Candidate Subject Access Requests: What Recruiters Must Provide

Under the GDPR and UK GDPR, a candidate can ask you for a copy of the personal data you hold about them and for details of how it is used. The request can be informal, and you should respond within one month, extendable by up to two further months for complex or numerous requests. Search every place data sits: your applicant tracking or screening tool, email, spreadsheets, shared drives, interview notes and scorecards, and vendor systems. Provide the candidate's personal data, redact other people's where necessary and explain any exemption you rely on. Write notes factually, since candidates can ask to see them. This is general information, not legal advice, as of October 2026. Other countries have different access rights.

Most problems come from not knowing what you hold, and from notes that were never meant to be read.

What counts as personal data in recruitment

• The application form, resume and cover letter.
• Emails and messages with the candidate.
• Interview notes, scorecards and ratings that relate to the candidate.
• Test and assessment results.
• References you received.
• Screening scores, rankings and flags, including those generated by tools.
• Information from background checks.
• Records of decisions and the reasons.

If it is about the person and you can identify them, it is likely personal data, whether in a system or a note.

Responding step by step

1. Log the date and acknowledge receipt.
2. Confirm identity in a proportionate way.
3. Clarify the scope only if the request is very broad, without delaying the clock.
4. Search all systems and people involved: recruiters, hiring managers, interviewers, vendors.
5. Collect the data and review it.
6. Redact information about other people unless you have a basis to share it.
7. Apply exemptions only where they clearly apply, and record why.
8. Send a copy in a clear, commonly used format, with the supplementary information the law requires: purposes, recipients, retention, source and rights.
9. Record what you sent and when.

Most requests must be handled free of charge, unless they are manifestly unfounded or excessive, in which case you may refuse or charge a reasonable fee, with reasons.

What you can withhold

• Information about other individuals, where sharing would breach their rights and it is not reasonable to disclose without their consent. Often you can redact their names and still share the candidate's data.
• Legally privileged material.
• Confidential references in some circumstances, depending on the country.
• Data subject to another exemption in national law.

The right is to the candidate's personal data, not necessarily to whole documents. You may extract the relevant parts.

Interview notes and scorecards

Candidates are often surprised that notes are in scope. Treat this as a reason to write good notes.

• Record facts and evidence tied to criteria: "Described reducing refund failures from 2.1 to 0.6 percent."
• Avoid personal comments, speculation and anything about protected characteristics.
• Use the scorecard, not freeform scribbles. See interview scorecard template.
• Do not keep side notes in chat messages or personal notebooks.

This discipline also improves decisions. See interview debrief meetings.

Automated tools and scores

If a tool produced a score or ranking for the candidate, that is personal data and may be within scope, along with information on how decisions were reached where the law requires. Be ready to explain in plain terms what the tool looks at. See candidate AI disclosure. Evidence-linked scores make this easier: Resume World shows which lines in the resume support each score, so you can explain a result without inventing a reason afterwards.

Reduce the burden

• Keep resumes and notes in one place, and avoid copies.
• Use a retention schedule so there is less to search. See candidate data retention.
• Make a named person responsible for requests, with a template and a log.
• Brief hiring managers on what is in scope.
• Ask vendors how they support exports.

Reply template

"Thank you for your request of [date]. Please find attached a copy of the personal data we hold about you in connection with your application for [role], including your application, our correspondence, and the notes and scores from your interviews. We have removed information that relates to other individuals. The attached summary explains why we process your data, who we share it with, how long we keep it and your rights, including your right to complain to [regulator]."

When it becomes a dispute

Requests are sometimes made alongside a complaint or a claim. Treat the data request as a separate legal duty, respond properly and tell your legal adviser early. Do not alter or delete records after a request or a dispute has begun. See candidate right to erasure and GDPR and recruitment data for related duties.