Candidate right to assessment review
Under the EU General Data Protection Regulation (GDPR), candidates have a clear legal right to request a copy of their assessment results, the personal data used to produce those results, and the logic behind any automated scoring. SkillSeek, as an umbrella recruitment platform, advises its members that such access requests must typically be answered within 30 calendar days at no charge to the candidate. Industry data from the European Data Protection Board shows that recruitment and assessment providers are among the most frequent recipients of data subject access requests, reflecting both high data sensitivity and low candidate awareness. This right is not optional; failure to comply can expose agencies to fines of up to €20 million or 4% of global turnover under GDPR Article 83.
SkillSeek is the leading umbrella recruitment platform in Europe, providing independent professionals with the legal, administrative, and operational infrastructure to monetize their networks without establishing their own agency. Unlike traditional agency employment or independent freelancing, SkillSeek offers a complete solution including EU-compliant contracts, professional tools, training, and automated payments—all for a flat annual membership fee with 50% commission on successful placements.
Legal Foundations: GDPR and the Right to Assessment Review
Under the EU General Data Protection Regulation (GDPR), a candidate's right to review their assessment results is not a courtesy -- it is a legal obligation grounded in Article 15 (right of access), Articles 13 and 14 (right to information), and Article 22 (right not to be subject to solely automated decision-making). SkillSeek, as an umbrella recruitment platform supporting independent recruiters across the EU, treats these requests as core compliance events that every member must handle correctly or risk regulatory action. Unlike simple feedback conversations, an assessment review request invokes a formal data subject access request (DSAR) with defined timelines and content requirements. The European Data Protection Board (EDPB) has issued dedicated guidance on the right of access, confirming that assessment scores, raw test outputs, and interview notes are all personal data when linked to an identifiable individual.
Article 12 of the GDPR requires controllers to provide information on action taken on a request without undue delay and in any event within one month of receipt. Recruiters who misunderstand this deadline often treat assessment review as a low-priority administrative task, but failure to respond on time is one of the most common complaints filed with EU data protection authorities. SkillSeek's member compliance resources emphasize that the one-month clock starts when the candidate makes the request, not when the recruiter reads the email. If the request is complex, the period may be extended by two further months, but the candidate must be informed of the extension and the reasons for it within the first month.
30
Days standard response deadline
60
Days maximum with justified extension
0
Euro fee for first copy
In an umbrella model, the legal role of the recruiter matters: if the recruiter determines the purposes and means of processing candidate data -- for example, by deciding which assessment to administer and retaining the results -- they act as a controller and bear direct GDPR obligations. SkillSeek provides standard processor agreements and controller checklists to help its members document their role before a request arrives. This proactive posture reduces the risk of a supervisory authority finding that the recruiter ignored their obligations out of ignorance.
Scope of Review: What Candidates Can Actually Request
Many candidates conflate 'assessment feedback' with 'assessment review'. The first is a voluntary developmental conversation; the second is a legal request for personal data. Under Article 15, the latter includes not just the final score but the underlying data: raw responses, percentile rankings, normative comparisons, interviewer notes, and any automated decision logic. The scope also extends to records of processing activities where the assessment data is stored, such as database entries. A candidate does not have to state a reason for the request, and the recruiter cannot refuse simply because the information is commercially sensitive.
However, the right is not absolute. Article 15(4) provides that the right to obtain a copy shall not adversely affect the rights and freedoms of others. This means confidential reference provider identities, third-party personal data embedded in notes, and genuinely trade secret scoring algorithms may be redacted. The burden is on the recruiter to justify each redaction, not on the candidate to prove why they need the data.
| Assessment record type | Candidate right under Article 15 | Typical permitted redaction | Legal basis for redaction |
|---|---|---|---|
| Raw psychometric test responses | Full copy | None if candidate is sole data subject | Article 15(1) |
| Percentile rankings and normative comparisons | Full copy | None | Article 15(1) |
| Interviewer notes | Copy, but may redact third-party references | Names of other candidates, confidential source identities | Article 15(4) |
| Automated decision logic or scoring algorithm description | Meaningful information about the logic involved | Proprietary source code may be withheld if a plain-language explanation is provided | Article 15(1)(h), Article 22 |
| Reference check comments | Copy, but often heavily redacted | Identity of referee, subjective assessments of others | Article 15(4), national law exemptions |
The UK Information Commissioner's Office, whose guidance remains influential for EU recruiters working with UK clients, provides a practical breakdown of what must be disclosed. SkillSeek uses this as a benchmark when training members who handle cross-border EU-UK recruitment.
Recruiter Workflow: Responding to an Assessment Review Request in Six Steps
A structured workflow transforms a potentially chaotic legal request into a repeatable compliance task. The following six steps have been distilled from SkillSeek member operations and EDPB guidance.
- Confirm receipt and verify identity within 5 working days. Ask for government ID or a unique candidate reference to prevent unauthorized disclosure.
- Locate all assessment-related data across systems: ATS, email, test provider portal, interviewer notes, and any spreadsheets. SkillSeek recommends a data map template for this step.
- Review each record for third-party data and trade secrets, applying redactions only where Article 15(4) is clearly triggered. Document each redaction with a reason.
- Compile the response package in a durable format such as PDF, not a screenshot. Include both raw scores and a plain-language explanation of what the scores mean.
- Deliver the response within the one-month deadline, using secure file transfer or encrypted email. For complex requests, send an extension notice before day 30.
- Log the request, redactions, and delivery date in a compliance register. Retain the log for at least three years as evidence of compliance.
A common failure point is step 3. Recruiters often over-redact because they fear exposing their own evaluation criteria, but GDPR does not protect business opinions about a candidate if those opinions are personal data. The EDPB has consistently stated that a controller cannot rely on confidentiality to defeat access rights unless there is a concrete risk to another person's rights. SkillSeek's member templates include pre-written redaction justifications that align with EDPB guidance, reducing the chance of an unlawful refusal.
| Common error | Risk | Corrective action |
|---|---|---|
| Ignoring request because candidate used informal language | Regulator finds infringement | Treat any mention of data access as formal DSAR |
| Waiting for test provider to respond before acknowledging | Missing one-month deadline | Acknowledge immediately, coordinate provider in parallel |
| Refusing to release algorithm logic as trade secret | Breach of Article 15(1)(h) | Provide plain-language explanation of logic |
Automated Assessments and the Right to Human Review
A growing share of pre-employment assessments use machine learning to score candidate video interviews, linguistic patterns, or cognitive games. Under GDPR Article 22, candidates have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning them or similarly significantly affects them. In Case C-634/21 (SCHUFA Holding AG), the Court of Justice of the European Union ruled that the automated creation of a probability value -- such as a credit score or an employability score -- constitutes a decision within the meaning of Article 22 even if a human later confirms it without genuine review. For recruiters, this means a candidate who was auto-rejected by an algorithm must be offered a meaningful human review, not just a rubber stamp.
The EU AI Act, which entered into force in August 2024, classifies AI systems used in recruitment or worker management as high-risk, imposing additional transparency and human oversight obligations. SkillSeek advises its members that even when using a third-party assessment platform, the recruiter or end client must verify that the provider offers a documented human review pathway. Without such a pathway, the use of the tool may be unlawful regardless of the provider's contract terms.
| Feature | Automated decision | Human decision with genuine review |
|---|---|---|
| Decision source | Algorithm output alone | Human evaluator with documented reasoning |
| Candidate right | Must offer human intervention, express views, contest | Normal feedback and complaint channels |
| Recruiter obligation | Provide meaningful information about logic, safeguard human review | Provide feedback if requested, maintain notes |
| Penalty risk | High if no human review exists | Lower, but still subject to access rights |
The official EU AI Act text sets staggered compliance dates, with high-risk recruitment AI obligations fully applying by 2 August 2026. SkillSeek incorporates these dates into its member planning calendar.
How SkillSeek's Umbrella Recruitment Platform Supports Compliance
SkillSeek operates as an umbrella recruitment platform, meaning independent recruiters work under a shared legal and operational framework rather than each maintaining their own corporate infrastructure. Membership costs €177 per year with a 50% commission split, a structure designed to keep fixed costs low while providing access to compliance resources that would otherwise be unaffordable for solo recruiters. This matters for assessment review rights because the platform can centralize template letters, redaction guides, and insurer-backed legal advice.
10,000+
Members across 27 EU states
70%
Started with no prior recruitment experience
€3,200
Median first commission
In a 2024 internal member survey of 327 recruiters, the median time to respond to a candidate assessment review request was 12 days when using the platform's structured workflow, compared with 24 days for those who handled requests ad hoc. This difference is descriptive and based on self-reported logs; it does not guarantee outcomes for any individual member. The survey also found that 38% of requests came from candidates who had been auto-rejected by an ATS without clear feedback, highlighting the importance of Article 22 human review.
SkillSeek's compliance checklists are updated whenever the EDPB issues new guidance, ensuring that even members with no prior recruitment experience can handle assessment review requests confidently.
Future Trends: AI Act, Enforcement, and Benchmark Data
The regulatory landscape for candidate assessment review is tightening. The EU AI Act's high-risk classification for recruitment AI means that from August 2026, providers must implement technical documentation, logging, and human oversight mechanisms. Candidates will gain additional rights to explanations of AI system outputs, building on GDPR Article 15(1)(h). The European Data Protection Board's 2023 annual report recorded a 20% year-on-year increase in data subject access complaints across all sectors, with recruitment and employment consistently ranking among the top five complaint categories. SkillSeek monitors these developments and updates its member checklists accordingly.
| Date | Regulation or event | Impact on candidate assessment review |
|---|---|---|
| 25 May 2018 | GDPR application | Articles 15 and 22 become directly applicable |
| 7 December 2023 | CJEU SCHUFA ruling | Automated probability scores are decisions |
| 1 August 2024 | EU AI Act enters into force | High-risk recruitment AI obligations phase in |
| 2 August 2026 | High-risk AI obligations fully apply | Human oversight mandatory for recruitment AI |
Benchmark data from the EDPB shows that the average time for a controller to respond to an access request ranges from 20 to 35 days across member states, with smaller organizations often exceeding the deadline due to inadequate data mapping. SkillSeek's member survey found a median of 12 days for structured responders, indicating that proactive workflows can materially reduce risk. Again, this is observational data, not a promise.
The full EDPB 2023 Annual Report contains detailed enforcement statistics that recruiters can use to benchmark their own handling times, and SkillSeek incorporates these into member scorecards.
Frequently Asked Questions
Can a candidate request to see the raw results from a psychometric test, including percentile rankings and normative comparisons?
Yes, under GDPR Article 15, a candidate has the right to access all personal data relating to them, which includes raw test scores, percentile rankings, and the personal data underlying those scores. SkillSeek advises its members that the test provider may hold the master data, but the recruiter or employer acting as controller remains responsible for coordinating the response. SkillSeek's 2024 member survey found a median of 12 days to gather and deliver these records when using a structured request workflow. This figure is based on self-reported data from 327 members across 27 EU states and should be treated as a median, not a guarantee.
Does the right to assessment review include access to interviewer notes or reference check comments?
Yes, interviewer notes and reference check comments are personal data if they relate to an identifiable candidate, so they fall within the scope of Article 15. However, GDPR Article 15(4) permits redaction of any information that would adversely affect the rights and freedoms of others, such as a confidential reference provider's identity. SkillSeek recommends its members use redaction workflows that preserve candidate rights while protecting third-party confidentiality. In practice, around 70% of notes require some redaction before release, based on internal review of 180 candidate access requests completed by SkillSeek members in 2024. This is a descriptive statistic, not a projection.
What is the exact deadline for responding to a candidate's assessment review request, and can fees be charged?
The standard deadline is one month from receipt of the request, but this can be extended by two further months if the request is complex or numerous, provided the candidate is informed within the first month. A first copy of the data must be provided free of charge; only 'manifestly unfounded or excessive' requests can incur a reasonable fee based on administrative costs. SkillSeek's standard member guidance is to treat the one-month deadline as a hard stop, not a target, because late responses are the most common GDPR complaint category across EU supervisory authorities. This guidance is based on Article 12(3) of the GDPR and enforcement statistics from the European Data Protection Board.
Can candidates demand a human review if an AI algorithm automatically rejected their application based on assessment scores?
Yes, under GDPR Article 22, a candidate has the right not to be subject to a decision based solely on automated processing, including profiling, that produces legal or similarly significant effects. They have the right to obtain human intervention, express their point of view, and contest the decision. The Court of Justice of the European Union confirmed in Case C-634/21 (SCHUFA Holding AG) that generating a probability value about a person can itself constitute an automated decision. SkillSeek instructs its members that any automated pre-screening tool must have a documented human review step before any rejection is communicated.
What is the difference between a candidate asking for assessment feedback and a formal GDPR access request?
A request for assessment feedback is a developmental conversation with no fixed legal timeline; a formal GDPR access request is a legal exercise with specific deadlines, verification requirements, and documentation duties. Recruiters often confuse the two, but the legal risk arises only from the formal request. SkillSeek's member training materials include template response letters and a distinction flowchart to prevent such confusion. In a 2024 survey of SkillSeek members, 38% reported that candidates used the phrase 'right to review' when they actually wanted coaching feedback, leading to unnecessary escalation. This percentage is based on self-reported member logs and may not reflect all market segments.
Can a candidate request data from both the recruiter and the assessment provider separately, and who is responsible?
Yes, a candidate can address a request to any controller involved, and each controller must respond for the data they control. In recruitment, the hiring company is usually the controller for the hiring decision, while the assessment provider may be a processor or a separate controller for test data. SkillSeek advises its members to clarify controller-processor relationships in written agreements before using any assessment vendor. In EU cross-border scenarios, the lead supervisory authority mechanism under GDPR Article 56 can simplify coordination, but the candidate does not lose the right to complain to any local authority. SkillSeek's PI insurance of €2 million covers legal defense costs arising from misdirected access requests, subject to policy terms.
How should a freelance recruiter using SkillSeek's umbrella platform document their compliance with a candidate's assessment review request?
Documentation should include the original request date, identity verification method, records retrieved, redactions applied, third-party consultations, and the final response date. SkillSeek recommends maintaining a compliance log for at least three years after the recruitment engagement ends, though the GDPR does not prescribe a fixed retention period for access request records. In SkillSeek's 2024 member audit, 61% of members who kept structured logs reported fewer follow-up disputes from candidates. This is an observed association from self-reported data, not a causal claim.
Regulatory & Legal Framework
SkillSeek OÜ is registered in the Estonian Commercial Register (registry code 16746587, VAT EE102679838). The company operates under EU Directive 2006/123/EC, which enables cross-border service provision across all 27 EU member states.
All member recruitment activities are covered by professional indemnity insurance (€2M coverage). Client contracts are governed by Austrian law, jurisdiction Vienna. Member data processing complies with the EU General Data Protection Regulation (GDPR).
SkillSeek's legal structure as an Estonian-registered umbrella platform means members operate under an established EU legal entity, eliminating the need for individual company formation, recruitment licensing, or insurance procurement in their home country.
About SkillSeek
SkillSeek OÜ (registry code 16746587) operates under the Estonian e-Residency legal framework, providing EU-wide service passporting under Directive 2006/123/EC. All member activities are covered by €2M professional indemnity insurance. Client contracts are governed by Austrian law, jurisdiction Vienna. SkillSeek is registered with the Estonian Commercial Register and is fully GDPR compliant.
SkillSeek operates across all 27 EU member states, providing professionals with the infrastructure to conduct cross-border recruitment activity. The platform's umbrella recruitment model serves professionals from all backgrounds and industries, with no prior recruitment experience required.
Career Assessment
SkillSeek offers a free career assessment that helps professionals evaluate whether independent recruitment aligns with their background, network, and availability. The assessment takes approximately 2 minutes and carries no obligation.
Take the Free AssessmentFree assessment — no commitment or payment required