How ICO AI guidance affects candidate screening in UK recruitment marketing

What to take away

What ICO AI guidance requires when screening candidates

The ICO's AI guidance applies to any recruitment marketing tool that sorts, scores or filters applicants. It sets out principles covering lawfulness, fairness and transparency, and expects you to minimise data and set storage limits.

The documents that matter are the ICO's Guidance on AI and data protection and Explaining decisions made with AI, which the ICO published with the Alan Turing Institute in May 2020. The AI guidance is published chapter by chapter and each page carries a last updated date, so check the version you rely on.

The guidance expects you to use AI in a way that is transparent and fair. You should tell candidates when AI is used, what data it processes and what effect it has. You should also check for bias and keep records of your decisions.

The ICO artificial intelligence guidance is the reference point for how the regulator expects UK employers to run AI recruitment screening.

Under UK GDPR, you need a lawful basis before you process candidate data. The UK GDPR guidance and resources explain that you must also meet the principles in Article 5. For recruitment marketing, that means you cannot collect CVs, test results or video interview data without a clear reason and a defined retention period.

Automated shortlisting is a form of profiling. It can be lawful, but only if you have thought about the risks and can justify them. The ICO expects you to document your reasoning and to avoid using sensitive data, such as health or ethnicity, unless you have a specific legal condition.

In practice, that means removing unnecessary fields from application forms and telling your AI vendor not to infer protected characteristics.

Your recruitment marketing team should work with your data protection officer from the start. If you are planning a new AI screening tool, involve them before you sign a contract. The ICO's AI guidance sets the compliance tasks, and the budget follows from them: a DPIA, bias testing and a human review step, rather than the licence fee.

Automated shortlisting under UK GDPR: lawful basis and transparency

Automated shortlisting means using software to rank, score or reject candidates without a human making the first decision. Under UK GDPR, you need a lawful basis for this processing. The most common bases are legitimate interests, consent and, in limited cases, contractual necessity.

For job applicants, legitimate interests is often the most practical, but you must carry out a legitimate interests assessment and record it.

For example, a recruitment team wants to rank applications before a recruiter reads them. The purpose test records why: to reach a decision faster when a role attracts more applications than the team can read, so good candidates are not lost.

The necessity test asks whether a manual sift against a scoring grid would work as well. If the team cannot sift at that volume, necessity is easier to justify.

The balancing test weighs the candidate's reasonable expectations against the employer's interest. Applicants expect their application to be read; they do not expect a score they cannot see. Removing names, addresses and dates of birth reduces the effect on candidates.

The team records the three tests, the mitigations, the retention period and a review date, and files the assessment with the DPIA.

The ICO's lawful basis guidance explains that you must identify your basis before you start processing and tell candidates what it is. You cannot switch basis later without a good reason.

If you rely on consent, it must be freely given, specific, informed and unambiguous. In an employment context, consent can be difficult because of the power imbalance between employer and applicant.

Transparency is not just a privacy notice. You must give candidates meaningful information about the logic involved in automated shortlisting, as well as the significance and envisaged consequences. A generic statement that you use AI is not enough.

You should explain what data the AI uses, how it weighs that data and what a candidate can do if they want a human to look at their application.

You also need to meet the accuracy principle. If your AI screening tool makes mistakes, such as rejecting a candidate because of a formatting error in their CV, you must correct them. The ICO expects you to have processes for checking accuracy and for handling complaints. That includes keeping a record of the data you used and the outcome.

Here are the steps to set up automated shortlisting lawfully:

Consent, legitimate interests and talent pool data in recruitment marketing

Recruitment marketing often involves building a talent pool. You collect details from people who are not yet applicants, perhaps through a careers site, a job alert or an event. Under UK GDPR, you need a lawful basis for holding and using that data. Consent is one option, but it must be specific to the purpose.

If you want to send marketing about future roles, ask for consent separately from the application process. Do not bundle it with terms and conditions, and do not treat an application as a marketing opt-in.

Legitimate interests can work for talent pools if your interest is not overridden by the individual's rights. Consider the reasonable expectations of the person. Someone who signs up for job alerts may expect to hear about relevant roles, but may not expect AI profiling.

The ICO's employment information confirms that employers must respect the rights of workers and applicants, including the right to object.

Consent must be easy to withdraw. If you rely on consent for talent pool marketing, provide a simple opt-out in every message and act on it promptly. You should also refresh consent at reasonable intervals. If you cannot show that consent is still valid, stop using the data for marketing and consider deleting it.

Candidate data compliance means keeping your talent pool clean. Do not keep data indefinitely. Set a retention period, such as 12 months for general talent pools, and delete or anonymise data when it expires. If you want to keep data longer, you need a reason that fits your lawful basis and you should tell the individual.

Two other periods come up often. Interview notes and assessment records are often kept for six months after the decision. That covers the usual tribunal window: most claims must be brought within three months less one day of the act complained of, and Acas early conciliation can add up to six weeks.

Where you keep records specifically to answer a claim, hold them until that window closes. UK GDPR sets no fixed number, so your purpose, your audit needs and the limitation periods determine what you can justify.

A checklist for talent pool data:

Candidate data flows between ATS, CRM and AI screening tools

Most employers use an applicant tracking system (ATS) and a candidate relationship management (CRM) system, plus one or more AI screening tools. Data flows between these systems, and each flow is a processing operation. You need to map those flows and understand what happens at each stage.

That means knowing what data goes in, what comes out, who can see it and where it is stored.

A typical flow starts when a candidate applies through your careers site. Their data goes into the ATS. If you use an AI screening tool, the ATS may send data to that tool, which returns a score or ranking. If you also use a CRM for talent pooling, data may be copied there.

Each transfer needs a lawful basis and a contract that meets UK GDPR requirements.

You should document your data flows in a record of processing activities. You must be able to find and retrieve a candidate's data across all systems when they make a request. If your data is spread across multiple tools and you cannot link it, you will struggle to comply.

International transfers are common with AI vendors. If your AI screening tool stores or processes data outside the UK, you need a transfer mechanism, such as the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses.

Adequacy regulations are the simplest route, and they cover the EEA, Switzerland, Japan, South Korea and Canada for commercial organisations. UK Binding Corporate Rules suit transfers within a corporate group, and the UK Extension to the EU-US Data Privacy Framework covers certified US organisations.

Article 49 derogations, such as explicit consent, are a fallback for occasional transfers rather than a routine basis for screening. You should also check whether the vendor uses sub-processors and where they are located.

Data minimisation matters. Do not send more data to the AI tool than it needs. If the tool only needs to analyse skills and experience, do not send names, addresses or dates of birth. This reduces risk and makes it easier to comply with the accuracy and storage limitation principles.

When you audit employer branding tool data, check each connection between your ATS, CRM and AI tools. Look for manual exports, API links and any shadow systems that marketing teams may have set up.

Profiling, significant decisions and Article 22 rights for applicants

Article 22 of UK GDPR gives individuals the right not to be subject to a decision based solely on automated processing that produces legal effects or similarly significantly affects them. In recruitment, a decision to reject a candidate at the shortlisting stage can be a significant decision.

If your AI tool automatically rejects candidates without human involvement, Article 22 may apply.

There are exceptions. You can use solely automated decisions if they are necessary for entering into or performing a contract, if they are authorised by law, or if you have explicit consent. In an employment context, consent is rarely valid because of the imbalance of power.

Contract necessity is also a high bar. Most employers should therefore ensure that a human reviews any automated rejection before it becomes final. Refusing an applicant a role is not necessary for entering into a contract with that applicant, so an automated rejection cannot normally rely on that exception.

Decisions that use special category data, such as ethnicity or health, need a further condition, either explicit consent or a substantial public interest, plus safeguards for the candidate.

Even if a human is involved, the decision may still be considered automated if the human simply rubber-stamps the AI output. The ICO expects human review to be meaningful. The reviewer should have the authority and the information to change the decision, and should consider the candidate's circumstances.

You must tell candidates about solely automated decisions, the logic involved and the consequences. You must also give them the right to request human intervention, to express their point of view and to contest the decision.

Your recruitment marketing workflow should include a clear way for candidates to do this, such as a link in the rejection email or a contact point in your privacy notice.

If you use AI to rank candidates but a human makes the final call, explain what data is used and how it affects the ranking. You should also consider whether the profiling could lead to discrimination under the Equality Act 2010, and take steps to prevent it.

Bias testing under the Equality Act 2010 looks at outcomes, not intentions. Compare selection rates by sex, ethnicity, age and disability at each stage of the process, and check whether the pass rate for one group is markedly lower than another. The four-fifths rule, a rule of thumb from US guidance, flags a ratio below 0.8 for review.

Where you cannot hold protected characteristic data for every candidate, run masking tests: remove names, postcodes, schools and employment gaps from the data and see whether the ranking changes. Check whether the tool disadvantages disabled candidates, for example through timed tests or video analysis, because the duty to make reasonable adjustments applies to your process.

Monitoring data of this kind is special category data, so you need an Article 9 condition such as equality of opportunity or treatment, and you should anonymise it as soon as possible. Indirect discrimination under section 19 of the Equality Act 2010 can arise from a provision, criterion or practice, and an AI tool can be one.

Data protection is part of good employment practice, not a separate exercise. Build the human review step into your recruitment marketing workflow so that it happens by default rather than on request.

Data protection impact assessments for AI recruitment marketing

You must carry out a data protection impact assessment (DPIA) if processing is likely to pose a high risk to individuals. AI screening tools that profile candidates often meet that threshold. The ICO expects you to carry out a DPIA before you start processing, and to consult your data protection officer if you have one.

A DPIA should describe the processing, assess the necessity and proportionality, identify risks and set out measures to address them. For AI recruitment marketing, cover the AI tool's purpose, the data it uses, the logic, the outputs and the benefits.

The ICO publishes a sample DPIA template and a screening checklist. Its list of processing likely to need a DPIA includes automated decision-making with a significant effect, large scale processing and the use of new technology. AI screening that scores every applicant will often meet more than one of those grounds.

You should also consider the risks to candidates, such as bias, lack of transparency and the impact of a rejection.

You should involve stakeholders, including your recruitment team, your DPO, your IT and security teams and, where appropriate, candidate representatives. You should keep your DPIA under review and update it when you change your tools or processes.

If your DPIA identifies a high risk that you cannot mitigate, you must consult the ICO before processing. That is rare, but it can happen with novel AI uses. You should also consider whether you need to consult other regulators, such as the Equality and Human Rights Commission, if your tool could lead to discrimination.

Where you do have to consult the ICO, the regulator aims to respond within eight weeks and can extend that by six weeks for complex processing. Keep the consultation and the response with the DPIA record.

A DPIA is not a one-off document. You should treat it as a living record. When you add a new AI feature or change your data flows, you should revisit it. That helps you show accountability and makes it easier to answer questions from candidates or the regulator.

A UK employer wants to use an AI tool to rank graduate applications. They carry out a DPIA, identify a risk of bias against candidates from certain universities, and mitigate it by removing university names from the data sent to the tool.

They also add a human review step for any candidate who is automatically rejected. They record the DPIA and review it every six months.

Individual rights requests from candidates and how to answer them

Candidates have rights under UK GDPR, including access, rectification, erasure, restriction and objection. They also have rights related to automated decision-making. You must respond to these requests within one month, although you can extend that by two months for complex requests. You should not charge a fee unless the request is manifestly unfounded or excessive.

A common request is a subject access request. A candidate may ask for a copy of their data, including AI scores and notes. You must provide the data in a concise, transparent, intelligible and easily accessible form. If you used an AI tool, you should explain how it was used and what the output was, unless an exemption applies.

The right to erasure can apply when the data is no longer necessary for the purpose you collected it. If you have a retention policy that says you keep unsuccessful candidate data for 12 months, you should delete it after that unless you have a lawful reason to keep it.

If a candidate asks for erasure earlier, you should consider the request and respond.

The right to object applies when you rely on legitimate interests or public task. If a candidate objects to AI profiling for recruitment marketing, you should stop processing their data for that purpose unless you can show compelling legitimate grounds that override their interests. In practice, it is often easier to remove them from the talent pool.

You should have a process for handling requests. That includes a single point of contact, a log of requests and responses, and a way to verify identity. The ICO's individual rights guidance sets out the details.

You should also train your recruitment marketing team to recognise a request and pass it to the right person quickly.

Good records also help if a candidate complains to the ICO. You may need to show your DPIA, your lawful basis assessment and your data flow maps, so keep them together and dated.

Supplier contracts and accountability for AI screening vendors

When you use an AI screening vendor, you are the controller and the vendor is usually a processor. You need a written contract that meets Article 28 of UK GDPR.

The contract must cover the subject matter and duration of processing. It should also state the nature and purpose, the types of personal data and the obligations of the controller.

The contract should also include specific terms for AI. For example, the vendor should not use your candidate data for its own purposes, such as training its models, unless you have agreed and have a lawful basis. You should require the vendor to assist with individual rights requests and with DPIAs.

You should also set out security measures, breach notification and audit rights.

You should check where the vendor processes data and whether it uses sub-processors. If data goes outside the UK, you need a transfer mechanism. You should also check the vendor's security certifications and its track record. Ask the vendor how the model works and what risks it poses before you sign.

Accountability is not just about contracts. Monitor the vendor's performance and review it regularly. If the vendor changes its model or its data sources, update your DPIA and your privacy notice. You should also have an exit plan in case you need to change vendors, including how you will retrieve or delete your data.

Common questions