The employer can not retain the information more than it is necessary. The employer has to give any one who comes in contact with the information of the applicant a code of conduct. The company has to go through an audit to make sure they are complying and protecting the data.[10]