Understanding your situation
What you need to prepare
- ✓Job posting or description you applied for (save a copy/screenshot)
- ✓Confirmation email or rejection notification from the employer
- ✓Your CV/resume and cover letter as submitted
- ✓Any assessment results or feedback provided (even if generic)
- ✓Screenshots of the recruitment platform or AI assessment tool used
- ✓The employer's privacy notice or recruitment privacy policy
- ✓Your qualifications, certifications, and experience relevant to the role
⏰ Deadline
Act within 30 days of the rejection for maximum effectiveness. GDPR rights can be exercised at any time, but earlier action strengthens your case. If you suspect discrimination, note that employment tribunal deadlines apply (e.g., 3 months less one day in the UK, 2 months in Germany, 3 months in France).
🏛️ Authority
The employer's Data Protection Officer (first step). National Data Protection Authority: UODO (PL), BfDI (DE), CNIL (FR), ICO (UK), AEPD (ES), Garante (IT). Equality/anti-discrimination bodies: Equality and Human Rights Commission (UK), Defenseur des droits (FR), Antidiskriminierungsstelle (DE), Rzecznik Praw Obywatelskich (PL).
⚖️ Legal basis
GDPR Article 22: right not to be subject to solely automated decisions producing legal or significant effects, including employment decisions. GDPR Articles 13-15: right to meaningful information about automated decision-making logic. EU AI Act (Regulation 2024/1689) Annex III, Category 4: AI systems for recruitment classified as high-risk. From 2 August 2026: AI Act obligations including risk management (Art. 9), human oversight (Art. 14), deployer obligations including informing workers' representatives (Art. 26(7)), and right to explanation (Art. 86). Already enforceable: Art. 85 complaint right. EU Employment Equality Directive 2000/78/EC: prohibition of discrimination in employment.
Expert tips
- 1Check the employer's privacy policy for mentions of automated decision-making or AI in recruitment. Under GDPR Article 13(2)(f), they must disclose this in advance.
- 2Send your letter to the employer's DPO (Data Protection Officer), not just the HR department. The DPO has a legal obligation to respond to data subject requests.
- 3Explicitly request: (1) confirmation of whether AI was used in the decision, (2) meaningful information about the logic involved, (3) human review of your application by a qualified recruiter, and (4) the specific factors that led to your rejection.
- 4If you suspect discrimination, mention the specific protected characteristic and why. This triggers additional obligations under equality law.
- 5Keep records of everything: the job ad, your application, the rejection, and all correspondence.
- 6From 2 August 2026, employers deploying AI recruitment tools must comply with AI Act high-risk obligations - including informing workers' representatives (Article 26(7)). Fundamental rights impact assessments (Article 27) apply specifically to public bodies and private entities providing public services, as well as deployers of creditworthiness and insurance systems under Annex III 5(b)/(c).
