When a candidate asks what personal data you hold about them, the UK and EU GDPR give them a right of access. Log the request the day it arrives, confirm who is asking, search every place the data may sit, remove other people data, and reply within the time the law allows with a copy and the information the law requires. This guide gives the steps and a reply template.
Key takeaways
- A request can arrive in any form, to anyone in the company. Train recruiters to pass it to the data lead at once.
- The standard time to reply under GDPR is one month, with a possible extension for complex requests. Check the current ICO or national guidance for your country.
- Search all systems: the tracker, email, calendars, chat, spreadsheets, interview notes and shared drives.
- Remove or redact other people personal data, such as interviewer names where needed, unless an exception applies. Do not hide the candidate own data without a lawful reason.
- Reply clearly, keep a record, and delete data on schedule afterwards.
What the right of access is
Under the GDPR in the EU and the UK GDPR, a person can ask an organisation whether it processes their personal data, and if so, can ask for a copy and for information such as why you hold it, who you share it with and how long you keep it. The request is often called a data subject access request, or DSAR. Candidates can use it to see what you recorded about them in the hiring process, including notes and scores. The official guidance of the UK regulator is the ICO right of access guidance. The European Data Protection Board publishes guidelines at edpb.europa.eu. The legal text is in Regulation (EU) 2016/679.
In the US, there is no general federal right of access, but some state privacy laws give job applicants rights to know and access their data, and other laws give access to certain records. Ask your adviser which apply to you. Treat requests from US candidates seriously and consistently.
Why recruiters should care
Hiring files contain opinions, scores and notes. If you write them carelessly, the candidate may read them. A clear process protects you and reminds your team to write facts that relate to the job. It also protects the candidate right to know how their data was used. See GDPR for job applicants for the wider rules.
Step 1: recognise and log the request
A request does not have to use the words “subject access request” or come through a form. An email saying “please send me everything you have about me” counts. It might arrive at a recruiter, a hiring manager or general email address. Train everyone to pass it on within a day. Log the date it arrived, who sent it, what they asked for, and who is handling it. The clock starts when you receive the request.
| Field | Example entry |
|---|---|
| Date received | |
| Channel (email, post, phone) | |
| Requester | |
| Scope (all data or specific) | |
| Identity check needed? Done on | |
| Owner | |
| Reply due date | |
| Extension used? Reason | |
| Reply sent on |
Step 2: confirm identity, only as needed
Check that the person is who they say they are, so that you do not give data to the wrong person. Ask for the minimum proof needed. If you know the person from the application email and the request comes from that address, you may already have enough. Do not ask for more documents than needed, and delete any ID copies once the check is done.
Step 3: search every place
- Applicant tracking system: profile, notes, scores, stage history, messages.
- Email: with recruiters, hiring managers and the candidate.
- Calendars and scheduling tools.
- Chat and messaging tools.
- Spreadsheets and trackers, including personal copies.
- Interview notes on paper and in notebooks.
- Assessment tools, video interview platforms and background check providers.
- Shared drives and backups, as far as reasonable.
- Data held by processors, such as agencies and software suppliers.
Ask your suppliers to search their systems too, under your data processing agreements. Note the places you searched, in case you need to explain later.
Step 4: review and redact
The candidate is entitled to their own personal data, not to everything in a document. A page of interview notes may mix the candidate data with data about interviewers or other candidates. Review each item.
| Item | What to do |
|---|---|
| Candidate own data (application, scores, notes about them) | Include |
| Names and details of other candidates | Remove or redact |
| Interviewer names and opinions | Consider the rules on other people data and whether an exemption or consent applies. Take advice on how to handle it |
| Legal advice or privileged material | Check whether an exemption applies |
| Information that would harm a lawful ongoing process | Check the exceptions with your adviser |
| Duplicate or unrelated emails | Include only if they contain the candidate personal data |
The ICO guidance covers exemptions and third-party data in detail. Take advice if you plan to withhold anything, and tell the person that something has been withheld, and why, where the law requires it.
Step 5: reply on time
Under GDPR the usual time limit is one month from receipt, and it can be extended in certain complex cases. The UK has updated parts of its data rules in recent years, so check the current ICO guidance for the exact rules on timing and on searches. Reply in a secure way: a protected file, a secure link or a password sent by a separate route. Do not send personal data in an open email attachment. Provide a copy in a clear format.
In your reply, include the information the law lists: the purposes of processing, the categories of data, recipients, how long you keep it, the source of the data if not from the candidate, their rights to correct or delete, and their right to complain to the regulator. A cover letter that covers these points saves follow-up questions.
Reply template
“Dear [name], thank you for your request dated [date] for a copy of the personal data we hold about you in connection with your application for [role]. We have confirmed your identity and searched our systems. Enclosed is a copy of your personal data, sent through a secure link. We hold your data for the purpose of managing your application, on the basis of [lawful basis], and we keep it for [period]. We have shared it with [recipients]. Some information has been removed because it relates to other people [or: because an exemption applies]. You have the right to ask us to correct inaccurate data, to ask for deletion in some circumstances and to complain to [regulator]. If you have questions, please contact [name, email].”
What if the request is unclear, large or repeated
- If you cannot tell what is asked, ask for clarification promptly, but do not use this to delay without reason. Check the guidance on when the clock pauses.
- If the request is very large, ask whether the person wants specific items first, while you continue to search the rest.
- If requests are repeated or clearly abusive, take advice. The law allows limits in narrow cases, but you must be able to justify them.
Related rights
A candidate may ask for more than a copy: correction of wrong data, deletion, or an end to certain uses. Handle each request on its own terms and in the time allowed. If they object to automated decisions, see GDPR Article 22. If they ask you to delete their data, check whether you have a lawful reason to keep it, such as a legal duty or a claim, and explain your decision. See how long to keep rejected applicant data.
Writing notes with the access request in mind
Write every note as if the candidate will read it. Record facts and evidence tied to the requirements. Avoid jokes, speculation, comments on appearance, age, health, family or other protected traits, and remarks about personality. This is good practice for fairness and makes access requests simple. Train interviewers on it, and review a sample of notes each quarter. See how to take interview notes.
Checklist
- Everyone knows to pass requests to the data lead within a day.
- A log and a template reply are ready.
- A list of systems and owners is current.
- Suppliers have agreed to help with searches.
- Redaction guidance is written and tested.
- Replies go through a secure route.
- Notes are written in a way that is fair to read.
- Data is deleted on schedule afterwards.
Worked example (fictional)
A candidate who was not selected emails the recruiter: “Please send me all the data you hold about me.” The recruiter logs the request and forwards it to the data lead the same day. The data lead confirms identity through the email address on the application, then searches the tracker, the email accounts of the two interviewers, the scheduling tool and the video interview platform. She finds the application, two scorecards and a set of emails. She removes the names of two other candidates mentioned in one email, and sends the rest through a secure link with a cover letter, within the month. The candidate thanks her and asks for one wrong date to be corrected, which she does. The data lead notes the request, the dates and the actions in the log.
Training your team
Most delays in access requests come from people not knowing what to do. Hold a short session for recruiters, hiring managers and administrators. Show them an example request, the log, and the reply template. Explain that any email asking for personal data may be a request, and that they must pass it on at once. Explain that notes are readable by the candidate and should be written in a fair, factual way. Remind them not to delete anything once a request has arrived, because that can create legal trouble. Repeat the session each year and when new staff join.
Working with suppliers and agencies
If an agency, a job board or a software supplier holds candidate data on your behalf, your contract should say how they help with access requests. Check that the agreement names the time they have to respond to you, for example a few working days, so that you can meet your own deadline. If an agency collects the data for its own purposes, it may be a separate controller, and the candidate may need to ask the agency directly. Make sure your privacy notice explains who holds what.
Keeping the record after the reply
Keep a copy of the reply and the log for as long as you need them to show that you complied. Limit access to them, since they contain personal data. After the retention period, delete them. If the candidate complains to the regulator, the log, the search list and the reply are your evidence of good faith. Review each request afterwards: what slowed you down, what the candidate asked about, and what you can do to make the next one easier. Update the template and the system list when you learn something new.
If you are unsure about any part of a request, ask your data protection officer or a qualified adviser early, not on the last day. A short call at the start of the month is far better than a rushed reply at the end, and it keeps the candidate trust in your hiring process intact.
Frequently asked questions
How long do I have to reply to a candidate access request?
Under GDPR the usual limit is one month, with extensions allowed for complex requests. Check the current guidance of your regulator.
Can I charge a fee?
Generally no, unless the request is manifestly unfounded or excessive and the law allows a fee or refusal in that case. Take advice.
Do candidates have the right to see interview notes?
Notes that contain their personal data are usually in scope, subject to exceptions for other people data and other exemptions.
What if the candidate lives in the US?
Some US state laws give applicants access rights. Check which apply to you and treat the request with care.
Related guides
This is general information, not legal advice.