# A candidate has sent a subject access request: the deadline, what a recruitment agency must search and what it can hold back

> A candidate asks for everything you hold on them. The one-month deadline worked on real dates, what to search, what to redact and when you may extend.

- Page to cite: https://aeolookup.com/recruitment/candidate-subject-access-request-recruitment-agency-deadline-what-to-send/
- Publisher: AEO Lookup (https://aeolookup.com/)
- Section: Recruitment agencies, Screening, shortlists and scheduling
- Published 6 October 2026
- Key fact: The ICO's one-month deadline runs to the same date in the next month, moves to the next working day if that falls on a weekend or bank holiday, and for a 31 October request ends on 30 November; worked on five received dates in 2026 and 2027, three of the five deadlines are not the date you would first guess, and a request received on Wednesday 25 November 2026 is not due until Tuesday 29 December 2026 because Christmas Day, the weekend and the substitute Boxing Day all intervene.
- Sources: ICO, "What should we consider when responding to a request?" (right of access guidance, last updated 8 December 2025) and "Subject access request Q and As for employers", both read on ico.org.uk 2026-10-06; GOV.UK "UK bank holidays" (England and Wales), read 2026-10-06. The ICO notes its employer Q and As are under review because of the Data (Use and Access) Act, so check the page before you rely on a detail. Dates and counts are ours. General information, not legal advice.

A candidate emails to say: "Please send me everything you hold about me." That is a subject access request, and the clock starts the day it reaches you. The ICO's guidance says to respond "without undue delay and at the latest within one month of receipt". For a recruitment agency the awkward part is not the deadline. It is that candidate data sits in half a dozen places, and most of them are not your CRM.

## The request does not have to look like one

The ICO's Q and As for employers say the UK GDPR "does not set out formal requirements for a valid request". It can be spoken or written, including through social media. It does not have to use the words "subject access request", "right of access" or "Article 15". A candidate who messages your agency's LinkedIn page asking what you have on file has made a valid request. Anyone on the desk who takes a call or reads a message needs to know to pass it on the same day, because the month runs from receipt, not from when someone in charge notices it.

You can ask for proof of identity, but the ICO says the request for it "should be reasonable and proportionate". If you already know the person, a reply from the email address on their record is usually enough to be going on with. If someone writes on a candidate's behalf, such as a solicitor or a relative, check their authority first.

There is no fee in most cases. The ICO says you may charge a reasonable administrative fee only for a request that is manifestly unfounded or excessive.

## How the month is counted

The ICO's method is to start from the day you receive the request and count to the same date in the next month. Three rules sit on top:

1. If that date falls on a weekend or a public holiday, the deadline moves to the end of the next working day.
2. If the same date does not exist in the next month, use the last day of that month. The ICO's own example is a request received on 31 January, which runs to the end of 28 February (29 in a leap year).
3. You start from the day you receive it, even if that is a Saturday.

Here are five requests worked through, using the England and Wales bank holidays on GOV.UK (25 December 2026 and a substitute Boxing Day on Monday 28 December 2026).

| Received | Same date next month | Deadline | Why |
|---|---|---|---|
| Fri 30 October 2026 | Mon 30 November | **Mon 30 November 2026** | A working day, no adjustment |
| Sat 31 October 2026 | 31 November does not exist | **Mon 30 November 2026** | Last day of the month; it is a Monday |
| Wed 25 November 2026 | Fri 25 December | **Tue 29 December 2026** | Christmas Day, the weekend and the substitute Boxing Day all fall before it |
| Fri 27 November 2026 | Sun 27 December | **Tue 29 December 2026** | Weekend, then the substitute bank holiday on Monday 28 |
| Sun 31 January 2027 | 31 February does not exist | **Mon 1 March 2027** | 28 February 2027 is a Sunday, so it moves one working day |

Notice that two requests received two days apart in November have the same deadline, and that the date you would first guess (25 December, 27 December, 28 February) is wrong in all three of the last rows. Put the deadline in the diary the day the request lands, calculated, not estimated.

## Extending the time, and stopping the clock

You may extend by up to a further two months where the request is complex or the person has sent you several. You have to tell them, and say why, within the first month. An agency that has to dig through a decade of placements for a long-serving temp has a case. One that simply has not looked yet does not.

Separately, if you ask the candidate to clarify what they want, the ICO says the time limit "pauses on the day you request clarification and resumes on the day after you receive it". Use that only where you need it to find the information, for example a candidate with 15 years of history who may only want the last placement. Do not use it to buy time.

## The six places a desk holds candidate data

The search has to be reasonable, which is not the same as the CRM export. Before you reply, check each of these:

| Place | What is typically in it |
|---|---|
| CRM or applicant tracking system | Record, notes, status history, tags, call log |
| Email, shared and personal inboxes | CV submissions to clients, interview feedback, chasers |
| Messaging | WhatsApp, SMS, LinkedIn messages, Teams chats |
| Timesheet and payroll system | Hours, pay, tax code, bank details (temps) |
| Compliance folder | Right to work copies, DBS outcome, references |
| Client-side exchanges | What you sent a client about the person, and what the client said back |

Emails and chats do not all have to go out whole. The ICO says you may need to disclose "some or all" of an email depending on whether it contains the person's personal information. Your own internal comment on a candidate, such as "good on paper, poor on the phone", is their data if it is about them, and it can be a surprise to the consultant who wrote it. That is a reason to keep notes factual, and it is dealt with from the other direction in our guide to [using ChatGPT for recruitment tasks](https://aeolookup.com/recruitment/chatgpt-for-recruiters-uk-gdpr-prompts-ai-policy/).

## What you can hold back

- **Other people's information.** Redact anything that identifies someone else unless they consent or it is reasonable to disclose without their consent. A client contact's name on an email you forward is the usual case.
- **Confidential references.** The ICO says a reference given in confidence for employment purposes is exempt, whether you gave it or received it. That is useful, because candidates often ask for the reference a former employer gave you.

You cannot hold back a record because it is embarrassing, and you cannot refuse because the candidate is in dispute with you over a fee.

## Records you cannot delete in a hurry

A request to see data is not a request to delete it, and an agency often has to keep right to work evidence and temp pay records for set periods. Keep the two apart, and see how long you have to keep [recruitment agency records](https://aeolookup.com/recruitment/how-long-must-recruitment-agency-keep-records/) before anyone starts clearing files. If software scored the CV you hold, the rules on automated screening are in [AI CV screening and the ICO's rules](https://aeolookup.com/recruitment/ai-cv-screening-ico-rules-recruitment-agencies/).

## A routine that stops it going wrong

1. Log the request with the date and time received, the channel and who received it.
2. Work out the deadline using the table above and put it in the diary.
3. Confirm identity only if you genuinely need to.
4. Search the six places and keep a note of what you searched.
5. Redact third-party data and confidential references, and keep a copy of what you sent.
6. Reply before the deadline, with the data in a clear format and a short note of what was withheld and why.

Overlyft ![](https://aeolookup.com/img/d/ours-badge.png) builds AI staff for recruitment agencies, and a request tracker is a typical first job: one that logs every request from any inbox, works the deadline, searches the CRM and shared mailbox, and puts a draft pack with proposed redactions in front of the person who signs it off. A person approves what goes out. This is general information about the published guidance, not legal advice.

---
![](https://aeolookup.com/img/d/owner-line.png)

General information for UK small firms, not legal, tax or financial advice.