What applicant data may a company store?

Only data required for the hiring process — and only for as long as necessary. BDSG Section 26 and GDPR Article 88 are the legal basis: employers may store applicant data for the duration of the process plus a reasonable retention period (typically 3–6 months after rejection). GDPR Article 15 grants you the right of access: you can enquire which data is stored. GDPR Article 17 grants you the right to erasure after the process ends. The Anti-Discrimination Office recommends: companies should not reuse application documents for other positions without explicit consent. Practically: if you are asked to join a talent pool — read the privacy policy and give informed consent.