Recruiting firm · Compliance
Candidate data request
Answer a candidate's request to see, correct or delete their personal data on time and in full. The candidate confirms what the request covers through a shared link, every system is searched, and nothing is sent or deleted until the data protection lead approves the response.
- Duration: Up to one month
- How often: For every candidate data request
- Steps: 10 steps
- AI agents: 1 AI agent
- Approvals: 1 approval
Free plan, no credit card needed.
What changes with this template
Without it
Data requests land in a recruiter's inbox and are forgotten.
Someone searches the database and misses old emails and spreadsheets.
Records are deleted before anyone checks what must be kept.
Every response is written from scratch.
With it
Every request is logged with its due date the day it arrives.
The search covers every system and every client the candidate was sent to.
Nothing is deleted until the data protection lead approves the response.
An AI agent drafts the response from the findings, and the data protection lead checks it.
The template, step by step
Each step says who does it: someone on your team, an AI agent, or the client through a shared link. An approval keeps every later step locked until it is given.
- Done by your team
- Done by an AI agent
- Done by the client, through a shared link
Starts when
A candidate asks to see, correct or delete the personal data you hold about them. The data protection lead starts a run with the request and the date it arrived.
- 1
Log the request
Day 1Data protection lead · Team
Record who is asking, what kind of request it is and when it arrived, set the response due date, and send the candidate the shared link.
Checklist
- Receipt acknowledged to the candidate
- Shared link sent to the candidate
Fields to fill in
- Candidate name (required)
- Request type (required)
- Date received (required)
- Response due by (required)
- 2
Candidate confirms the request
Days 1 to 3Candidate · Shared link
Through the shared link, the candidate confirms what the request covers and the email addresses and phone numbers they may be on file under, so every record can be found.
Checklist
- Request details confirmed
- Contact details for the reply confirmed
Fields to fill in
- What the request covers (required)
- Email addresses used (required)
- Phone numbers used
- 3
Verify the candidate's identity
Days 2 to 4Data protection lead · Team
Confirm the person asking is the candidate, using details you already hold where you can, before anything is searched or shared.
Checklist
- Identity confirmed against details on file
- No more identity documents asked for than needed
Fields to fill in
- How identity was verified (required)
- 4
Find the candidate's data in every system
Week 1Recruiting coordinator · Team
Search the applicant tracking system, inboxes, shared drives, spreadsheets and job board accounts, and list what you hold, where, and which clients received it.
Checklist
- Applicant tracking system searched
- Inboxes and shared drives searched
- Spreadsheets and job board accounts searched
Fields to fill in
- Data found and where (required)
- Clients the candidate was submitted to
- 5
Decide what must be kept
Week 2Data protection lead · Team
For each record, decide whether it must be kept for a legal reason, such as a live dispute or tax records, or can be corrected or deleted as asked.
Checklist
- Legal reasons to keep checked
- Clients to be told of changes listed
Fields to fill in
- Records to keep and why (required)
- Records to correct or delete (required)
- 6
Draft the response
Week 2Response drafter · AI agent
The response drafter writes the reply from the request, the data found and the decisions in step 5: what you hold and why, who received it, and what you will correct or delete.
Fields to fill in
- Draft response (required)
Checked by: The data protection lead checks the draft against the data found and approves it in step 7.
- 7
Approve the response
Week 2Data protection lead · Team
Check the draft against the data found, remove anything about other people, and approve it.
Checklist
- Every system from step 4 covered
- No data about other people in the response
- Due date can still be met
Approval: Nothing is deleted or sent to the candidate until the data protection lead approves the response.
- 8
Correct or delete the data
Weeks 2 to 3Recruiting coordinator · Team
Make the approved corrections and deletions in every system, and tell the clients who received the candidate's details where that is required.
Checklist
- Changes made in every system
- Clients told where required
- Do-not-contact note kept if the candidate asked
Fields to fill in
- Completed on (required)
- 9
Send the response
Before the due dateData protection lead · Team
Send the approved response to the candidate in a secure way before the due date, and record when it went.
Checklist
- Sent securely
- Sent before the due date
Fields to fill in
- Response sent on (required)
- 10
Candidate confirms receipt
After the responseCandidate · Shared link
Through the shared link, the candidate confirms they received the response, or notes what they think is missing.
Fields to fill in
- Response received (required)
- Anything missing
Done when
The candidate has the approved response before the due date, corrections and deletions are made in every system, and the run records what was done and why.
Make it yours. Rename steps, change owners and add checklist items, fields or approvals. The template is a starting point for the way your team works.
The AI agents in this template
An agent only works on its own steps, and a person on your team checks what it did. Anything an agent writes to a connected app waits for approval unless you allow it.
Response drafter
Writes the reply to the candidate from the request, the data found and the decisions recorded on the run.
What it does
- Reads the request, the data found and the records to keep
- Follows the response outline in its step instructions
- Writes the draft response into its step
- Flags any part of the request left unanswered
Checked by: The data protection lead checks the draft against the data found and approves it in step 7.
Questions this template answers
Log the request the day it arrives, confirm who is asking and search every system before you answer. Steps 1 to 4 log the request, collect the candidate's details through the shared link, verify their identity and list every record you hold.
List every place the candidate's data lives, including inboxes and the clients you sent it to, before deleting anything. Step 4 lists the data and the clients, and step 8 makes the approved deletions and tells clients where required.
Set the due date the day the request arrives, usually one month under GDPR, and keep it in view on the run. Step 1 records the date received and the due date, and step 7 checks the deadline before the response is approved.
Check each record for a legal reason to keep it before you correct or delete it. In step 5 the data protection lead records what stays and why, and the response drafted in step 6 explains it to the candidate.
Let AI draft the reply from what your team found and decided, and have the data protection lead check it. The response drafter writes the reply in step 6, and step 7 is an approval gate before anything is sent or deleted.
Use details you already hold where you can, rather than collecting new identity documents. Step 3 records how the data protection lead verified the candidate, before step 4 searches for any data.
Run this workflow in OKiDO
Set up the steps, owners and approvals once, then start a run for every new case.