GDPR Audit Trail
📋 On This Page
- Overview
- What Is Tracked
- Data Captured
- Admin Console
- Usage Guide
- How It Works
- Best Practices
- Related Features
- Candidate lifecycle — creation, updates to core fields (name, contact details, anonymisation, status), deletion/restoration
- Submission lifecycle — creation and status changes (sent, viewed, shortlisted, rejected, on hold, hired, withdrawn)
- Submission notifications — outbound client emails for new submissions
- Consent events — consent granted/withdrawn when recorded via the consent model
- LIA actions — Legitimate Interest Assessments created or reviewed/approved
- Not tracked here — submission or CV views; use submission analytics for engagement data
- Timestamped event type
- Candidate, submission, and client company links when available
- User and agency context (or "System" when automated)
- IP address and user agent from the request
- Before/after values for tracked candidate field changes
- Event details payload (e.g., status change or email recipient)
- Access under Admin → GDPR Audit Log
- Filter by event type, date range, candidate, user, or agency
- Search IP address or event details
- CSV export respects applied filters
- Detail view for each entry shows context and payload
- Open Admin → GDPR Audit Log to review recent activity
- Apply filters to isolate specific candidates, event types, or dates
- Click an entry to see who performed the action and what changed
- Use Export to CSV when auditors request evidence
- Observers and listeners automatically create audit entries when the tracked events occur
- Entries store a created timestamp only; day-to-day use is append-only, and updates are not part of the workflow
- IP addresses are retained for accountability; no geolocation or device fingerprinting is performed
- No automated retention window is enforced—set and execute your own audit-log retention policy
- Review key events when sharing sensitive candidates
- Export filtered logs for audit requests instead of sharing the full history
- Pair anonymisation and NDAs with audit logging so you can evidence how data was shared
- Legitimate Interest Assessments — LIA management
- Consent Management — Consent tracking
---
Overview
The GDPR Audit Trail records key candidate and submission events so agencies can evidence lawful processing when sharing profiles with clients.
---
What Is Tracked
---
Data Captured
---
Admin Console
---
Usage Guide
---
How It Works
---
Best Practices
---