Must the controller inform the data subject that it does not process their personal data?

ANSWER

The controller should certainly respond to the data subject's request, as a rule within one month in accordance with Article 12(3) GDPR. If you do not process the personal data of the person concerned because, after the recruitment process ended, all personal data were erased, such a response should still be given to the data subject. Of course, the controller is unable to indicate what personal data were processed before and during the recruitment process, because at present it does not process any personal data of the person concerned. If the controller has a personal data erasure protocol, it may be attached for the person concerned, or a response may be given as to when, after the completed recruitment process for a specific job position, the data were erased. Providing such a response does not violate any legal provisions and is consistent with the storage limitation principle.

Of course, the controller is unable to indicate what personal data were processed before and during the recruitment process, because at present it does not process any personal data of the person concerned. If the controller has a personal data erasure protocol, it may be attached for the person concerned, or a response may be given as to when, after the completed recruitment process for a specific job position, the data were erased.

Providing such a response does not violate any legal provisions and is consistent with the storage limitation principle.