Recruitment Agency Achieves 100% DSAR Compliance After Near-Fine

The Challenge

TechRecruit Partners (name changed) is a specialist IT recruitment agency placing contractors and permanent staff across Ireland and the UK. They handle thousands of candidate records annually.

The GDPR Problem:

Recruitment is a data-intensive business. For every placement, TechRecruit held:

• Original and reformatted CVs
• Interview notes and assessments
• Email correspondence with candidates and clients
• Reference check documentation
• Right-to-work verification documents

When candidates exercised their GDPR rights, finding and preparing this data was a nightmare.

The Wake-Up Call

In late 2024, TechRecruit received a letter from the DPC regarding a complaint. A former candidate claimed they:

1. Responded late to their access request (34 days instead of 30)
2. Failed to include interview feedback notes
3. Didn’t redact a client’s name from correspondence

The DPC gave them 21 days to demonstrate improved processes or face formal investigation.

“That letter changed everything. We realised we’d been lucky not to be fined already.” — Managing Director

The Urgent Solution

TechRecruit needed a solution they could implement immediately. They chose SAR Portal’s Pro plan for its higher capacity and advanced features.

Implementation Timeline:

Day 1: Account setup, team training Day 2-3: Created workflows for different request types Day 7: First DSAR processed through new system Day 21: Demonstrated new process to DPC — case closed

How SAR Portal Solved Their Problems

Problem 1: Data Scattered Everywhere

Solution: Standardised export and upload process

Staff now export candidate data from their ATS, email, and shared drives, then upload everything to SAR Portal. The AI scans all documents regardless of format.

Problem 2: Redacting Client Information

Solution: AI-powered smart redaction

When sharing candidate records, client names, contact details, and commercial information must be protected. SAR Portal’s AI identifies and redacts this automatically while preserving the candidate’s own data.

“We used to spend 2-3 hours manually redacting a single candidate file. Now it’s done in seconds.” — Compliance Lead

Problem 3: No Paper Trail

Solution: Immutable audit logs

Every action is logged with timestamp, user, and details. When the DPC asked how they handled requests, they could provide a complete evidence package.

Problem 4: Consultants “Forgetting” About DSARs

Solution: Centralised dashboard with assignments

All requests now flow through SAR Portal. Consultants are assigned cases and see their deadlines prominently. The Managing Director has visibility across all active requests.

The Results

6-Month Performance:

ROI Calculation:

• 15 DSARs/month × 6 hours saved × €40/hour = €3,600/month saved
• Pro plan cost: €199/month
• Net monthly savings: €3,400+

Qualitative Benefits:

• DPC case closed with no fine or ongoing monitoring
• Candidates receive faster responses — improved employer brand
• Consultants freed up to focus on placements, not paperwork
• Client confidence — can demonstrate GDPR compliance in pitches

Lessons Learned

1. Don’t wait for a complaint — Proactive compliance is always cheaper than reactive
2. Recruitment data is complex — You need tools designed for multi-party data
3. Redaction is critical — One client name in a candidate file is a breach
4. Audit trails save you — When regulators ask questions, evidence matters

Looking Forward

TechRecruit now includes their GDPR capabilities in client proposals, positioning compliance as a competitive advantage.

“We went from dreading DSARs to being confident we’re handling them better than most of our competitors.” — Managing Director

Results based on customer-reported data. Individual results may vary.