How candidate data rules affect employer branding claims

What to take away

Why employer branding depends on data protection

Employer branding promises a fair, modern workplace. That promise is only credible if candidate data is handled properly. A careers page saying you value transparency, while your application form shares data with external partners without explaining why, creates a gap candidates notice.

Across the UK, recruitment data is governed by the UK GDPR and the Data Protection Act 2018; the Information Commissioner's Office (ICO) is the data protection regulator. The ICO's Guidance on AI and data protection explains how data protection requirements apply to AI. If your brand says you hire on merit, your screening tools and practices need to support that claim.

Under UK GDPR Article 6, a recruiter must identify and document a lawful basis for each processing purpose. The six bases are consent, contract, legal obligation, vital interests, public task and legitimate interests; choose the basis that genuinely fits the use rather than treating consent as a default.

What candidates can request

A candidate can make a subject access request (SAR) under UK GDPR Article 15 to ask for their personal data and related information. Respond without undue delay and normally within one month of receiving the request; this can be extended by up to two further months for complex or multiple requests, with notice and reasons given within the first month. A clear, timely process supports claims that applicants are treated with respect.

UK GDPR does not set one universal retention period for unsuccessful applicants' CVs. A policy might set six or twelve months as examples, but neither is a statutory default; choose and document a period justified by the purpose, then erase or anonymise data when it is no longer needed.

An organisation acting as a data controller generally must pay the ICO data protection fee unless an exemption applies under the Data Protection (Charges and Information) Regulations 2018. Check the ICO's fee self-assessment and keep a record of the outcome.

Where employer branding claims go wrong

A common error is claiming a process is unbiased while using a tool nobody has tested. Another is promising feedback to every applicant without the capacity to give it. Both create a mismatch between brand and practice.

A recruitment privacy notice is part of how you explain data use to candidates, not a substitute for accurate employer-branding claims. Make sure the careers page, privacy notice and actual handling of candidate data are consistent.

AI tools, contracts and fair recruitment

For recruitment AI, identify a lawful basis and complete a data protection impact assessment (DPIA) before processing that is likely to result in high risk. Branding that mentions innovation should also describe the tool's actual role and any human review accurately.

UK GDPR Article 22 is the legal hook for decisions based solely on automated processing that have legal or similarly significant effects. It provides protections including, where applicable, human intervention, the opportunity to express a point of view and the ability to contest the decision.

Acas's Recruitment and selection guidance describes fair, objective and consistent selection practices. Following it gives you something concrete to point to when a candidate questions your process.

Illustrative remediation costs

As a hypothetical, consider a retailer whose careers site claims fully automated fair hiring. A candidate requests their data and finds that an untested tool scored their rejected application without human review.

The following amounts are illustrative planning assumptions, not reported case costs, quotes or standard remediation costs: a hypothetical complaint and review might involve around £8,000 in staff time and legal review, while retraining hiring managers and rebuilding the application process might be budgeted at £12,000. No fine is automatic, but the brand damage from a public complaint is harder to price.

For related UK-wide coverage of employer branding rules and compliance, see our UK rules and compliance guide.

Keeping marketing claims accurate

Your careers site should describe the hiring process as it actually works. If a human reviews every rejection, say so. If AI ranks candidates, explain the role it plays and how someone can ask for review.

Employment contract terms shown in job adverts must reflect the real offer. GOV.UK sets out the rules on written statements and working hours, and a mismatch between advert and contract is a quick route to a dispute.

Common questions

Does the UK GDPR apply to speculative CVs we keep on file?

Yes, if you hold personal data about an identifiable person, the UK GDPR applies. You need a lawful basis and a retention period, and you should tell the candidate how long you will keep it.

Can we use AI to rank applicants and still claim fair hiring?

You can, but the ICO expects you to assess the tool, document the risks and keep human oversight of decisions that significantly affect people. Your brand claim should describe that process honestly.

What should a careers page say about data use?

It should link to a privacy notice covering recruitment, state what data you collect, why, how long you keep it and who you share it with. Keep the language plain and consistent with your application form.

Do we need a data protection impact assessment for recruitment tools?

Often yes, particularly for large-scale or automated screening. The ICO's AI guidance explains when a DPIA is expected and what it should cover. Take advice if your use is complex.

This is general guidance only, not legal advice. Individual cases need a qualified adviser.