Perhaps "quickly enough" is over 3 years. Regardless even when it does go poorly with one candidate, I've had 3 years of people I've at least been a normal person to, instead of acting like a drone who is constantly afraid of the proverbial lawsuits from candidates.
Caveats: this is in Australia, and I believe we've had legal advice a few times encouraging us to stop, because it could expose us to litigation.
The situation in the EU is the exact opposite. As any company can be compelled to disclose electronic records, and all recruitment is done that way now, good companies get ahead of GDPR requests by proactively providing feedback.
Source: recent experience on both sides of the table. Location: South Wales.
OTOH, sounds like you made the right call on hiring :)