize/0p8tQ--ZZOxRtkVp6Qr-e/LMLSr3pbgH1ks6TPVVXa4_data-privacy-compliance-acent-ashby-2026-03-17-at-113834-am.jpg) ## Inactivity rules Inactivity rules apply based on a candidate’s most recent relevant activity. :::hint{type="info"} Relevant activity is any candidate or application event you choose to count towards retention. When one of these events happens, the retention period resets. Examples include a candidate sending an email, completing an assessment, or attending an interview. If a candidate has no relevant activity, Ashby uses their creation date instead. To choose which events count, see [Setting which events update retention dates](https://docs.ashbyhq.com/data-privacy-and-compliance#setting-which-events-update-retention-dates). ::: There are three types of inactivity rules: ![Ashby Data Privacy & Compliance page showing three enabled inactivity-based retention rules for inactive leads, active candidates, and archived candidates, with retention periods of one year, 90 days, and one year respectively.](https://api.archbee.com/api/optimize/0p8tQ--ZZOxRtkVp6Qr-e/Y6EG1OBY2oynXVpuoqpS0_data-privacy-compliance-ashby-2026-10-14-at-22835-pm.jpg) - **Lead:** To manage sourced candidates, prospects, and talent pools who have not been added to a job. This rule prevents passive profiles from being retained indefinitely while allowing relevant candidate activity to refresh the retention period. - **Archived Candidate:** To manage archived job considerations. This rule helps the organization clean up applicant data after the hiring process ends, while still recognizing later relevant activity. - **Active Candidate:** To prevent active job considerations from being retained indefinitely when a hiring process stalls. Ashby flags the candidate for review once their retention date passes, but does not automatically archive them. :::hint{type="warning" indent="1"} When an active candidate matches both an Active Candidate rule and an Archived Candidate rule, Ashby adds the two retention periods together to set their retention date. This covers the time the candidate will spend archived after they’re eventually rejected. If no Archived Candidate rule matches, Ashby uses only the Active Candidate retention period. ::Image[]{src="https://api.archbee.com/api/optimize/0p8tQ--ZZOxRtkVp6Qr-e/Yw1sbOYRNiTW2nF7M2r6i_darlene-mccullough-infrastructure-engineer-ashby-2026-10-14-at-23051-pm.jpg" size="80" isUploading="false" width="798" height="549" darkWidth="798" darkHeight="549" alt="Ashby candidate profile showing the Data Retention section with an inactivity-based retention date of January 12, 2028, and an informational tooltip explaining how the retention date is calculated based on the candidate’s retention rule and latest relevant event." showCaption="false"} For example, say your Active Candidate rule has a retention period of 1 year and your Archived Candidate rule has a retention period of 2 years. An active candidate covered by both rules has a retention date of 3 years (1 + 2) after their latest relevant activity. If only the Active Candidate rule applies, the retention date is 1 year after their latest relevant activity. ::: ### Setting which events update retention dates You can choose which candidate and job consideration events update the retention date. Select only the events that your organization's retention policy considers relevant activity. The available events and their descriptions appear in the configuration panel. 1. Navigate to **Admin > Data Management > Data Privacy & Compliance > [Inactivity Rules](https://app.ashbyhq.com/admin/organizational-settings/data-compliance/inactivity).** 2. Select `Configure`. ::Image[]{src="https://api.archbee.com/api/optimize/0p8tQ--ZZOxRtkVp6Qr-e/MkNVsejpBuxdIKa_TnAJt_data-privacy-compliance-ashby-2026-10-14-at-22941-pm.jpg" size="100" isUploading="false" width="1328" height="529" darkWidth="1328" darkHeight="529" alt="Ashby Data Privacy & Compliance page showing inactivity-based retention rules, with a pink arrow pointing to the Configure link for retention window settings." showCaption="false" indent="1"} 3. Select the events that should update retention dates. - **Candidate activity** refers to actions taken by the candidate, such as applying for a role, responding to an interview invitation, or completing an assessment. These events reflect the candidate's engagement with your organization and generally provide a stronger basis for extending retention under data privacy regulations. - **Recruiter activity** covers actions taken by your team, such as adding a candidate, changing their stage, or submitting a scorecard. These are internal operational activities rather than candidate-initiated engagement. ::Image[]{src="https://api.archbee.com/api/optimize/0p8tQ--ZZOxRtkVp6Qr-e/QLKgFt_CuM1GZimdN_Z-H_data-privacy-compliance-ashby-2026-10-14-at-23316-pm.jpg" size="70" isUploading="false" width="846" height="979" darkWidth="846" darkHeight="979" alt="Ashby Configure Events page for inactivity rules, showing selected candidate and recruiter activities used to calculate candidate data retention dates." showCaption="false"} 4. Select `Save` or `Save and re-evaluate X candidates` if you would like to re-evaluate all of your candidates' retention dates based on the selected events. :::hint{type="info"} When a selected relevant activity occurs, Ashby re-evaluates the candidate's retention date. Ashby also re-evaluates the candidate when their application stage changes, even if the stage change is not selected as a relevant activity. A stage change can cause a different retention rule to apply, so Ashby checks the candidate again. This does not necessarily reset the retention date unless stage changes are selected as relevant activity. ::: ### Amending the default inactivity-based rule Select one of your default inactivity-based rules to further configure it: - Updating basic information, such as adding an internal description for reference. - Amending the retention period, which defines the time period after which the lead, active candidate, or archived candidate is marked as needing to be anonymized or deleted. - Configuring a Rule Filter using the `Add Field to Match` option to add fields and establish criteria. The rule applies to candidates who meet the criteria. After you reconfigure the rule, you can re-evaluate your inactivity or consent-based rule for candidates matching your rule filters in the **Danger Zone** section. Click `Re-evaluate X Candidates` to take this action. :::hint{type="warning"} Re-evaluating the rule for candidates does not delete or anonymize candidates automatically. It only flags those in violation of your configured rule. ::: ### Creating an additional inactivity-based rule You can create additional inactive lead and inactive application rules. These allow you to set different location criteria and retention periods, giving you greater flexibility and compliance control over candidate data. See below for examples of rule configurations. To create a new inactivity-based rule: 1. Ensure you are on the **Inactivity Rules** tab of the **Data Privacy & Compliance** page. 2. Click `+ New` and select `Lead Rule`, `Active Candidate Rule`, or `Archived Candidate Rule`. ::Image[]{src="https://api.archbee.com/api/optimize/0p8tQ--ZZOxRtkVp6Qr-e/RvAwYxjyRS-cOHlnaXKEm_data-privacy-compliance-ashby-2026-10-14-at-23606-pm.jpg" size="90" isUploading="false" width="1325" height="561" darkWidth="1325" darkHeight="561" alt="Ashby Data Privacy & Compliance page with the New retention rule menu open, showing options to create a Lead Rule, Active Candidate Rule, or Archived Candidate Rule." showCaption="false"} 3. For additional inactivity rules, complete the following information: - **Title:** Click the current title of the rule to rename it. - **Description (Optional):** Add an internal description for your rule. - **Retention Period:** Determines how long Ashby retains the candidate's data after the latest relevant activity, based on the events selected in your configuration settings. If no relevant activity exists, Ashby uses the candidate creation date as the fallback start date. - **Location:** Determine your location criteria: - **Global:** Covers all locations configured in Ashby. You can only configure one rule per type with the Global Location setting (to avoid conflicts). - **Specific Locations:** Specify the locations this rule applies to. For more on configuring locations, see [Set up Departments & Locations](docId\:ACYBgYBzAs3YmyVbO5um8). - **Advanced:** Switch on the `Advanced` option and click `+ Add Field to Match` to set your criteria using a range of location fields and values. You can also set further criteria in the **Additional Criteria** section. :::hint{type="warning"} If you do not enable the **Advanced** toggle and specify location fields, the locations you select for data rules within the **Locations** section refer to the locations assigned within your job's **Settings** section. ::: ::Image[]{src="https://api.archbee.com/api/optimize/0p8tQ--ZZOxRtkVp6Qr-e/J5OMtQbYNG8ofbXmNnRgF_new-inactive-applicant-rule-acent-ashby-2026-03-17-at-115705-am.jpg" size="70" alt="The Locations section of configuring a new data retention rule." isUploading="false" width="938" height="284" darkWidth="938" darkHeight="284" showCaption="false"} 4. When you are ready to enable your rule, switch on `Is Enabled` in the **Basic Info** section and select `Save Changes` at the bottom of the page. ::Image[]{src="https://api.archbee.com/api/optimize/0p8tQ--ZZOxRtkVp6Qr-e/GHUPk5MKnHx_1JTGcX-CO_is-enabled-toggle.jpg" size="70" alt="The Basic Info section of a data retention rule with Is Enabled highlighted." isUploading="false" width="954" height="376" darkWidth="954" darkHeight="376" showCaption="false"} 5. In the **Danger Zone** section, you can also re-evaluate candidates who meet your rule criteria and apply the rule to them if they qualify. Click `Re-evaluate X Candidates` to take this action. :::hint{type="warning"} Re-evaluating the rule for candidates does not delete or anonymize candidates automatically. It only flags those in violation of your configured rule. ::: ## Consent rules Consent-based rules apply based on the date a candidate gives consent. ### Amending the default consent-based rule Select the default consent-based rule to further configure it: - Adding a description for internal reference. - Choosing the consent request period, which defines how long a period of consent Ashby requests from the candidate when requesting consent via your jobs page or via automation settings. - Creating a rule filter, which restricts which candidates this rule applies to. - Setting up consent collection on Job Posting pages in the **Jobs Page Settings** section. The consent collection option appears underneath the application form on the job posting. - Setting up automation settings to automatically send an email with a link to a consent form based on a set of rules. You can use this to collect consent from non-applicants, such as sourced candidates (for example, those added via the Chrome extension) or candidates that were manually added to Ashby. - Setting up consent extension automation settings to automatically request a consent extension prior to the consent retention date. ::Image[]{src="https://api.archbee.com/api/optimize/0p8tQ--ZZOxRtkVp6Qr-e/sLi6SgKifYUGdSQhMgAhV_default-consent-rule-acent-ashby-2026-03-17-at-13346-pm.jpg" size="80" alt="The edit menu for the default consent-based rule." isUploading="false" width="1022" height="1416" darkWidth="1022" darkHeight="1416" showCaption="false"} ### Creating an additional consent rule You can create additional consent rules to set different location criteria and retention periods. For examples of multiple rule configurations, see the examples below. To create a new consent rule: 1. Ensure you are on the **Consent Rules** tab of the **Data Privacy & Compliance** page. 2. Click `+ New` and select `+ Consent Rule`. ![The consent rules tab with the New button highlighted.](https://api.archbee.com/api/optimize/0p8tQ--ZZOxRtkVp6Qr-e/rJwNwI8NsmTotjPQ3uU2m_data-privacy-compliance-acent-ashby-2026-03-17-at-14625-pm.jpg) 3. For additional consent rules, complete the following information: - **Title:** Click the current title of the rule to rename it. - **Description (Optional):** Add an internal description for your rule. - **Consent Request Period:** The request period defines how long a period of consent Ashby requests from the candidate when requesting consent via your jobs page or via automation settings. - **Custom Consent Form Text:** Optional custom consent form text specifically for this rule. If left blank, Ashby uses the consent form text set within the **Direct Consent Request Settings** instead. ::Image[]{src="https://api.archbee.com/api/optimize/0p8tQ--ZZOxRtkVp6Qr-e/mOxMFa8G6ibZ7FtMKJyuX_consent-rule-basic-info.jpg" size="60" alt="The basic info section of a consent rule." isUploading="false" width="940" height="476" darkWidth="940" darkHeight="476" showCaption="false"} - **Location:** Determine your location criteria: - **Global:** Covers all locations configured in Ashby. - **Specific Locations:** Specify the locations you have configured in Ashby that this rule applies to. For more on configuring locations, see [Set up Departments & Locations](docId\:ACYBgYBzAs3YmyVbO5um8). - **Advanced:** Switch on the `Advanced` option and click `+ Add Field to Match` to set your criteria using a range of location fields and values. You can also set further criteria in the **Additional Criteria** section. :::hint{type="warning"} If you do not enable the **Advanced** toggle and specify location fields, the locations you select for data rules within the **Locations** section refer to the locations assigned within your job's **Settings** section. ::: ::Image[]{src="https://api.archbee.com/api/optimize/0p8tQ--ZZOxRtkVp6Qr-e/RP1SROibyiDXwEexGRDjk_locations-and-additional-criteria.jpg" size="70" alt="The location section of the consent rule menu with the Advanced toggle on, displaying the Additional Criteria section." isUploading="false" width="938" height="450" darkWidth="938" darkHeight="450" showCaption="false"} ## Consent rules: jobs page settings On the **Jobs Page Settings** tab of your consent rule, you can enable the `Collect Consent on Jobs Pages` option. When enabled, you can configure criteria so only the job pages that meet the filters you set request consent. ![The Jobs Page Settings section of a consent rule.](https://api.archbee.com/api/optimize/0p8tQ--ZZOxRtkVp6Qr-e/SIPHfTpomHdOHDZV2H-CI-20260318-115118.jpg) When candidates complete an application on your career page, Ashby automatically adds a note below the custom consent form text and above the consent checkbox. The note tells candidates how long the consent period lasts, based on the rule's **Consent Request Period**. You cannot hide this note from the job page. ::Image[]{src="https://cdn.images.archbee.com/0p8tQ--ZZOxRtkVp6Qr-e/cVwWEWfi_Lqi-IPNFexQA_customer-support-specialist-tier-3-moonfall-industries-demo-2026-09-29-at-82109-am.jpg?format=webp" size="70" width="800" height="441" isUploading="false" darkWidth="800" darkHeight="441" alt="Candidate Data Consent section on a Moonfall Industries job application, displaying consent terms, a highlighted note that the consent period lasts for one year, an "I agree" checkbox, and a purple Submit Application button." showCaption="false"} If both the rule-level and Direct Consent Request custom text are blank, Ashby uses this built-in default: "Do you agree to allow \[legal entity name] to contact you about job opportunities for up to \[consent period]?" ::Image[]{src="https://cdn.images.archbee.com/0p8tQ--ZZOxRtkVp6Qr-e/BWY64_TpF59yedsJR1AIb_realm-guide-moonfall-industries-demo-2026-09-29-at-82154-am.jpg?format=webp" size="70" width="800" height="329" isUploading="false" darkWidth="800" darkHeight="329" alt="Job application consent question asking whether the candidate agrees to be contacted by Moonfall Industries about job opportunities for up to five years, with an "I agree" checkbox and Submit Application button." showCaption="false"} ## Consent rules: automation settings Within the **Automation Settings** tab, you see two options: **Initial Consent** and **Consent Extension**. ![Global Consent Rule page with the Automation Settings tab highlighted, showing options to configure automated consent form delivery to candidates.](https://api.archbee.com/api/optimize/0p8tQ--ZZOxRtkVp6Qr-e/xXJj8rg-jcldo5PAzfLRZ_royal-records-consent-ashby-2026-09-10-at-14259-pm.jpg) ### Initial consent automation settings Initial consent automation settings allow you to determine the conditions under which the first consent request is sent. Click `Get Started` to create a draft. ![Global Consent Rule Automation Settings page with no automation configured and an arrow pointing to the Get Started button.](https://api.archbee.com/api/optimize/0p8tQ--ZZOxRtkVp6Qr-e/o0a0YhRrWYPTFXJC5gp8A_global-consent-rule-ashby-2026-09-10-at-14433-pm.jpg) In the **Condition** section, you can add filters by clicking `Add Field to Match`. You can then specify any criteria candidates must meet to be sent the initial consent request email. Use the **Email Template** field to determine the template sent to the candidate, and the **Delay** dropdown to specify when the email is sent. :::hint{type="info"} The email template must use the `Data Consent Request Link` token to be selectable in the dropdown menu. ::: If you need to add an additional automation rule to create a separate set of criteria, click `Create New Automation Rule`. ![The menu to create a new automation rule.](https://api.archbee.com/api/optimize/0p8tQ--ZZOxRtkVp6Qr-e/A-BWrZyuAluARLBpiPPYF_new-consent-rule-acent-ashby-2026-03-17-at-20330-pm.jpg) When you are ready to use your rule or rules, click `Save & Publish`. When a candidate meets the conditions you have set in your automation, they receive the email you specified in the **Email Template** field. ![Global Consent Rule Automation Settings page in editing mode with an arrow pointing to the Save & Publish button.](https://api.archbee.com/api/optimize/0p8tQ--ZZOxRtkVp6Qr-e/3UzJsaVw58ZEs941Tikco_global-consent-rule-ashby-2026-09-10-at-14858-pm.jpg) ### Consent extension automation settings Consent extension automation rules allow you to determine when a consent extension request email is sent to the candidate. Click `Get Started` to start setting up your automation rule. ![Global Consent Rule Automation Settings page with the Consent Extension tab selected and an arrow pointing to the Get Started button for configuring consent extension automation.](https://api.archbee.com/api/optimize/0p8tQ--ZZOxRtkVp6Qr-e/vtP_CIBlUmmAh9MYtY9XB_global-consent-rule-ashby-2026-09-10-at-15205-pm.jpg) Use the `Advance notice period` field to determine how far in advance the request is sent. In the pictured example, Ashby sends the consent extension request email 21 days prior to the date listed in the **Consent Retention Date** field on the candidate's profile. You can then determine the email template and the sender email address using the **Email Template** and **From email address** fields. :::hint{type="info"} The email template must use the `Data Consent Request Link` token to be selectable in the dropdown menu. ::: To add a filter to your rule, click `Add Field to Match` in the **Filter** section to set your criteria. If this section is left blank, all candidates the consent rule applies to are sent an extension request prior to their consent expiring. To create an additional consent extension automation rule, click `Create New Automation Rule`. ![The consent extension automation rule configuration menu with the Create New Automation Rule option.](https://api.archbee.com/api/optimize/0p8tQ--ZZOxRtkVp6Qr-e/X0-UO0LjyUOCeGMq8VIRW_global-consent-rule-ashby-2026-09-10-at-15412-pm.jpg) When you are ready to use your rule, click `Save & Publish`. ![The consent extension automation settings page in editing mode with an arrow pointing to the Save & Publish button.](https://api.archbee.com/api/optimize/0p8tQ--ZZOxRtkVp6Qr-e/DZnSMdYsriaDuPh8H1nY8_global-consent-rule-ashby-2026-09-10-at-15710-pm.jpg) :::hint{type="info"} When you activate your consent extension configuration rule, Ashby applies it to all candidates meeting your criteria. ::: ::::ExpandableHeading{isOpen="true"} ## Open for examples of rule configurations :::hint{type="warning"} The examples below are purely illustrative. Consult your legal team and organization's policies when configuring your own data compliance rules within your Ashby account. ::: ### Example based on candidate location In our first example, our test company has different retention periods for inactive candidates who are located in Germany. An additional inactive applicant rule can be created with the appropriate retention period and the `Advanced` option switched on in the **Locations** section. The Advanced option allows them to use the `Candidate's Location` field, meaning this is the field evaluated when applying the rule. ![Illustrative example of an inactive applicant rule configured based on candidate location.](https://api.archbee.com/api/optimize/0p8tQ--ZZOxRtkVp6Qr-e/r63-h8Penq73foVnR2h-L_illustrative-example-inactive-applicant-rule.jpg) ### Example based on job posting location In this second example, the test company wants to set a different consent request period and different consent form text for job postings with their locations in the United States. When configuring an additional consent rule based on job posting location, the **Advanced** toggle should be switched on and the `Candidate's Job Consideration's Job Posting's Location` field can be used to determine the value fields. The consent period can then be set in the **Consent Period Request** section, and the alternative consent form text can be added to the **Custom Consent Form Text** field. ![Example of a consent rule configured based on job posting location.](https://api.archbee.com/api/optimize/0p8tQ--ZZOxRtkVp6Qr-e/wcbIMy8ouuZbIHl-KdlSA_example-consent-rule-job-posting-location.jpg) :::: # Privacy & legal settings On the **Privacy & Legal** tab of the **Data Privacy & Compliance** page, you can set the following: - Recruiting Privacy Policy - Legal Entity Name - Automated Processing Legal Notice ![The Privacy and Legal tab of the Data Privacy and Compliance page in Ashby.](https://api.archbee.com/api/optimize/0p8tQ--ZZOxRtkVp6Qr-e/vVGxQRBylJMKDVEFPGopQ_data-privacy-compliance-acent-ashby-2026-03-17-at-21535-pm.jpg) ## Recruiting privacy policy Add a link to a privacy policy here that contains details of how you manage candidate data. This link appears on any consent forms that candidates complete. You can set a **Recruiting Privacy Policy** in the [Data Privacy & Compliance](https://app.ashbyhq.com/admin/organizational-settings/data-compliance) section of Admin, under the **Privacy & Legal** tab. When you do so, a link to the policy appears on any consent forms that candidates fill out. ## Legal entity name The legal entity name is used for data consent requests, Equal Employment Opportunity Commission (EEOC), and other legal contexts. You can leave this blank to use your Organization Name. ## Automated processing legal notice Here you can configure a legal notice to inform candidates that their data may be processed using artificial intelligence (AI). :::hint{type="info"} For more on Ashby's AI tools, see [Ashby AI Features](docId\:isi4AsubJJXiHYTbEekfa). ::: # FAQs ### How does location hierarchy work with compliance rules? Location hierarchy across jobs and job postings is supported in compliance rules. For example: If the rule is scoped to the United States region and the job location is set to California, the rule **will** match because the United States location is the region the California location is linked to. If the rule is scoped to the California location and the job location is set to the United States region, the rule **will not** match because California is a descendant of the United States region, and the specification is respected. ### How are inactivity-based rules and consent-based rules applied to hired candidates? Ashby treats candidates in the Hired stage as active candidates. This is because hired candidates have an active employment relationship with your organization, which provides a legitimate business interest for retaining their data. The employment of the hired candidate also creates a legal basis for data retention that supersedes the need to apply consent-based or inactivity-based retention rules. As such, Ashby does not consider them or mark them as in violation of the rules you configure in Ashby. ### What happens when a rule is disabled? You can disable a data compliance rule by switching off the `Is Enabled?` toggle when viewing the rule details. When you disable a rule, Ashby re-evaluates all candidates who had that rule applied. If another applicable rule exists, it becomes the new applied rule. If no other rule applies, Ashby clears the candidate's retention date for that category. ### What happens when a rule is archived? You can archive a rule by opening the rule details and clicking the `Archive` button. You must disable a rule before archiving it. Once archived, it cannot be re-enabled (it is effectively retired). The same re-evaluation that happens on disable applies here as well. Ashby hides archived rules from the active rules list but retains them in the system for audit purposes. ### What happens to automated consent emails when a consent rule is archived or disabled? Ashby cancels any scheduled automated consent extension emails tied to that rule. This prevents outdated or irrelevant emails from being sent to candidates. ### If multiple consent rules apply to the same job posting, which consent form is shown to applicants? Ashby displays the consent form from the rule with the longest retention period. This ensures candidates are asked for consent under the most protective rule. ### What happens if a candidate has both active and archived job considerations? The answer depends on whether you have an Active Candidate rule enabled. If you do not have an Active Candidate rule enabled, Ashby skips compliance evaluation entirely for candidates with at least one active job consideration. The archived job consideration does not start a retention clock while an active one exists. Evaluation only begins once all job considerations are archived. If you have an Active Candidate rule enabled, Ashby evaluates the candidate using the Active Candidate rule and the Archived Candidate rule. The retention date is calculated as the Active Candidate retention period plus, when applicable, the longest matching Archived Candidate retention period. ### Can an active candidate be marked as out of compliance? Yes. If an enabled Active Candidate rule applies and the calculated retention date has passed, Ashby can mark the candidate as out of compliance. Archive all active applications before taking anonymization or deletion actions.