How HR Should Respond to a Rejected Candidate's 'Expose' Threat

A rejected candidate's message says they're going to "expose" the hiring decision. That word alone doesn't tell you much: it could mean a request for feedback, a plan to post a public review, an allegation of discrimination, an attorney already retained, or a safety or privacy concern buried inside the wording. Sorting out which one is actually in front of you comes before naming an owner or drafting a reply.

This guide is written for the hiring manager or HR contact holding that message right now. Other people, employment counsel, a designated safety lead, an insurance carrier contact, communications staff, may end up owning parts of the response. The framework below is built to route the situation to them rather than have HR handle every category alone.

What follows walks through preserving the message, matching it to a trigger, naming an internal owner, and deciding whether a reply is appropriate. It does not evaluate whether a candidate's discrimination, defamation, or retaliation claim has merit. That determination belongs to employment counsel and, once a charge is filed, to the agency's own process. Retention duties, reporting lines, insurer-notice requirements, and response deadlines vary by company size, policy, and state law, so treat this as a starting framework and have counsel review your organization's version of it before relying on it as policy.

A few facts below come from federal guidance and legal reference sources, linked where they appear; everything else is this guide's recommended practice, not a legal conclusion, so check it against the organization's actual policy before relying on it. Employers covered by Title VII, the ADA, and the ADEA face federal recordkeeping obligations for hiring files, and those obligations extend once a charge is filed, so confirm the exact retention period and any charge-specific deadline directly with the EEOC or with counsel rather than assuming a fixed timeline. Whether a statement counts as defamation depends on state law and the specific facts involved, which is why a legal threat belongs with counsel rather than an internal read of the message, according to Cornell Law School LII.

One distinction comes before any of the sorting below. A message describing imminent physical danger is an emergency: follow the organization's emergency procedure immediately, before doing anything else in this guide. Harassment, stalking, doxxing, or impersonation without an imminent-danger element still needs same-day attention, but it typically routes to whoever the organization's policy designates as the safety or HR owner, not to an emergency line. Personal information exposed in a message, such as a home address, calls for a different response again: preserve it, restrict who inside the organization sees it, and escalate to whoever handles privacy or security. The table below assumes the first of these has already been ruled out.

Trigger, owner, and response at a glance

What the message contains Immediate action Who owns it Substantive reply? Imminent physical danger Follow the organization's emergency procedure Safety/emergency contact No, until cleared Harassment, stalking, doxxing, or impersonation Preserve; notify the designated safety or HR owner Safety/HR owner under policy No without that owner's approval Exposed personal information Preserve; restrict internal distribution to those with an authorized business need Privacy, security, or legal contact No without that contact's approval Agency notice, subpoena, court document, or attorney communication Preserve as received; record the date; route to counsel and the insurer if policy requires Employment counsel No without counsel's direction Specific allegation the rejection was discriminatory or unlawful Preserve; notify HR the same day HR and counsel together No without their sign-off Threat to post or publish publicly Screenshot with URL and timestamp HR Only a private acknowledgment, plus the platform's reporting tools Request for reconsideration, explanation, or feedback Preserve HR Only if no other trigger applies and policy allows it

These rows aren't mutually exclusive. A single message can trigger more than one, and Step 2 covers what to do when that happens.

Rules that apply no matter which row fits

Three practices apply to every message in the table, regardless of category:

Save the message exactly as received, with date, sender, and channel noted, and move it out of any auto-deleting inbox or chat before doing anything else.
Hold off on contacting the candidate for more information until the assigned owner has weighed in. That exchange can become part of the record itself.
Notify the owner from the table promptly. Same-day notice is a reasonable target for most organizations, but check whether your own escalation policy sets a different timeline before assuming one.

These are internal risk-management practices this guide recommends, not requirements drawn from the sources cited above. The sections below cover what to do once those three steps are done.

Step 1: Build the escalation record

Once the message is saved, assemble a short record and forward it to the assigned owner along with the message itself:

Date and time received
Exact wording, saved rather than summarized
Channel it came through
Screenshots or URLs, if the content is public
Date of the original hiring decision and who made it
Any language referencing a protected characteristic, an attorney, or an agency
Any safety or privacy concern
Who inside the organization has already been notified

A usable escalation email keeps this information in one place instead of scattered across a conversation thread:

Subject: Candidate message needs review before any reply, [candidate name], [role]

To: [HR contact / designated owner]

Urgency: [same-day / next business day]

Attached: original message, screenshots, hiring decision date and decision-maker

Note: Forwarding for review. Not characterizing whether this is discrimination, defamation, or a safety issue, that determination is yours to make.

That last line matters. A manager forwarding the message shouldn't guess at the legal category in the subject line or body; naming it prematurely can shape how the reviewer treats it before they've actually read it.

Pausing routine deletion of that candidate's hiring file while the situation gets sorted is a reasonable precaution, but it's an internal policy choice rather than a specific federal requirement. Check whether the organization already has a written hold procedure before improvising one, and confirm current retention rules directly with the EEOC or with counsel if there's any doubt about how long the file needs to be kept.

Step 2: Match the message to a trigger, then set priority if more than one applies

Read the message against the table above rather than reacting to its tone. More than one trigger can apply at once, for example a public post that also alleges discrimination and includes a home address.

When triggers overlap, priority generally runs in this order: immediate physical danger first, then active privacy or security exposure, then a formal legal deadline already running, then a discrimination allegation, then a reputational concern with no legal or safety element attached. This isn't a ranking of importance, it's a sequence for what needs attention first when everything can't be handled at once.

Name a single lead owner so the candidate doesn't get inconsistent responses from two teams. When counsel, HR, security, privacy, and communications are all involved, whoever owns the highest-priority trigger under that sequence should coordinate the others, pulling in each function for their piece rather than letting every team draft its own response independently.

Mentioning a protected characteristic isn't the same as alleging the rejection happened because of it. Federal law enforced by the EEOC covers specific protected characteristics, but whether a specific message rises to an actual allegation is a call for HR and counsel, not something a checklist settles.

Example: a candidate says they were rejected because of their age, names the interviewer, and says they're considering an EEOC charge. That message raises a discrimination issue that HR and counsel should assess. A stated intention to file is not the same as an agency notice confirming a charge has actually been filed, so treat the two separately: notify HR and counsel the same day for the allegation, and update the file the moment an actual notice arrives.

Step 3: Name the owner before you need one

The table points to an owner for each trigger. The harder part is having that person identified before a message arrives; the hiring manager alone is rarely the right owner once anything above the bottom two rows applies.

Organizations without in-house legal or security staff benefit from settling this in advance: an outside employment attorney, the insurance carrier's employment-practices contact if one exists, an HR lead who owns candidate communications, and a safety contact if the organization has one. Deciding who fills each role now, rather than while a message sits unanswered, keeps a real incident from stalling on who's supposed to handle it.

Step 4: Decide whether and how to reply

A reconsideration or feedback request is one situation where HR can often respond directly, but only if no other trigger from the table is present and the organization's disclosure policy allows it. Favoring factual, neutral language over commentary on a candidate's fit or character is a cautious approach worth adopting on its own merits: subjective statements about a candidate's character are harder to defend later if the decision gets questioned. That's this guide's own recommendation, not a rule drawn from any cited standard.

A sample acknowledgment, adapted to your organization's actual disclosure policy rather than sent as written:

"Thank you for reaching out. Our hiring decisions are based on the qualifications and criteria set for the role. We're not able to share additional detail about the evaluation, but we appreciate the time you put into the process."

For a message involving exposed personal information, keep any reply narrowly focused on the safety issue rather than the hiring decision, and only after the designated contact has cleared it:

"We've received your message and are looking into it. Someone from our team will follow up separately."

Handling the information itself matters as much as the reply. Don't forward it broadly across the organization; send it through whatever channel your policy treats as secure, restrict access to people with an authorized business need, and ask the privacy or security lead how it should be stored once the immediate review is done.

For a public post or review, the Glassdoor Employer Center describes tools for responding to reviews and flagging policy-violating content, and notes that employers shouldn't offer anything of value in exchange for a review's removal. That reflects Glassdoor's policy at the time of writing; platforms change these rules, and sites like Google, LinkedIn, or Indeed set their own, so confirm the current policy directly on each platform before acting rather than assuming it matches what's described here. Reporting a post through a platform's tools addresses whether it violates that platform's terms, not whether the underlying allegation is true.

For anything routed to counsel or a safety contact, wait for their direction before sending anything substantive. Whether a brief acknowledgment is appropriate in the meantime is their call, based on the organization's policy, not the hiring manager's.

A few things to avoid regardless of trigger:

Editing old interview notes, or asking interviewers to add detail after the fact
Getting into a public back-and-forth over a post or an allegation
Promising a confidentiality outcome, investigation timeline, or result the organization can't guarantee
Replying from a personal email or social account

Step 5: Review the hiring file without rewriting it

A file review compares what already exists. It isn't an opportunity to build new justification after a complaint has surfaced.

Have HR, not the hiring manager alone, pull the job posting and criteria, the interview notes taken at the time, any assessment results, and the rejection message that was sent. Federal recordkeeping and anti-discrimination laws cover what hiring records to keep and which laws govern the decision, but they don't instruct an employer on comparing candidates internally; that process is left to organizational policy and counsel's judgment.

Whether the review needs records for other candidates considered for the same role is a decision for HR or counsel to make deliberately, not a default step. Pulling comparator files exposes other applicants' personal information and can create its own handling obligations, so limit access to people with an authorized business need under the organization's policy and pull only what's relevant to the specific allegation.

Preserve the original records as they are; don't alter or backdate anything in them. If counsel decides additional analysis is needed, ask how it should be documented rather than adding notes directly into the existing file, since practices differ by organization and by privilege considerations.

What to do next

Turn this into a one-page reference before the next message arrives:

HR contact who owns candidate communications, confirmed by a set date
Outside employment attorney or insurance carrier contact, saved to the reference in advance rather than searched for after a message shows up
Designated safety or security contact, if the organization has one
The escalation-record fields and email template from Step 1, saved somewhere a manager can find them under pressure
A note on who approves acknowledgment language and how

Have employment counsel review the finished reference, not just this guide, since state law and internal policy both shape what's appropriate to send. Then test it against a public review naming an employee and a message alleging discrimination that mentions a possible charge. If either scenario turns up a missing contact or an unclear approval step, fix the reference before a real message arrives.

How HR Should Respond to a Rejected Candidate's 'Expose' Threat