GDPR Access Request After a Job Rejection

Why a GDPR access request after a job rejection

Most rejections arrive without explanation, and more of them now pass through software first. In October 2026, AFP reported that three former employees of Plus que pro, a French startup, accuse it of having built recruitment software whose AI instructions rejected women, candidates over 55 or under 27, and people with African surnames; one says they complained to the CNIL and the Défenseur des droits. The company says a former employee developed that version against its guidelines and that it was never put into service. The same week, Turkish media covered a UK parliamentary committee report warning that automated recruitment screening can disadvantage ethnic-minority candidates.

You can't see inside an employer's screening software. But in the EU you can ask for the data it produced about you. That is what a GDPR access request — also called a data subject access request, or DSAR — is for. It won't get you the job, but it can tell you what was recorded, which tools were used and whether a person was involved, and it is the starting point for correcting errors or challenging a decision.

What you're entitled to

Under Article 15 of the GDPR, you can ask the employer — and separately any recruitment agency — to confirm whether it processes your personal data and, if so, to give you:

• A copy of the data itself. The EU Court of Justice has ruled that this means a faithful and intelligible reproduction of all your data, including extracts of documents or databases where that is needed to understand them (case C-487/21).
• The purposes of the processing and the categories of data concerned.
• The recipients — for example, the applicant-tracking system, assessment or video-interview provider, or another company in the group.
• How long your data will be kept, or the criteria used to decide.
• Where the data came from, if you didn't provide it — useful if a recruiter found your profile elsewhere.
• Whether automated decision-making was used and, in that case, meaningful information about the logic involved and its consequences for you.

In a hiring process, your personal data can include your CV and application form, screening or ranking scores, online test results, AI or video interview recordings and transcripts, interviewer notes and scorecards about you, and internal emails discussing your application.

Automated rejections and Article 22

Article 22 of the GDPR gives you the right not to be subject to a decision based solely on automated processing that significantly affects you — and a rejection can be such a decision. Where an employer relies on one of the exceptions (for example, that the decision is necessary to enter into a contract, or your explicit consent), it must still let you obtain human intervention, express your point of view and contest the decision.

Two EU court rulings make this right more useful:

• In SCHUFA (C-634/21, December 2023), the Court held that an automatically generated score counts as an automated decision when the company that receives it draws strongly on it to decide. A recruiter who in practice rejects everyone below a set AI score may be in a similar position.
• In Dun & Bradstreet Austria (C-203/22, February 2025), the Court held that "meaningful information about the logic involved" means a concise, intelligible explanation of the procedure and principles actually applied to your data — not a complex formula. If the company claims trade secrets, it must give the information to the data protection authority or court, which decides how much you get.

The EU AI Act adds a right to a clear explanation of the AI's role in decisions based on high-risk systems, which include hiring tools (Article 86) — but only where EU law does not already provide one, so the GDPR remains your main tool. The Act's high-risk obligations for hiring tools apply from 2 December 2027 under the AI Omnibus.

How to send the request

There is no required form. Email works, and the company's privacy notice usually names a contact or data protection officer. A short request is enough:

"Subject: Data access request (Article 15 GDPR). I applied for [role, reference] on [date]. Under Article 15 GDPR, please confirm whether you process my personal data and send me a copy of all personal data relating to my application, including screening scores or rankings, test and assessment results, interview recordings, transcripts and notes. Please also tell me the purposes, the recipients (including software providers), the retention period and, if any automated decision-making was used, meaningful information about the logic involved. Please reply within one month as required by Article 12(3). [Name, email address used to apply]"

• Send it from the email address you applied with; this makes identification easy. The company may ask for more information only if it has reasonable doubts about who you are.
• Keep a copy and note the date: the one-month clock starts when the company receives your request.
• If you applied through an agency or job platform, send a separate request to each of them — each is responsible for its own data.

What you'll get back — and what can be withheld

• Time: an answer without undue delay and within one month. The company may extend by two further months for complex or numerous requests, but must tell you within the first month and explain why.
• Cost: the first copy is free. The Court of Justice confirmed you don't need to give a reason for your request (C-307/22). A reasonable fee is possible only for further copies.
• Other people's rights: the copy must not adversely affect others, so other candidates' data is removed and some details, such as parts of colleagues' internal comments, may be redacted. Redaction should be targeted, not a reason to refuse everything.
• Abuse: a company may refuse or charge only for requests that are manifestly unfounded or excessive, for example repeated ones — and must be able to show that.
• National exceptions: EU countries may restrict access in specific cases, so the details vary slightly by country.

Once you have your data, you can ask for errors to be corrected, ask for deletion when it is no longer needed, or object to keeping your CV for future vacancies.

If they don't reply: complaints and next steps

If a company refuses, it must tell you why within one month and inform you of your right to complain. If it ignores you or gives an incomplete answer, send one reminder, then complain to the data protection authority in your country — the CNIL in France, for example — or in the country where the employer is based. The European Data Protection Board lists every national authority, and complaints are free.

If the data suggests discrimination — for example, filters based on age, sex or origin — you can also contact your national equality body, and in many countries an employment lawyer or trade union can advise you. In the UK, the same right of access applies under the UK GDPR, and complaints go to the ICO.