A candidate has sent a subject access request: the deadline, what a recruitment agency must search and what it can hold back

A candidate emails to say: "Please send me everything you hold about me." That is a subject access request, and the clock starts the day it reaches you. The ICO's guidance says to respond "without undue delay and at the latest within one month of receipt". For a recruitment agency the awkward part is not the deadline. It is that candidate data sits in half a dozen places, and most of them are not your CRM.

The request does not have to look like one

The ICO's Q and As for employers say the UK GDPR "does not set out formal requirements for a valid request". It can be spoken or written, including through social media. It does not have to use the words "subject access request", "right of access" or "Article 15". A candidate who messages your agency's LinkedIn page asking what you have on file has made a valid request. Anyone on the desk who takes a call or reads a message needs to know to pass it on the same day, because the month runs from receipt, not from when someone in charge notices it.

You can ask for proof of identity, but the ICO says the request for it "should be reasonable and proportionate". If you already know the person, a reply from the email address on their record is usually enough to be going on with. If someone writes on a candidate's behalf, such as a solicitor or a relative, check their authority first.

There is no fee in most cases. The ICO says you may charge a reasonable administrative fee only for a request that is manifestly unfounded or excessive.

How the month is counted

The ICO's method is to start from the day you receive the request and count to the same date in the next month. Three rules sit on top:

1. If that date falls on a weekend or a public holiday, the deadline moves to the end of the next working day.
2. If the same date does not exist in the next month, use the last day of that month. The ICO's own example is a request received on 31 January, which runs to the end of 28 February (29 in a leap year).
3. You start from the day you receive it, even if that is a Saturday.

Here are five requests worked through, using the England and Wales bank holidays on GOV.UK (25 December 2026 and a substitute Boxing Day on Monday 28 December 2026).

Notice that two requests received two days apart in November have the same deadline, and that the date you would first guess (25 December, 27 December, 28 February) is wrong in all three of the last rows. Put the deadline in the diary the day the request lands, calculated, not estimated.

Extending the time, and stopping the clock

You may extend by up to a further two months where the request is complex or the person has sent you several. You have to tell them, and say why, within the first month. An agency that has to dig through a decade of placements for a long-serving temp has a case. One that simply has not looked yet does not.

Separately, if you ask the candidate to clarify what they want, the ICO says the time limit "pauses on the day you request clarification and resumes on the day after you receive it". Use that only where you need it to find the information, for example a candidate with 15 years of history who may only want the last placement. Do not use it to buy time.

The six places a desk holds candidate data

The search has to be reasonable, which is not the same as the CRM export. Before you reply, check each of these:

Emails and chats do not all have to go out whole. The ICO says you may need to disclose "some or all" of an email depending on whether it contains the person's personal information. Your own internal comment on a candidate, such as "good on paper, poor on the phone", is their data if it is about them, and it can be a surprise to the consultant who wrote it. That is a reason to keep notes factual, and it is dealt with from the other direction in our guide to using ChatGPT for recruitment tasks.

What you can hold back

• Other people's information. Redact anything that identifies someone else unless they consent or it is reasonable to disclose without their consent. A client contact's name on an email you forward is the usual case.
• Confidential references. The ICO says a reference given in confidence for employment purposes is exempt, whether you gave it or received it. That is useful, because candidates often ask for the reference a former employer gave you.

You cannot hold back a record because it is embarrassing, and you cannot refuse because the candidate is in dispute with you over a fee.

Records you cannot delete in a hurry

A request to see data is not a request to delete it, and an agency often has to keep right to work evidence and temp pay records for set periods. Keep the two apart, and see how long you have to keep recruitment agency records before anyone starts clearing files. If software scored the CV you hold, the rules on automated screening are in AI CV screening and the ICO's rules.

A routine that stops it going wrong

1. Log the request with the date and time received, the channel and who received it.
2. Work out the deadline using the table above and put it in the diary.
3. Confirm identity only if you genuinely need to.
4. Search the six places and keep a note of what you searched.
5. Redact third-party data and confidential references, and keep a copy of what you sent.
6. Reply before the deadline, with the data in a clear format and a short note of what was withheld and why.

Overlyft builds AI staff for recruitment agencies, and a request tracker is a typical first job: one that logs every request from any inbox, works the deadline, searches the CRM and shared mailbox, and puts a draft pack with proposed redactions in front of the person who signs it off. A person approves what goes out. This is general information about the published guidance, not legal advice.