You applied for a role a few months ago, had two interviews, and received a short email thanking you for your time. No reason, no feedback, just the polite full stop that ends most applications.

Somewhere in that company’s hiring system there is a record of you that goes well beyond your CV: interviewer notes, scorecards, internal comments typed into free-text boxes, tags that categorise you, and quite possibly a written rejection reason nobody intended you to see.

If the company operates in Estonia or anywhere else in the EU, you can ask for a copy of all of it. Most people know the General Data Protection Regulation (GDPR) as the reason websites pester them about cookies, and far fewer connect it to the job they did not get.

The Right Nobody Mentions in a Rejection Email

Under the GDPR you can make a subject access request to any organisation that has processed your personal data, and a company that took your application processed your personal data.

It costs nothing and requires no lawyer, no form and no particular wording. You send an email, and the organisation generally has one month to respond, telling you what data they hold, why they hold it, how long they intend to keep it, and who else has seen it.

Recruitment is not carved out of this, because the applicant tracking system your application vanished into is just another database holding information about an identifiable person.

What Is Actually in There

Companies vary, but a typical file contains your CV and cover letter. It also includes structured scoring from each interview stage and free‑text notes interviewers typed immediately after meeting you.

You may see tags or categories applied to your profile, notes from the recruiter’s screening call, and internal messages discussing your candidacy. Finally, there is usually a rejection reason selected from a dropdown.

The interview notes are usually the revelation, because they were written for colleagues rather than for you, and they tend to be considerably blunter than anything in your rejection email.

Where an automated tool ranked, scored or filtered applications, you can also ask for meaningful information about the logic behind it, though the quality of answers on this point varies.

Your File Outlives Your Rejection

The record does not vanish when you are rejected. It usually sits in the system for a year or more, and you probably agreed to it being kept for future opportunities without anyone explaining what that meant in practice.

Apply to the same company eighteen months later and a recruiter opening your profile may see what the last interviewer wrote.

A fair note does no damage. A throwaway line typed in a hurry, a factual error, or a judgement that had more to do with the interviewer’s mood than your performance is still sitting there, shaping how you are received before anyone has spoken to you.

Correction Matters More Than Access

You can ask how long your data will be retained and on what basis, request erasure, and withdraw the consent you gave for your details to be kept for future roles.

The most useful right is correction, because an inaccurate interview note is something you are entitled to have fixed rather than something you must carry into every future application to that company.

Three limits are worth knowing. Companies may withhold information that would reveal personal data about other people, so an interviewer’s identity is often redacted even when their comments are disclosed.

Some organisations interpret the exemptions generously in their own favour. Responses range from a thorough data export to a defensive minimum.

How to Send One

Email the company’s privacy or data protection contact, listed in their privacy policy, rather than the recruiter.

State that you are making a subject access request under the GDPR. Give the role and roughly when you applied, and include the identity details they need to locate your record.

Ask for all personal data held about you, including interview notes, assessments, and internal communications relating to your application. Request the retention period in the same email.

These requests usually land with a privacy or legal function rather than the hiring team, which means the response is handled as a compliance obligation rather than a relationship to be managed, and the result is often far more candid than any feedback you would have received by asking nicely.

If You Are on the Hiring Side

Every note your interviewers write is potentially disclosable to the person it describes. “Not a culture fit” reads very differently in a legal disclosure than it did in a debrief, and a comment about someone’s accent, age or likely family plans becomes a documented record of discrimination that you may be obliged to hand over.

Train interviewers to write about evidence and job-related criteria, as though the candidate will read the note, because they might. Set a retention policy and enforce it instead of keeping everything indefinitely by default.

State clearly in your privacy notice how long you keep applications and why. Make sure somebody knows how to handle a request when it arrives, since the one-month deadline runs whether or not anyone has opened the email.

Volume makes this urgent. A well-placed listing on Jobs Hub can generate hundreds of applications, and every one becomes a record you are responsible for, so note-taking discipline is far easier to establish before your system holds a thousand profiles than after.

This is a plain-language overview rather than legal advice, and the practical details vary by country and situation. If you meet resistance, your national data protection authority is the escalation route, and in Estonia that is the Data Protection Inspectorate.

Final Thoughts

Hiring is a process where the company holds nearly all the information, decides what to share, and owes you no explanation when it says no. This is one of the few mechanisms running in the opposite direction.

You will not send a request after every rejection, and you do not need to. It is worth knowing the option exists for a company you intend to apply to again, or for a rejection that never made sense, and worth knowing that the polite email closing the door was not the whole story.

#GDPR #JobSearch #CandidateRights #RecruitmentTransparency #EstoniaJobs #DataProtection