Skip to content

M9-02 GDPR — Subject Access Request (SAR) Handling

Milestone: M9 — Hardening and Compliance SOW Reference: NFR3 Requirement Clarity: ✅ Clear Dev Status: ❌ Not started

Overview

Let a Candidate request a copy of all personal data the platform holds on them (a Subject Access Request), and let Platform/Org Admins fulfil that request.

Backend Tasks

  • Build a SAR export job that pulls together all personal data for a given candidate (employee record, credential offers, disclosure history, session/audit logs)
  • Package the export in a readable format (PDF/CSV bundle)

Frontend Tasks

  • Add a SAR-request/fulfilment action for Internal System Admins (per the SOW's user role table)

Dependencies

Acceptance Criteria

  • Comply with GDPR, including subject access requests (per SOW NFR3)

Existing Reference Material

  • SOW Appendix 1, User Roles table — "Internal System Admin: Respond to GDPR, compliance and audit reports requests"

Blockers & Risks

None beyond the general "not started" status of the whole GDPR surface.