Subject Access Requests Are Surging
Under GDPR Article 15, every candidate has the right to request a copy of all personal data you hold about them. These Subject Access Requests (SARs) have risen sharply: a 2024 report by the UK ICO noted a 36% year-over-year increase in SAR complaints. For organisations running video interviews at scale, this creates an operational challenge, especially since you have only 30 calendar days to respond.
What Candidates Can Request
A valid SAR entitles the candidate to:
- A copy of all personal data you process about them
- Information about the purposes of processing
- The categories of data concerned
- Recipients to whom data has been disclosed
- The retention period or criteria
- The existence of automated decision-making, including profiling, and meaningful information about the logic involved
For video interviews, this includes the video recordings themselves, text responses, AI-generated scores or transcripts, evaluator notes, and any metadata.
Step-by-Step SAR Handling Process
- Acknowledge receipt immediately. Confirm you received the request and will respond within 30 days. This is not a legal requirement but best practice.
- Verify the requester’s identity. Ask for enough information to confirm the person is who they claim to be, without requesting excessive data.
- Search all systems. Video interview platforms, ATS, email, shared drives, evaluation spreadsheets, all are in scope.
- Review for third-party data. Redact information about other individuals (e.g., interviewer names in evaluation notes may need anonymisation).
- Compile and deliver securely. Provide the data in a commonly used, machine-readable format. Use a secure delivery method, not unencrypted email.
- Document everything. Record the request, your actions, and the response for accountability.
The 30-Day Deadline: Extensions and Exceptions
You can extend the deadline by an additional 60 days for complex or numerous requests, but you must inform the candidate within the initial 30-day period and explain the reason for the delay. Requests that are “manifestly unfounded or excessive” can be refused, but the bar is high and the burden of proof is on you.
Common Mistakes That Draw Regulatory Attention
- Missing the 30-day deadline entirely
- Providing incomplete data (forgetting video recordings or AI scores)
- Charging a fee without justification (SARs are free under GDPR)
- Failing to search all relevant systems
- Not documenting the process
How StormInterview Streamlines SAR Fulfilment
StormInterview provides a dedicated SAR export feature in the admin dashboard. With two clicks, you can generate a complete data package for any candidate, including video recordings, transcripts, AI analysis, evaluations, and metadata, in a machine-readable format. Audit logs are maintained automatically.
All of this is included at €79/month. No enterprise upgrade needed.