Candidate Search Security - GDPR Countries

How are others managing GDPR compliance for candidates/job applicants?

Our organization has asked us to gather feedback from the candidate based on other job applications. Below screenshot is an example of a non-Oracle site which grants the candidate multiple selections. We thought the best way to replicate was to create a Candidate EFF and have custom SQL to restrict Candidate Search based on the response to that EFF. However, we found the Candidate Search SQL cannot be customized like Employee Search. We are being told that, without these types of options, we are out of compliance. Looking to understand what others are doing.