Right of access
The data subject has the right to obtain confirmation whether you process their personal data and, if so, access to it [1]. Personal data is any information relating to an identifiable person [2]; a score, ranking or suitability label about a candidate falls under it. You provide a copy [3].
For automated decisions
In the case of automated decision-making as referred to in Article 22 GDPR, you also give meaningful information about the logic involved, the significance and the envisaged consequences [4].
Limits
The right to obtain a copy does not adversely affect the rights and freedoms of others [5]. You do not have to provide data on other candidates or the supplier's trade secrets, but that is no reason to refuse the score itself.
Explanation of the decision (Article 86)
In addition, an affected applicant can ask for an explanation of the role of the system and the main elements of the decision [6]. Article 86 has applied since the general date of application, 2 August 2026 [8]. The right concerns decisions based on a high-risk system from Annex III (except point 2) that produce legal effects or similarly significant adverse effects [6]. The classification rules of Chapter III apply to Annex III systems only from 2 December 2027 [7], and for systems already in use the transitional rule of Article 111(2) applies [9]. Assess per system and per decision, therefore, whether the right already applies.