DEV Community

Xeito
Xeito

Posted on Originally published at xeito.ai

GDPR access request after a rejection or ghosting: a developer's guide (2026)

#gdpr #accessrequest #article15 #righttoerasure

A GDPR access request is a written request, under Article 15 of Regulation (EU) 2016/679, asking an organisation to confirm whether it processes your personal data and to give you a copy and the surrounding information. If a company rejected you, or went silent after your last interview, it probably still holds your CV, your contact details and its internal notes about you, and you are entitled to ask to see them. If it has deleted them, it must still confirm whether it processes any data about you.

TL;DR:

  • Access (Art. 15): you get a copy of your data plus purposes, categories, recipients, the planned storage period, the source of the data and any automated decision-making information.
  • Erasure (Art. 17): you can ask the company to delete your data when, for example, it is no longer necessary for the purposes it was collected for or it was processed unlawfully. It has exceptions, including legal claims.
  • Clock (Art. 12(3)): one month from receipt, extendable by two further months only if the company tells you why within the first month.
  • Cost (Art. 12(5)): free of charge, unless the request is manifestly unfounded or excessive.
  • No reason needed, no form required: the EDPB says so explicitly in its right-of-access guidelines.

Why a developer would bother

A rejection email usually tells you nothing. A ghosting tells you even less. An access request is one of the few tools that makes a company produce something concrete: what it recorded about you, where it got it from and who it shared it with.

Reasons people actually send one:

  • You want to know what the company kept from your interviews, including internal evaluation notes and any scoring.
  • You suspect an automated filter rejected you and want to know whether the company says it made an automated decision (Art. 15(1)(h)).
  • You sent a CV, a take-home or a portfolio and want to know it is not sitting in a database indefinitely.
  • You want the company to delete everything after a bad process.

None of these requires a justification. The EDPB's Guidelines 01/2022 state that the data subject does not have to give reasons for an access request, and that it is not up to the controller to assess whether the request will help you (EDPB, Guidelines 01/2022 on data subject rights, right of access, version 2.1, adopted 28 March 2023).

Step 1: work out who the controller is

The right is exercised against the controller, the organisation that decides why and how your data is processed. For a direct application that is usually the employer you applied to. If you applied through a recruiter or an application platform, it can be more than one party, and a processor can answer on the controller's behalf where the contract between them provides for it (as the Spanish authority, the AEPD, explains on its page on exercising rights).

Look for the privacy notice on the company's careers page. Under Articles 13 and 14 the notice should name the controller and, where applicable, give the contact details of the data protection officer (DPO). Art. 38(4) says data subjects may contact the DPO about all issues related to processing and the exercise of their rights, so the DPO address, if there is one, is a good place to send the request.

The EDPB guidelines say there is no required format, and that you are not obliged to use the company's own request channel: you may send the request to an official contact point of the controller. They also say a controller is not obliged to act on requests sent to completely random or obviously wrong addresses. Use the privacy contact, the DPO or the recruiting contact named in the privacy notice, not a stray employee's inbox.

Step 2: write the request

Keep it short, with everything the company needs on the first screen:

  1. Who you are, with enough detail to find you: full name, the email address you applied from, the role and the approximate dates.
  2. What you ask for: confirmation of whether the company processes your personal data, a copy of it, and the information listed in Art. 15(1)(a) to (h) and, if relevant, Art. 15(2).
  3. The legal basis: Art. 15 GDPR, with the one-month deadline under Art. 12(3).
  4. A preferred format: where you send the request by electronic means and do not ask otherwise, Art. 15(3) says the copy must be provided in a commonly used electronic form.
  5. A date: write the date you send it and keep proof of sending and, if you can, of delivery (a read receipt, a ticket number or an acknowledgement), because the clock runs from the company's receipt.

What Art. 15(1) says you can obtain, as a checklist to paste into your request:

Art. 15 item What to ask for
(a) The purposes of the processing
(b) The categories of personal data
(c) Recipients or categories of recipient, including in third countries
(d) The planned storage period, or the criteria used to set it
(e) Your rights to rectification, erasure, restriction and objection
(f) Your right to lodge a complaint with a supervisory authority
(g) The source of the data, where it was not collected from you
(h) Existence of automated decision-making, including profiling, under Art. 22(1) and (4), and meaningful information about the logic involved and its significance and consequences for you

Item (g) matters if a recruiter found you on a public profile or a third party passed your CV on. Item (h) is the one to include if you suspect a screening tool.

The AEPD publishes a form for the right of access (linked from its page on the derecho de acceso), which is useful as a template even if your request goes to a company in another Member State.

Step 3: understand the one-month clock

Article 12(3) is the sentence that matters. The controller must provide information on the action taken on your request without undue delay and in any event within one month of receipt. The period may be extended by two further months where necessary, taking into account the complexity and number of requests, and the controller must inform you of the extension, with the reasons, within the first month.

Two practical consequences:

  • The clock starts on receipt, not on the day you feel you should have heard back. Keep the sent email or the delivery receipt.
  • Silence is not an extension. An extension only counts if the company told you about it, with reasons, inside the first month. Art. 12(4) adds that if the controller decides not to act at all, it must tell you within one month why, and about your right to complain to a supervisory authority and to seek a judicial remedy.

Art. 12(6) lets the company ask for additional information if it has reasonable doubts about who you are. The EDPB guidelines say such a request must be proportionate. If you get a reply asking for ID, give what is reasonably needed and no more.

Step 4: decide whether to ask for erasure

Article 17 gives you the right to have your data erased without undue delay where one of the listed grounds applies. For a rejected applicant, the grounds most likely to apply are that the data is no longer necessary for the purposes it was collected for (Art. 17(1)(a)), or that it was unlawfully processed (Art. 17(1)(d)). If the company relied on your consent for keeping you in a talent pool and you withdraw it, Art. 17(1)(b) applies where there is no other legal ground.

The right is not absolute. Art. 17(3) lists exceptions, including where processing is necessary for the establishment, exercise or defence of legal claims (Art. 17(3)(e)). A company may point to that when it holds interview records, but the exception covers only what is actually needed for a claim, and only for as long as such a claim could still be brought. It must still tell you what it is doing and why, under the same Art. 12 deadlines, because Art. 12(3) applies to requests under Arts. 15 to 22.

Order matters. If you send an erasure request together with an access request, the company may act on the erasure first, and the data you wanted to see may then be gone. (The EDPB says a controller must not delete data to avoid answering an access request, and in its own job-application example says access comes first and deletion afterwards; Guidelines 01/2022, para. 39.) To be safe, do one of these:

  • Send the access request first and the erasure request after you have the answer, or
  • Ask for both in one message and state that the copy under Art. 15 must be provided before erasure is carried out.

This is practical advice, not something the Regulation requires: it follows from the fact that erasure removes the material an access request would show you.

Step 5: when the company does not answer, or answers badly

If the one-month period (or an extension you were told about) has passed, a short factual reminder that quotes the date of receipt and Art. 12(3) is the usual first step.

That reminder is practical sequencing, not a legal precondition. Art. 77(1) gives you the right to lodge a complaint with a supervisory authority, in particular in the Member State of your habitual residence, your place of work or the place of the alleged infringement. The authority must inform you of the progress and outcome of the complaint, including the possibility of a judicial remedy (Art. 77(2)). If the authority does not handle the complaint or does not inform you within three months, Art. 78(2) gives you a right to an effective judicial remedy against the authority.

The EDPB lists the national authorities of the EU and EEA, with links, on its "Our members" page. In Spain that authority is the AEPD.

Things to put in a complaint: the dates, a copy of your request, proof it was received, any reply and the missing items you expected under Art. 15(1).

Related articles

FAQ

How long does a company have to answer a GDPR access request?

One month from receipt of the request (Art. 12(3) GDPR). The controller can extend that by two further months where necessary, but it must tell you about the extension and the reasons within the first month.

Do I have to explain why I want my data?

No. The EDPB's Guidelines 01/2022 say the data subject does not have to give reasons and that the controller should not assess whether the request will help you.

Can a company charge me for an access request?

Not normally. Art. 12(5) says information and actions under Arts. 15 to 22 are free of charge. A reasonable fee or a refusal is possible only if the request is manifestly unfounded or excessive, and the controller bears the burden of showing it. The controller may charge a reasonable fee for further copies (Art. 15(3)).

Should I ask for access and erasure in the same email?

Safer to ask for access first. If you want both at once, say explicitly that the copy must be provided before the data is deleted.

What if the company ignores my request?

Send a short reminder citing the date of receipt and Art. 12(3). You can lodge a complaint with a supervisory authority at any time under Art. 77, in practice with your original request and the missing or inadequate answer.

Sources

This article describes general EU data-protection rules for informational purposes. It is not legal advice. How a request is handled depends on the controller, the Member State and your facts; if you are in a dispute, speak to a lawyer or your national data protection authority.

An access request is easier when you can say which company, which role and when. If you apply to a lot of companies, Xeito keeps one record per application with the company name, one of seven statuses (interested, applied, phone screen, technical interview, on-site interview, offer, rejected) and free-text notes, and it records the applied date when you mark a job as applied through Xeito. It does not generate or send access or erasure requests; it is a record of your own applications, not a legal tool.

Top comments (0)