How a Recruitment Agency Could Strengthen DSAR Compliance

The Challenge

Consider a specialist IT recruitment agency placing contractors and permanent staff across Ireland and the UK, handling thousands of candidate records annually.

The GDPR Problem:

Recruitment is a data-intensive business. For every placement, an agency like this holds:

• Original and reformatted CVs
• Interview notes and assessments
• Email correspondence with candidates and clients
• Reference check documentation
• Right-to-work verification documents

When candidates exercise their GDPR rights, finding and preparing this data can be a nightmare.

The Wake-Up Call

Imagine the agency receives a letter from the DPC about a complaint. A former candidate claims the firm:

1. Responded after the one-month deadline
2. Failed to include interview feedback notes
3. Didn’t redact a client contact’s name from correspondence

A letter like this could be the wake-up call: a sign that relying on luck rather than process is a real risk.

The Urgent Solution

With 15-20 requests a month, an agency in this position would need SAR Portal’s Pro plan (up to 25 cases a month and 10 users).

A Possible Rollout:

Day 1: Account setup and inviting the team Day 2-3: Agree internally who handles which requests, and how Day 7: First DSAR handled in SAR Portal Within a few weeks: A repeatable, documented process the team could show a regulator on request

How SAR Portal Could Address These Problems

Problem 1: Data Scattered Everywhere

Solution: Standardised export and upload process

Staff would export candidate data from their ATS, email, and shared drives, then upload it to SAR Portal. The AI scans PDF, Word, Excel and PowerPoint files, emails (.eml, .msg), images (JPG, PNG, TIFF, BMP, GIF) and text files. Other formats, such as video and audio, need manual review.

Problem 2: Redacting Client Information

Solution: AI-suggested redaction with human review

When sharing candidate records, client contacts’ details and commercial information must be protected. AI suggests redactions for other people’s personal data. It can also suggest organisation names, depending on the detection setting you choose. Commercially confidential content, such as rates or terms, needs your own review. The team would review the suggestions and choose what to redact before anything is applied. Detected items start selected, including the candidate’s own details, so the reviewer would use “Deselect Subject Data” to keep the candidate’s own information in their copy.

Manual redaction of a candidate file can take two to three hours; AI suggests the redactions in minutes, and your team then reviews them.

Problem 3: No Paper Trail

Solution: An audit log of key actions

Key actions are recorded in an audit log with the time, the user and the details. No user can edit or delete entries. If the DPC asks how a request was handled, the agency could export the log as evidence.

Problem 4: Consultants “Forgetting” About DSARs

Solution: A shared case dashboard

All requests would sit in one dashboard with their deadlines, visible to the whole team (Pro includes 10 users). The Managing Director would see every active request.

Illustrative Outcomes

The comparison below is illustrative of the kind of improvement an agency of this size could see — it is not measured data from a specific deployment.

Illustrative ROI:

For a busy agency handling 15-20 DSARs a month, saving a few hours on each can add up to well over €1,000 of staff time a month against a Pro plan at €199 a month ex VAT. Actual savings depend on your volume and how you work today.

Benefits an agency could expect:

• Faster responses for candidates — a better employer brand
• Consultants freed up to focus on placements, not paperwork
• Client confidence — the ability to demonstrate a documented DSAR process in pitches

Lessons Learned

1. Don’t wait for a complaint — Proactive compliance is usually cheaper than reactive
2. Recruitment data is complex — You need tools designed for multi-party data
3. Redaction is critical — One client contact’s name left in a candidate file can be a breach
4. Audit trails save you — When regulators ask questions, evidence matters

Looking Forward

An agency in this position could then describe its DSAR process in client proposals, positioning compliance as a competitive advantage. Done well, DSAR handling could shift from a dreaded task to a point of confidence.

Example scenario: not based on a real customer. Figures are illustrative, not measured results.