Handling a candidate’s request for their data

What’s automatic#

• The candidate chooses Request my data on their status page. The secure link they followed counts as verifying who they are, and asking again joins the request that’s open.
• Your admins are emailed.
• OpenATS drafts the response: an explanation of how their data is used, written from your workspace’s privacy notice, and everything you hold about them.

What an admin does#

1. 1

   Step 1: Open Settings → Data & privacy → Candidate access requests → Open access request queue.

   Or, from the candidate, More application actions → Manage candidate access requests.

2. 2

   Step 2: Fill in your privacy notice the first time.

   Who the controller is, why you process data, who receives it, how long you keep it, transfers, and the candidate’s rights. It’s reused for every request.

3. 3

   Step 3: Read the draft.

   It can’t be marked reviewed while it still has a [Reviewer: …] note in it. Confirm their identity and the review.

4. 4

   Step 4: Choose Mark response reviewed, then Release to candidate portal.

   Or download it, send it another way, and choose Record completed delivery.

The candidate then downloads an explanation of how their data is used (a text file), everything you hold about them (JSON), and their files.