The hidden complexity of recruitment data
Recruitment agencies are data-intensive businesses. Every candidate interaction generates personal data — from the initial CV submission through interviews, references, and placement. This data often lives in multiple systems and stays on file for years.
GDPR gives candidates the right to access and delete this data. With information spread across your ATS, email, shared drives, and consultant notes, responding within one month requires a systematic approach.
Common DSAR scenarios in recruitment
"Send me everything you have on me"
A candidate wants to see their CV, application history, interview feedback, consultant notes, and any communications about them with clients.
"Delete my data from your systems"
Candidates who found roles elsewhere or want to be removed from your database. You need to delete across all systems while retaining legally required records.
"What feedback did the client give?"
Candidates want to see interview feedback from clients. You may need to balance their rights against client confidentiality.
Placed candidate requests
Someone you placed years ago wants their complete file. You may hold extensive records from the placement process.
Data recruitment agencies hold
Candidate data accumulates across multiple touchpoints
CVs & Applications
Original and reformatted CVs, cover letters
Interview Notes
Screening calls, assessments, consultant observations
Communications
Emails, messages, call logs
References
Reference requests and responses
Payroll Data
For temp/contract workers on your books
Compliance Documents
Right-to-work, ID verification, DBS checks
How SAR Portal helps recruitment agencies
Find data across systems
Upload exports from your ATS, email, and other systems. AI identifies personal data in the files you upload.
Protect client information
When sharing candidate records, AI suggests redactions for other people's details (for example client contacts in correspondence), and you check them before anything is shared. It can also suggest organisation names, depending on the detection setting. Commercially confidential content needs your own review.
Track deletion requests
Document what you deleted and when. Maintain records showing compliance while respecting the right to erasure.
Meet tight deadlines
One-month deadline tracking, with every open request and its due date on one dashboard.