Seven years & two years respectively according to the Code of Practice on Human Resource Management.
Old employee
The employer cannot keep the personal record for an old employee for more than seven years. There are only limited exceptions to justify the extension of the retention period, for example administering the remaining duty of MPF and defend the organisation in any civil suit or criminal prosecution. Some more examples are provided in section 4.1.2 and 4.2.1 of Code of Practice on Human Resource Management.
Unsuccessful job applicant
The personal data of an unsuccessful job applicant should not be retained for more than 2 years unless there is any subsisting reason that obligates the employer to do so or the applicant has provided prescribed consent for the data to be kept beyond 2 years. See more in section 2.10 of Code of Practice on Human Resource Management.