If "Person Data Retention Policy" is turned on, candidates will be deleted (moved to ReceycleBin) when their expiration date is exceeded. It is managed according to the rules set up in Company Settings.
For a candidate to be included in the deletion, the expiration date must be set to a candidate profile. This will happen automatically for newly created candidates after the number of Default Expiry days have been set in Company Settings.
Existing candidates must be set with an expiry date manually. This is most easily done in the People list, where you can select the candidate and "Renew" the Expiry Date under "Action".
If automatic deletion is NOT desired expiry dates can still be used.
Data should be deleted when they are no longer needed, but as a rule of thumb that is currently 6 month according to GDPR recommendations.