(19)It is necessary to enable ESMA to assess whether an applicant that applies for recognition as a third-country external reviewer complies with the conditions for such recognition, while ensuring proper safeguards. For that reason, personal data relating to applicants for recognition as a third-country external reviewer should be kept by those external reviewers and ESMA for no longer than five years after that applicant has ceased to perform its function. For the same reasons, where ESMA has refused recognition as a third-country external reviewer or where the applicant has withdrawn its application for recognition as a third-country external reviewer, personal data relating to that applicant should be kept by ESMA no longer than five years after the refusal of the recognition of the applicant or after the withdrawal of the application.