---
title: A subject access request arrives on a Friday
description: "Someone asks what your agency holds about them. A practical runbook: where to look, what recruiter notes mean for you, and the deadline you are working to."
---

[Echo Recruit blog](https://www.echorecruit.com/blog)

# [A subject access request arrives on a Friday](https://www.echorecruit.com/blog/a-subject-access-request-arrives-on-a-friday)

 Written by [Echo Recruit](https://www.echorecruit.com/blog/author/echo-recruit) | Oct 1, 2026, 5:39:58 AM

*“Please send me all the personal data you hold about me.” One sentence, no explanation required, and a clock starts.*

In short

- A request does not have to use the words “subject access request”, be in writing, or go to a particular address. It counts from when anyone at your agency receives it.
- The database is the easy part. The time goes on mailboxes, exports, notes and whatever a recruiter saved locally.
- Recruiter notes are disclosable. That fact should change what goes in them, starting before you ever receive a request.
- You may need to redact other people — a note naming a client contact contains their data too.

Most agencies handle their first access request badly, and not out of bad faith. They handle it badly because nobody has ever done one, the deadline is shorter than it sounds, and the data turns out to be in nine places rather than one.

This is a practical runbook. It is not legal advice, the specifics differ by jurisdiction, and if you place people across borders the details vary — but the shape of the work is much the same everywhere, and having done it once on paper makes the real one manageable.

## Recognise it

The commonest failure is not recognising the request at all. Under the UK and EU GDPR a request can be made verbally or in writing, to anyone in the organisation, and need not mention any particular phrase. “What have you got on me?” said on a phone call to a recruiter is capable of starting the clock.

The deadline is generally one month from receipt, extendable in limited circumstances for complex requests. The practical consequence: **the clock may already have been running for a week before it reaches anyone who knows what to do.**

Two cheap protections. Tell everyone who speaks to candidates what one looks like and where to forward it — a single line in induction is enough. And publish an address for it in your privacy notice, so most arrive somewhere sensible.

## Where the data actually is

The instinct is to export the candidate record and send it. That is the first ten percent. Personal data is anything from which the person can be identified, and in a recruitment agency it is scattered:

- **The candidate record** — contact details, parsed CV, applications, stage history, scores
- **Documents in storage** — the CV itself, right-to-work scans, certificates
- **Recruiter notes and call logs** — free text, and the part people forget
- **Email and messages** — including internal threads *about* them, not just correspondence with them
- **Interview scorecards and feedback**, including the client's if you hold it
- **Payroll and timesheet records**, if they were ever placed
- **Exports** — the spreadsheet someone downloaded to work on at the weekend, which is outside every control you have

Internal email is where the days go. A search across mailboxes for a name and an address is the single most time-consuming step, and the one most likely to surface something you would rather had not been written.

## The runbook

1. **1Log it and acknowledge the same day**Record the date received — that is the date the clock started, not the date it reached the right person. Acknowledge, and say when they will hear back.
2. **2Verify who you are talking to**Proportionately. If the request comes from the address already on the record, that is usually enough; if it comes from an unfamiliar address claiming to be a candidate, ask for something reasonable. Do not use verification as a delaying tactic, and do not demand a passport scan for a request about a CV — you would be collecting more sensitive data than you hold.
3. **3Search every system on your list**Use the list you built when you mapped where data lives. Search on name, every email address you hold, and phone number — people apply from more than one address, which is also why duplicate records matter here.
4. **4Review for third parties**A note saying “spoke to Priya at Northwind, she thought he was light on controls experience” contains Priya's personal data as well. You generally cannot disclose another identifiable person's data without consent or another basis, so redact or summarise. This step takes judgement and is the reason a request cannot simply be an automated export.
5. **5Send it with the explanation**Not a raw database dump. A readable pack, plus the things the law expects you to tell them: why you hold it, who you have shared it with, how long you keep it, where it came from if not from them, and their other rights. Send it securely.
6. **6Record what you sent**Keep a copy of the pack and the date. If they follow up — and an access request is quite often the step before an erasure request or a complaint — you need to know exactly what was disclosed.

## Notes are disclosable. Write them accordingly.

The single most useful thing to take from this: recruiter notes are personal data, and the person can ask to see them.

That is not an argument for keeping no notes. Notes are how a desk works, and a candidate record with no history is useless. It is an argument for writing notes you would be comfortable showing the person — which, conveniently, are also better notes.

- **Observations, not verdicts on character.** “Asked for £75k, would consider £70k for remote” is useful and fine. “Difficult, bit of an ego” is neither.
- **Reasons tied to the requirement.** “No production experience with the stack” beats “not a fit” — and it is also the note that defends the decision if the rejection is ever questioned.
- **Nothing about protected characteristics**, or anything adjacent to them. Notes about family plans, health or age are a problem in a disclosure pack and a much larger problem in a discrimination claim.

Run one as a drill. Pick a candidate placed two years ago, and have someone assemble everything you hold on them as if the request were real. Time it. The drill costs an afternoon and tells you which system is the bottleneck while the answer still has no deadline attached.

## What usually goes wrong

**The clock started earlier than you think.** It runs from receipt by the organisation, not by the right person.

**Somebody deletes something.** Tidying a record after a request arrives is the worst possible instinct — it converts an administrative task into something far more serious. Freeze the record instead.

**The duplicate record is missed.** You search the address they wrote from and find one record; a second exists under an old work address. Deduplication is a data protection control as much as a hygiene one.

**Nobody can say what is held or for how long.** Which is the same underlying gap as not having decided a retention period — the request just makes it visible.

In Echo Recruit

One workspace to search, not nine

Candidate records, applications, evaluations, documents and message history sit in one workspace scoped by row-level security, so the search step is a lookup rather than an expedition. CVs live in private storage served by signed links that expire in five minutes, and retention is enforced by a scheduled sweep that deletes the file before clearing the pointer — so there is no orphaned document sitting outside any record. Applications deduplicate against the pool on arrival, which is what stops a second record being missed.

## Common questions

How long does an agency have to answer a subject access request?

Generally one month from receipt, extendable in limited circumstances for complex requests. The clock runs from receipt by the organisation, not by the person who knows what to do — so it may already have been running a week before it reaches them. This is a practical runbook, not legal advice, and specifics differ by jurisdiction.

Does a subject access request have to be in writing?

No. Under the UK and EU GDPR it can be made verbally or in writing, to anyone in the organisation, and need not use any particular phrase. “What have you got on me?” said on a call to a recruiter is capable of starting the clock. Tell everyone who speaks to candidates what one looks like and where to forward it.

Are recruiter notes disclosable?

Yes — recruiter notes are personal data and the person can ask to see them. That is not an argument for keeping no notes; it is an argument for writing notes you would be comfortable showing the person. Observations rather than verdicts on character, reasons tied to the requirement, and nothing about protected characteristics.

[View full post](https://www.echorecruit.com/blog/a-subject-access-request-arrives-on-a-friday)

```json
{
  "@context" : "http://schema.org",
  "@type" : "BlogPosting",
  "author" : {
    "@type" : "Person",
    "name" : "Echo Recruit"
  },
  "dateModified" : "2026-10-01T05:39:58.264Z",
  "datePublished" : "2026-10-01T05:39:58Z",
  "headline" : "A subject access request arrives on a Friday",
  "image" : {
    "@type" : "ImageObject",
    "height" : 60,
    "url" : "/hs/hsstatic/content_shared_assets/static-1.4092/img/default-amp-logo.png",
    "width" : 60
  },
  "mainEntityOfPage" : "https://www.echorecruit.com/blog/a-subject-access-request-arrives-on-a-friday",
  "publisher" : {
    "@type" : "Organization",
    "logo" : {
      "@type" : "ImageObject",
      "height" : 60.0,
      "url" : "https://www.echorecruit.com/hubfs/echo-recruit-avatar-green-400.png",
      "width" : 60.000004
    },
    "name" : "Echo Recruit blog"
  }
}
```