Any candidate can ask for everything you hold on them, at any time, and you have one calendar month to respond. Put these in place now so a request is routine, not a panic.
Know your lawful basis
Record why you hold each candidate's data (usually legitimate interest). You must be able to state it on request.
A privacy notice they actually received
A clear notice, given when you captured their data, that you can produce.
Data in one searchable place
Be able to export a candidate's record in minutes, not hunt across five inboxes, a CRM and a spreadsheet.
A retention rule you follow
A defined period after which data is reviewed or deleted, with evidence you apply it.
A simple SAR process
Who logs the request, the one-month clock, and what to gather, decided before the first one lands.
Redaction discipline
Remove other people's personal data and genuinely confidential references before you send.
A response template
A standard cover response so each SAR isn't drafted from scratch under time pressure.
Most SARs are routine, if you're ready
The 30 days are the same whether you're a solo desk or a 500-person agency. Batiq&Co sets up lawful-basis mapping, retention and an SAR process so a request never derails your week.
Book a 30-min consultationBatiq&Co is a commercial compliance and contracts consultancy, not a law firm. General guidance, not regulated legal advice.