The interpretation of which legal ground to use for this specific processing varies. Our opinion, that however needs to be assessed on a case by base basis, is the following:
If you know that you have a similar job-opening coming shortly, there is a possibility to motivate the use of a balancing of interests (“legitimate interest”), as the candidate probably also has an interest in you keeping the information. However, this applies if you know that you have a job-opening within the upcoming months, not a year/years. According to the Article 20 Working Party (“WP29”) Opinion 2/2017 p 11 fn 15 – which refers to the Recommendation CM/Rec(2015)5 para 13.2 of the Committee of Ministers) the candidate needs to be informed about data being processed for future recruitment and given the possibility to object and request deletion.
If you just wish to keep the application because it is “nice to have”, we recommend collecting a valid consent.
If a candidate is no longer relevant for employment, the processing must cease as the legal ground expires (this also follows from the principle of storage minimization). It is recommended to set automatic deletion of older applications to ensure no illegal processing. Depending on the type of jobs with the employer the “best before”-dates for applications may vary. When determining such end date, one should also keep in mind the principle of processing only accurate personal data.