MUbase
MUbase

Explore apps

Get started

HR | base10 min readUpdated:

Applicant management: from vacancy to hiring

Applicant management for SMEs: stages, assessment, rejections, data protection under the DSG and GlG, retention and hiring, with an example.

Editorial team KMU | base – technically reviewed by an HR specialist from the founding team with experience in accounting and auditing

DeutschEnglishFrançaisItaliano
By emailLinkedIn
Yellow, pink and red folders with a mechanical pencil on a wooden table

Good applicant management means that no application is left lying around, everyone involved sees the same status and, in the end, nobody holds more data than they need. For an SME without its own recruitment department this is above all a matter of order: fixed stages, clear responsibilities and a plan for what happens to the documents. This guide shows how to set up applicant management from receipt to hiring and which legal guidelines apply.

Define the stages

A simple process is enough: receipt, screening, interview, offer, then hiring or rejection. What matters is that each application is in exactly one stage and that someone is responsible for the next step. Decide who reviews applications, who takes part in interviews and who decides. That the stages have these names is practice, not a statutory requirement; what matters is traceability.

What you may ask and store

The employer may process data about employees only to the extent that they concern the employee’s suitability for the employment relationship or are necessary for performing the employment contract; otherwise the Data Protection Act applies (Art. 328b CO). The DSG requires that personal data be processed lawfully, in good faith and proportionately, that they be collected only for a specific and recognisable purpose and that they be destroyed or anonymised as soon as they are no longer needed for that purpose (Art. 6, paras. 1 to 4 DSG).

For applications, according to the guidance of the Federal Data Protection and Information Commissioner (FDPIC), this means: questions about education and career are generally permitted. Questions about illness or pregnancy are permitted only if special reasons justify them, such as a link to the advertised job. Health data count as particularly sensitive personal data (Art. 5 lit. c point 2 DSG; more in the guide Data protection in HR). For reference enquiries, first obtain the applicant’s consent. Only authorised persons may see the application documents, as a rule the HR department and the direct line managers.

Inform applicants

Anyone who collects personal data informs the person concerned appropriately. At least the identity and contact details of the controller, the purpose of processing and, where applicable, the recipients of the data must be communicated (Art. 19, paras. 1 and 2 DSG). For applications, a short data protection notice therefore belongs in the application form or the acknowledgement of receipt. Wilful breach of this duty to inform is punished on complaint with a fine of up to CHF 250’000 (Art. 60, para. 1 DSG).

If you want to keep the documents for later vacancies, the person’s consent is required. It is valid only if given voluntarily, after appropriate information, for one or more specific processing operations (Art. 6, para. 6 DSG). This is known as a talent pool.

Assess applications and decide

Assess all persons by the same criteria set in advance, for example expertise, experience and fit with the team, and record your impressions from the interviews briefly in writing. This creates comparability and helps later if someone asks for the reason for the rejection. If you use software that sorts out applications automatically, note Art. 21 DSG: a decision based exclusively on automated processing that significantly affects the person triggers duties to inform and gives the person the right to have it reviewed by a human. The simplest way is for a person always to decide.

Rejections and equal treatment

The Gender Equality Act expressly prohibits discrimination on grounds of sex, also in recruitment (Art. 3, paras. 1 and 2 GlG). If a recruitment is rejected in a discriminatory manner, there is no entitlement to the job but to compensation (Art. 5, para. 2 GlG) of at most three months’ salary (Art. 5, para. 4 GlG). Anyone who alleges discrimination can demand written reasons for the rejection (Art. 8, para. 1 GlG). The entitlement to compensation lapses unless an action is brought within three months of notification of the rejection (Art. 8, para. 2 GlG).

Practice: send rejections promptly, politely and without judging the person. Give a reason if the person asks for one, and then factually.

Retention, talent pool and deletion

The law names no fixed period for rejected applications. According to the FDPIC’s guidance, you return the documents of unsuccessful persons and destroy copies. You may keep what belongs to you, such as cover letters and personnel questionnaires; these too must be destroyed at some point. With the applicants’ consent, documents may be kept for a period fixed in advance if it is foreseeable that they will soon be needed again. Without consent, an overriding interest of the company may in some circumstances justify retention; the person must then be informed.

Practice, not statutory: retention of at least three months after the rejection is obvious, because the time limit for bringing an action under Art. 8, para. 2 GlG is three months. After that, set a fixed, short period and keep to it.

Every person can request information about what personal data you process about them. The information is free of charge and is normally provided within 30 days (Art. 25, paras. 6 and 7 DSG); the person submits the request in writing (Art. 16, para. 1 DSV).

Notifiable vacancies

In occupations with high unemployment, vacancies must be notified to the public employment service (Art. 21a, para. 3 AIG, Art. 53a et seq. AVV). This affects the procedure: the regional employment centre (RAV) sends suitable files within three working days of the complete notification (Art. 53c, para. 1 AVV). You invite suitable candidates to an interview or aptitude assessment and tell the RAV whom you invited and whether you have hired anyone (Art. 21a, para. 4 AIG, Art. 53c, para. 2 AVV). Anyone who wilfully breaches the duty to notify, or the duty to invite suitable persons to an interview or aptitude assessment, is punished with a fine of up to CHF 40’000, or up to CHF 20’000 in the case of negligence (Art. 117a AIG). Details are in the guide to the job advertisement.

Practical example: Muster Metallbau AG

Muster Metallbau AG is a fictitious business with 14 employees. On Monday, 5 October 2026, it advertises a position as a polymechanic (EFZ) starting on 1 February 2027. By the application deadline on Friday, 30 October, 31 applications have arrived: 18 via the careers page, 8 by email and 5 on paper. Nine go to screening and four to interview; scheduling is done with three proposals each.

On Monday, 9 November 2026, the team decides: one person receives the offer, and 30 applications are rejected. The rejections are scheduled for Wednesday, 11 November, 09:00. The procedures are closed on 9 November; with the six-month period, the documents are deleted from 9 May 2027. The company sends the originals of the paper applications back with the rejection; scanned copies run down with the period. Two persons agreed to the talent pool in the form (received on 14 October 2026, 24 months): their documents are kept until 14 October 2028. The three-month time limit under Art. 8, para. 2 GlG ends for the rejections of 11 November on 11 February 2027, long before deletion. On 18 November a rejected applicant requests information; the reply is due by 18 December 2026 (30 days).

Checklist

  • Stages and responsibilities defined
  • Only questions asked that concern suitability for the job
  • Data protection notice in the application form, consent for the talent pool voluntary and separate
  • Criteria set before the interviews, impressions recorded in writing
  • A person always makes the decision
  • Rejections sent promptly, reasons ready on request
  • Retention period set and configured
  • Checked whether the vacancy is subject to the notification duty
  • Information requests answered within 30 days
  • On hiring: documents transferred to the personnel file, the rest deleted

How KMU | base helps

HR | base guides applications from the vacancy to the personnel file. You find everything under People › Applications.

1. Pipeline. The overview shows your vacancies with open and new applications; with the Pipeline switch you see the applications as cards in the stages New, Screening, Interview, Offer, Hired and Rejected (you maintain names and order in the settings). You move cards with the mouse or keyboard, filter by name, tag and source, and forward or reject several applications at once.

2. Assess. Your team assesses with stars and criteria and sees the average. Notes with an @mention notify colleagues; everything is in a timeline. You forward applications to line managers or external persons for assessment with a deadline. For each vacancy you set the hiring team and criteria.

3. Interviews. You set an appointment or send up to five proposals from which the person chooses via a link. The person and the team receive a calendar file. Invitation and rejection emails come from templates with placeholders. Rejections by default go out two days later at 09:00 and can be cancelled until then.

4. Data protection. Closed applications are deleted or anonymised, with their files, after the period you set (1 to 24 months); individually this can be done at any time on request. The default is 6 months; this is a suggestion that you must check. Persons who agreed in the application form are found under Applications › Talent pool; you set the duration of consent between 6 and 36 months, and it can be withdrawn at any time. For information requests, in the application you download all data with their documents as a ZIP with “Export subject access data”; the retrieval is logged. You find the related settings under HR settings › Applications.

5. Hire. With “Hire” you create the person in the personnel file with a joining checklist. Documents and profile picture are transferred, the vacancy is marked as filled if you wish, and the advertisements end. The employment contract follows separately, see Create an employment contract; for the probation period read Probation period in the employment contract.

Limits: HR | base never decides on an application. Knock-out answers in the questionnaire are flagged but do not lead to automatic rejection, and rejections go out only when you trigger them. Whether a vacancy is notifiable, and the notification to the RAV, you handle yourself.

If you would like to try it yourself, take a look at the Demo or open a test account. For prices, see the Prices page. If you have questions, we will help you via the Contact page.

Sources

This guide does not replace legal or tax advice. Information as at 27.10.2026.

Back to top

Collaboration ×

The next step starts with a conversation.

What does your business need?

Try the demo company Request a quote