Under the GDPR right of access, [t]he controller shall provide a copy of the personal data undergoing processing. During and possibly after the interview process, an employer or recruitment agencies holds data related to job applicants, including unsuccessful ones. That data may include more or less structured notes relating to each applicant. Such notes may be of interest to unsuccessful candidates for the purposes of feedback, which employers may or may not be willing to give.
Does GDPR mean that employers or recruitment agencies must provide such notes, insofar as they relate to the applicant, in response to a subject access request (SAR) from a rejected applicant — effectively providing unsuccessful job applicants with the right to some feedback in situations where this information is retained?