Candidate data access requests: handling GDPR and CCPA requests from applicants

A candidate who asks what you hold about them, or asks you to delete it, is exercising a legal right in the UK, the EU and California, and increasingly in other US states. The answer has to be complete, on time and careful: under the GDPR you have one month, under the CCPA 45 days, and the data is usually scattered across an applicant tracking system, inboxes, calendars, note-taking tools and interviewers' own files. This guide gives recruiting teams a working procedure, from logging the request to the reply, with the deadlines, the exceptions that let you keep hiring records, and templates.

Which law applies to which candidate

Whether the CCPA reaches you at all depends on its thresholds, which are summarized in the CCPA job applicant guide. Outside these regimes, answering a reasonable request is still good practice.

The deadlines and rules in detail

GDPR and UK GDPR

• Timing. Respond without undue delay and within one month, extendable by two further months where necessary given the complexity and number of requests, provided you tell the candidate within the first month (GDPR Art. 12(3)).
• What they get. Confirmation that you process their data, a copy of it, and information including the purposes, recipients, retention period, source and any automated decision-making (Art. 15(1) and (3)).
• Cost. Free, with a reasonable fee possible only for further copies or manifestly unfounded or excessive requests (Art. 12(5), 15(3)).
• Other people. The right to a copy "shall not adversely affect the rights and freedoms of others" (Art. 15(4)), which is the basis for redacting other candidates and, in some cases, referees.
• Erasure. Article 17(3) disapplies the right where processing is necessary to comply with a legal obligation or "for the establishment, exercise or defence of legal claims."

In the UK, the Data (Use and Access) Act 2025 changed two things. Section 78 inserted Article 15(1A), under which the candidate is entitled only to what you can provide "based on a reasonable and proportionate search," treated as in force from 1 January 2024. Section 76 inserted Article 12A, in force since 5 February 2026: the month runs from the "relevant time," which accounts for identity checks, and the clock stops while you wait for information you reasonably need to identify the scope of the request (see the Act's data subjects' rights provisions). A reasonable search is still a real search: it has to include the places interview data actually lives.

CCPA

• Methods. At least two designated methods for requests, including a toll-free number unless you operate exclusively online (Civ. Code § 1798.130(a)(1)).
• Timing. Confirm receipt within 10 business days and respond within 45 calendar days, extendable once by 45 days with notice (§ 1798.130(a)(2) and CCPA regulations § 7021).
• Verification. Authentication reasonable for the data requested, without requiring the candidate to create an account.
• Deletion exceptions. § 1798.105(d) lists eight, including internal uses reasonably aligned with the consumer's expectations and complying with a legal obligation; § 1798.145(a)(1) separately preserves the ability to comply with laws and to "exercise or defend legal claims."
• No retaliation. The request cannot affect how the candidate is treated in any current or future process.

A working procedure

1. Recognize it. A request does not have to use legal words. "Can you send me what your interviewers wrote about me?" and "Please remove me from your system" are requests. Train recruiters to forward them the same day.
2. Log it. Date received, the candidate, what they asked for, which law applies, the deadline, and who owns it.
3. Verify identity proportionately. Matching the request to the email address you already corresponded with is usually enough. Do not ask for more than you need, and do not demand documents you would then have to hold.
4. Check for a legal hold. If the candidate has complained or a claim is in view, involve counsel before deleting anything.
5. Search every location (next section). Ask each interviewer in writing to confirm what they hold.
6. Review and redact. Remove other candidates' data and information about other people where disclosure would affect their rights. Do not remove material simply because it is unflattering.
7. Decide on deletion. Delete what no rule requires you to keep; list what you are keeping, why and until when.
8. Tell service providers. Under the CCPA, notify service providers and contractors to delete; under the GDPR, tell recipients about erasure unless that proves impossible or involves disproportionate effort (Art. 19).
9. Reply and record. Send the response securely and keep a record of the request and what you did, without keeping a second copy of the data itself.

Where candidate data hides

Tools that store transcripts on the interviewer's own computer rather than in a vendor's cloud still hold personal data you are responsible for. Interview Signal works this way, which keeps transcripts out of third-party storage but means each interviewer's machine is part of the search. Build that into the written request you send interviewers.

What candidates are entitled to see, and what you can hold back

• Interviewer opinions are the candidate's personal data. Ratings and comments about a candidate are information about them. This is why what not to write in interview notes matters: assume the candidate will read it.
• Other candidates are not. Comparative rankings that name others need redaction.
• Referees and third parties. Consider their rights before disclosing what they said, and where you withhold, say that you have.
• Privileged advice. UK data protection law has an exemption for legally privileged material, and EU countries have their own rules; ask counsel before relying on one. Copying a lawyer on interview notes does not make the notes privileged.
• Recordings. An audio or video file of the interview is in scope. Provide it, or a transcript where the candidate agrees that meets the request.

Reply templates

Acknowledgment

Subject: Your request about your personal data

Hi [name],

Thank you for your request of [date] to [access / delete] the personal data we
hold about you in connection with your application for [role]. We will respond
by [deadline]. [To confirm it is you, please reply from the email address you
used to apply.] If we need more time because the request is complex, we will
tell you before that date and explain why.

[Name], [privacy contact]

Access response

Attached is a copy of the personal data we hold about you: [application,
interview notes and scorecards, interview transcript(s), emails]. We have
removed information about other people where sharing it would affect their
rights. We use this data to [purposes], share it with [recipients], and keep it
until [date / period] because [reason]. You can ask us to correct or delete it,
and you can complain to [regulator].

Deletion response where some records must be kept

We have deleted [categories] from our systems and asked our service providers
to do the same. We are required to keep [application and interview records]
until [date] to meet [record-keeping obligation / to be able to respond to
legal claims]. We will not use them for any other purpose and will delete them
then.

Keeping requests manageable

The teams that handle requests easily are the ones with a retention schedule that is actually applied, a short list of approved places for candidate data, and notes written as if the candidate will read them. The first of those is in the candidate data retention policy template; the notice that tells candidates about their rights in the first place is in the GDPR candidate privacy notice template. For recordings and transcripts specifically under UK law, see recording interviews under UK GDPR.