You apply. A few weeks later, a template email arrives. "We have decided to move forward with other candidates." That is the entire information transfer. You do not know which system processed your CV, whether a human read it, what score it was assigned, or how long your data will be kept.
The rejection is not the end of the process for your data. It is the beginning of a retention period that can last months or years, during which a company holds your employment history, your contact details, and often the documents you submitted.
GDPR Article 15 gives you the right to request everything a company holds about you. One email, addressed to the data protection officer, citing Article 15. Within one month, they must respond.
I have sent more than fifteen of these requests over the past several months, all to companies that rejected my application. Here is what I have learned.
What you actually get back
Responses vary more than you would expect. Some companies provide a complete data export: your CV as submitted, the application record with its timestamps, internal notes if any exist, the name of the ATS platform, and a retention schedule. Others respond with a boilerplate denial claiming they hold nothing beyond what you submitted, which is rarely accurate. A few miss the one-month deadline entirely, which is itself a violation.
The most useful responses are the detailed ones. They name the system that handled your application. They list every data field stored against your profile. In several cases they included an application status field I had no access to as a candidate, with values like "Processed", "Reviewed", or a numeric score. One response confirmed automated CV parsing had occurred and named the sub-processor responsible. Another revealed the application had been marked as a duplicate because I had applied to a different role at the same company two years earlier.
What to look for
The system name matters. Knowing that a company uses SAP SuccessFactors, Workday, or Lever tells you which data model your application lives in, how long it is typically retained by default, and whether the platform's own privacy documentation describes any automated scoring. That information is not available anywhere on the company's career site.
The processing description matters more. GDPR Article 15(1)(h) requires companies to disclose "the existence of automated decision-making, including profiling". If a company's response says no automated processing occurred, but the data export shows a CV parsing timestamp and a structured keyword extraction field, those two claims do not agree. I have seen this gap in more than one response.
The retention schedule tells you when your data will be deleted. This is useful to know before you reapply. If a company retains rejected candidate data for three years, applying again in year two means your previous application status is already on file.
What happens when the process goes wrong
The month deadline is a hard legal requirement under Article 12(3). A company that fails to respond in time can be reported to the relevant data protection authority. A company that deletes your data after receiving your request but before fulfilling it has potentially compounded the problem: you requested access, they deleted the data you requested access to, which is precisely what Article 15 exists to prevent.
I have encountered both. Neither situation resolved itself without a formal follow-up.
How to send the request
The email itself is simple. Address it to the company's data protection officer or, if no DPO is listed, to the privacy contact in their policy. State that you are exercising your rights under GDPR Article 15 and request all personal data held about you, including the legal basis for processing, the retention period, whether automated processing occurred, and the identity of any sub-processors who received your data.
Keep the email and the date you sent it. The clock starts on receipt.
Why this is worth doing
The practical value is intelligence. After enough responses, patterns emerge. Certain ATS platforms handle data systematically and respond clearly. Others are inconsistent. Companies that run a careful process tend to provide detailed, prompt responses. Companies that do not tend to respond late, incompletely, or not at all.
A rejection is a data point about a role. The SAR response is a data point about a company.