Usually yes, but how much you must release, and how fast, depends on the country. Indonesia is the strictest: its Personal Data Protection Law gives candidates a right of access with no exception for evaluations, and you have 3 × 24 hours to give it. Australia and New Zealand start from access and need a specific legal ground to refuse. Singapore lets you withhold opinion data kept solely for an evaluative purpose, which includes assessing someone for employment, and the PDPC has accepted that opinions produced by an algorithm count. If you screen with HyreTech, a request about a candidate in your workspace is yours to answer as the employer or recruiting firm. HyreTech answers directly only for its free resume screener, talent-pool submissions and its own role-recommendation emails.
An email arrives at a recruiting firm: "Please send me everything you hold about me, including the score your software gave me." Most hiring teams have a process for CV requests and none for this one. The score sits in an AI ATS, the vendor processes it, and nobody is sure who has to answer or what can be held back.
This article covers access and correction requests only. It explains who answers, what each country lets you withhold, and a checklist for handling a request. For the wider rules on AI in hiring, see AI hiring compliance in Singapore, Australia and New Zealand.
Checked against the primary sources on 15 October 2026. This is a plain-language summary, not legal advice. Have counsel in each country review your response process.
The Employer Usually Answers, Not The Software Vendor
In Singapore, the PDPC's Advisory Guidelines on Key Concepts in the PDPA (revised 29 April 2026) say the PDPA does not directly impose the access and correction obligations on a data intermediary that only processes data for another organisation under a written contract (paragraph 15.2). The organisation that engaged it remains responsible, and its response must take into account the data the intermediary holds.
Indonesia's Personal Data Protection Law (UU 27/2022) puts the duty in the same place. A processor acts on the controller's instructions, and that processing remains the controller's responsibility (article 51). The 72-hour deadlines for access and correction are duties of the controller.
In Australia, the OAIC's APP 12 guidelines say an organisation that outsources storage but keeps the right to deal with the information still holds it, and cannot simply refer the individual to the third party (paragraph 12.7).
In New Zealand, section 11 of the Privacy Act 2020 treats information an agent holds for you as held by you. If the agent also uses it for its own purposes, you both hold it. Our AI ATS data transfers guide covers that agent rule in more detail.
HyreTech's privacy policy follows that line for workspace data, but not for everything. Who acts depends on where the candidate's data came from:
| Candidate data | Who acts on a request |
|---|---|
| Applicants in a client's workspace, imported or applying to a client's role | The client that runs the workspace, whether that is the employer or a recruiting firm. HyreTech processes this data on the client's documented instructions and forwards any request it receives to the client |
| Talent-pool submissions on a HyreTech-hosted client page | HyreTech and the client are joint controllers. HyreTech acts on requests directly, and the candidate names the client's page they submitted through |
| Free resume screener | HyreTech, as controller, acts itself, including for a person named on a CV that someone else uploaded |
| Role-recommendation emails | HyreTech, as controller, acts itself |
The free screener shows a result for 24 hours. An hourly clean-up then deletes it, and deleted files stay recoverable at our storage provider for up to 7 days, so a request about a screening concerns data that is already close to deletion.
HyreTech's policy says it responds to rights requests within 30 days, or any shorter period the law requires. Your own clock starts when the candidate writes to you, and in Indonesia it runs for 72 hours, so start searching on the day the request arrives rather than waiting for a vendor reply.
What a Request Can Reach When an AI Scores a Candidate
Whether a score is the candidate's personal data is not in doubt in Singapore. In a 2021 decision on a bank's internal evaluation report, the PDPC's Deputy Commissioner said it was not relevant that the data had been generated by an algorithm. What counts is whether it is about an identifiable individual and is in the organisation's possession or control.
Australia's OAIC says an individual can access all the personal information you hold about them unless an exception applies. Indonesia's Law gives a right to access and obtain a copy of one's own personal data (article 7). A ranking or scorecard tied to a named candidate is information about that person, so plan on it being in scope in all four markets.
In an AI ATS, a request can reach more than the CV. In HyreTech, it can reach these:
| Item | What it is in HyreTech | Note |
|---|---|---|
| Parsed CV and application answers | What the candidate submitted | Release it. No market's evaluative exception covers the inputs |
| Scorecard | A 1 to 100 score and a written reason for each criterion, plus strengths, gaps and concerns | Opinion data, and where the four markets differ most |
| AI recommendation and rank | A Shortlist, Consider or Reject label against the role's cut-offs, and the candidate's position when sorted by score | Same as the scorecard |
| GitHub or portfolio analysis | The public profile, repositories and merged pull requests, or a portfolio site, taken from links in the CV or application form, plus the AI's written assessment of them | The fetched data is public but still held about the person. The assessment is opinion data |
| Trust score | A verification score and its flags. HyreTech computes it for every candidate but shows it only on the Growth plan and above | On other plans you hold it without seeing it, so ask us for it |
| Interview notes, rejection reasons and do-not-hire entries | What your team recorded | Check for other people's personal data before release |
| Emails you sent | Custom messages and rejection notices | HyreTech sends them but keeps no copies, so search your own mailboxes |
Expect requests that ask why, not only what. HyreTech's policy tells candidates they may have the right to request human review of AI-driven decisions, receive an explanation of how AI processing works and contest automated outcomes, by contacting the employer or privacy@hyretech.ai.
In the product itself, HyreTech labels candidates but never rejects one: a person on your team makes every status change. For how a scorecard is built, see how AI candidate matching works and how weights become a score. What the trust score checks is in what a trust score flags.
Singapore: A Bank's Algorithmic Opinion was Withheld
In the HSBC decision ([2021] SGPDPC 3), an unsuccessful credit card applicant asked for the bank's internal evaluation report. HSBC released it with some fields redacted, saying those fields were opinion data kept solely for an evaluative purpose. The Deputy Commissioner agreed that the redacted data was opinion data, confirmed the refusal under the Fifth Schedule exception, and noted that individuals have no right to request correction of such data either.
The decision turned on the part of the definition that covers awarding contracts, not hiring. Hiring sits in the same statutory definition: under section 2 of the PDPA, an evaluative purpose includes determining a person's suitability, eligibility or qualifications for employment.
Three details matter for a hiring team:
- "Kept solely" is the test. If you also use scores for something other than evaluating suitability, ask counsel whether the exception still fits.
- Only the opinion is covered. You must still provide the rest of what was asked for (section 21(5)), such as the CV and application answers, and information about how you used or disclosed the candidate's data in the year before the request (section 21(1)(b)).
- Transparency counted in HSBC's favour. Separately from the ruling on the exception, the Deputy Commissioner noted that HSBC had acted reasonably by giving the applicant information about how it uses data and technology in its decisions.
If you refuse, you must still reply and say so, and the PDPC says you should give your reasons (paragraph 15.38). You must also keep a complete and accurate copy of what you withheld for at least 30 days after you tell the candidate, and longer if they ask the PDPC to review your decision (section 22A, with regulation 8 of the Personal Data Protection Regulations 2021).
On timing, respond as soon as reasonably possible. If you cannot respond within 30 days, tell the individual in writing within those 30 days when you will (regulation 5). You may charge a reasonable fee for access if you first give a written estimate (regulation 7), but not for a correction. Nothing requires you to alter an opinion (section 22(6)), but if you do not make a requested correction, you must annotate the data with the correction that was asked for (section 22(5)).
Indonesia: 72 Hours and No Evaluative Exception
Indonesia's Personal Data Protection Law has applied in full since its two-year transition ended in October 2024 (article 74). It covers processing in Indonesia, and processing outside Indonesia that has legal effect there or concerns Indonesian citizens abroad (article 2). For a candidate's request, it is the strictest of the four markets:
- A right of access and a copy. A candidate may access and obtain a copy of their personal data (article 7). The controller must give access to the data together with the record of how it was processed (article 32(1)). The official elucidation says the copy is free except in particular cases that genuinely involve a cost.
- 72 hours. Access must be given no later than 3 × 24 hours after the controller receives the request (article 32(2)). Errors and inaccuracies must be corrected within the same 72 hours, and the candidate told the result (article 30).
- No evaluative exception. The Law's exceptions to these duties cover state interests only, such as national defence and security, law enforcement and financial-sector supervision (article 50). Nothing in it lets an employer hold back a hiring evaluation. The controller must refuse where giving access would endanger someone's safety or health, or reveal another person's personal data (article 33).
- Objection to automated decisions. A candidate may object to a decision based solely on automated processing, including profiling, that has legal effects or a significant impact on them (article 10). The procedure is left to a government regulation, which we could not find in Indonesia's official legal database on 15 October 2026.
- An impact assessment comes first. Automated decisions with significant effects, and processing that systematically evaluates or scores people, are high-risk processing that requires a data protection impact assessment (article 34).
In practice, an Indonesian candidate who asks for their score should get the scorecard, the reasoning and their CV within 72 hours.
Australia: The OAIC's Own Example is a Scorecard
Under APP 12, you must respond within a reasonable period, which the OAIC says should generally not exceed 30 calendar days (paragraph 12.67). You cannot charge for making a request, and any charge for giving access must not be excessive. There is no formal requirement for a request, so an email is enough, though you may ask people to follow a process.
The OAIC's guide to access requests lists ten grounds for refusal. One covers evaluative information generated within your organisation in connection with a commercially sensitive decision-making process.
The APP guidelines give "a score card weighting system and score card result" as an example of evaluative information (paragraph 12.61), so an AI scorecard can fall within this ground if your decision-making process is commercially sensitive. Two limits apply. The ground covers only the evaluative information, never the personal information the decision was based on, such as the CV. And if you refuse on this ground, your notice can explain the decision instead (APP 12.10).
If you refuse, give written notice of the reasons, unless that would be unreasonable, and of how to complain. The OAIC also suggests alternatives to a flat refusal, such as a redacted copy or a summary. It has a separate guide for correction requests.
APP 12 binds only organisations covered by the Privacy Act, and many businesses with an annual turnover of A$3 million or less are not. The employee records exemption does not cover unsuccessful applicants, and the OAIC says it is unlikely to apply to a recruitment agency acting for an employer.
Expect more requests after 10 December 2026, when privacy policies must describe automated decisions (APP 1.7 to 1.9). The OAIC's APP 1 guidelines use AI screening and ranking of job applications as an example, and our compliance guide has example wording.
New Zealand: Evaluative Material Needs a Promise of Confidence
IPP 6 gives people the right to confirmation of whether you hold personal information about them and to access it. When you give access, you must tell them they can ask for a correction. You must respond as soon as reasonably practicable and no later than 20 working days (section 44). You can extend that only for a large volume of information, consultation or complexity, and you must give the reasons within the 20 days (section 48).
A request can arrive by email, letter, phone or in person. A private-sector employer may charge a reasonable fee for making information available (section 66), but the Office of the Privacy Commissioner says that in most circumstances people should not be charged.
New Zealand's evaluative ground is built differently. Under section 50, you may refuse access to evaluative material only if releasing it would breach an express or implied promise, made to the person who supplied it, that it would be held in confidence.
The material must have been compiled solely for a listed purpose, which includes deciding suitability for employment. And it does not include material compiled by a person employed or engaged by the agency in the ordinary course of their duties.
The OPC's own example is a job referee who may not be candid if the applicant will see what they said. A scorecard generated by software has no supplier who was promised confidence. That is our reading and not a ruling, so treat a scorecard as releasable in New Zealand unless counsel advises otherwise. Referee comments are a different matter. If you do refuse, tell the candidate which ground you rely on.
If the candidate complains and the matter is not resolved, the Privacy Commissioner can direct you to give access, in a manner and by a date the Commissioner sets (sections 91 and 92).
For corrections, IPP 7 requires reasonable steps to keep information accurate, up to date, complete and not misleading. If you will not change it and the candidate asks, attach their statement of the correction they wanted so that it is always read with the information.
The Four Markets Side by Side
| Singapore | Indonesia | Australia | New Zealand | |
|---|---|---|---|---|
| Law | PDPA, sections 21 and 22 | PDP Law (UU 27/2022), articles 6, 7, 30 and 32 | Privacy Act 1988, APP 12 and APP 13 | Privacy Act 2020, IPP 6 and IPP 7 |
| Response time | As soon as reasonably possible. If not within 30 days, say in writing within that time when you will reply | 3 × 24 hours, for access and for correction | A reasonable period, generally not more than 30 calendar days | As soon as reasonably practicable, and within 20 working days |
| Fees | A reasonable fee for access with a written estimate. None for correction | A copy is free except where a cost is genuinely needed | None for making the request. An access charge must not be excessive | Usually none. A private-sector employer may charge a reasonable fee |
| Can you withhold an AI score as evaluative material? | Yes, if it is opinion data kept solely for an evaluative purpose | No. There is no evaluative exception | Possibly, if it would reveal evaluative information from a commercially sensitive decision-making process. The OAIC's example is a scorecard result | Only with a promise of confidence to the person who supplied it, which a software output does not have |
| Correction of the opinion itself | No duty to alter an opinion. Annotate the requested correction | Correct errors and inaccuracies within 3 × 24 hours. The Law does not say how this applies to an opinion | Correct information that is inaccurate, out of date, incomplete, irrelevant or misleading (APP 13) | Take reasonable steps. If you will not change it, attach the candidate's statement on request |
| If you refuse | Reply, give your reasons, and keep a copy of what you withheld for at least 30 days | Only on the Law's narrow grounds, such as revealing someone else's data | Written notice with reasons and how to complain | State the ground. After a complaint, the Commissioner can direct access |
A Checklist For Handling a Request
- Log the time and confirm identity. The OAIC says not to disclose if you are unsure who is asking, and the PDPC expects you to check identity. Indonesia's 72 hours run from receipt, so log the time as well as the date.
- Find everything, including at the vendor. Search your ATS, mailboxes and any AI ATS. HyreTech has no candidate or scorecard export yet: the candidate's page shows the full scorecard, recommendation and profile analysis, and you can download the CV there. For a complete copy of everything HyreTech holds, email privacy@hyretech.ai on the day the request arrives. It is compiled by hand within 30 days of a verified request, which is slower than Indonesia's 72 hours and can run past New Zealand's 20 working days, so answer first from what your workspace shows. See also where candidate data is processed and how to delete candidate data.
- Decide by country. Use the table above, and record why you released or withheld each item.
- Strip other people's data. Remove other individuals' personal data, such as a referee's identity or another candidate's details, before release. All four markets expect this.
- Reply on time. If you need longer and the law allows it, say so in writing and give a date. In Singapore, if you refuse, keep a copy of what you withheld for at least 30 days.
- Tell them how to ask for a correction. New Zealand requires it, and it costs nothing elsewhere.
- Publish how to ask. The OAIC says your privacy policy should set out how an individual can request access. Do the same in your careers-page notice in all four markets.
For how long to hold the data a candidate is asking about, see how long you can keep candidate data in Singapore, Indonesia, Australia and New Zealand.
For where HyreTech processes that data, see our guide to AI ATS data transfers for Australian and New Zealand teams and the PDPA and AI hiring guide.
Rehearse One Request Before a Real One Arrives
The easiest time to find gaps is before a candidate writes in. Pick one closed role and treat it as a mock request: find the candidate's record, open the scorecard, and decide which items you would release in each country. Time it against Indonesia's 72 hours.
To do that on a real role, start free and read the per-criterion reasoning the way a candidate would.
To map where each candidate record sits across your markets and who would answer, book a demo and we will walk through it with you.
FAQ
A candidate asked our recruiting firm for the score our AI screening tool gave them. Who has to answer?
You do, for applicants in your HyreTech workspace. HyreTech processes that data on your documented instructions and forwards any request it receives to you. It acts directly only for talent-pool submissions, its free resume screener and its role-recommendation emails. Whether you can withhold the score depends on the country: Singapore allows it for opinion data kept solely for an evaluative purpose, Australia only in narrow cases, New Zealand rarely and Indonesia not at all.
Do candidates have the right to see their AI screening score?
Often yes. Indonesia, Australia and New Zealand start from access and need a specific ground to refuse, and Indonesia has no ground for evaluations at all. Singapore lets you withhold opinion data kept solely for an evaluative purpose, and the PDPC has accepted that opinions generated by an algorithm can qualify.
Can a Singapore employer refuse to show a candidate an AI score?
Possibly. In a 2021 decision the PDPC confirmed a bank's refusal to release algorithm-generated opinion data kept solely for an evaluative purpose. Evaluating suitability for employment is in the same statutory definition. If you refuse, you must still reply, and you must keep a copy of the withheld data for at least 30 days.
Do candidates in Indonesia have the right to see their AI screening score?
Yes. The Personal Data Protection Law gives a right of access and a copy with no exception for evaluations, and you must give access within 3 × 24 hours of receiving the request (articles 7 and 32 of UU 27/2022).
How long do I have to respond to a candidate's access request?
In Indonesia, 3 × 24 hours. In New Zealand, 20 working days. In Australia, a reasonable period that should generally not exceed 30 calendar days. In Singapore, as soon as reasonably possible, and if you need more than 30 days, tell the individual in writing within that time when you will reply.
Can I charge a candidate for an access request?
In Singapore, a reasonable fee for access with a written estimate, but nothing for a correction. In Australia, nothing for making the request, and any access charge must not be excessive. In New Zealand a private-sector employer may charge a reasonable fee, though the Privacy Commissioner expects most requests to be free. In Indonesia a copy is free except where a cost is genuinely needed.
Does a New Zealand employer have to release screening and interview notes?
Usually yes. The evaluative ground in section 50 needs a promise of confidence to the person who supplied the material, such as a referee, and it excludes material compiled by people employed or engaged by the agency in the ordinary course of their duties. Ask counsel before withholding anything.
If our AI vendor holds the candidate's data, do we still have to answer?
Yes. In all four markets the organisation that engaged the vendor stays responsible and must include the data the vendor holds for it. Ask the vendor how a full record is pulled before you need it, because its timeline may be longer than yours.