AI in Recruitment: What Employers Must Check Under UK Data Protection Law

Automated tools are now common in hiring, from CV screening to online assessments. For employers in the UK, the Information Commissioner's Office (ICO) has set out what it expects. This guide summarises the ICO's published material on AI in recruitment, so that HR teams and hiring managers know which questions to ask before they buy or switch on a tool. It covers UK data protection law. Irish employers fall under the GDPR as applied in Ireland, where the regulator is the Data Protection Commission, so check its guidance too. For wider context on fair hiring, see our guide to fair and inclusive recruitment for hiring managers.

What the ICO has looked at

In November 2024 the ICO published an overview of its consensual audit engagements with developers and providers of AI-powered sourcing, screening and selection tools. The ICO says AI recruitment tools can benefit employers but can also create risks for people's privacy and information rights. In its March 2026 update, the ICO says that in 2024 it audited several AI recruitment providers and developers and made almost 300 recommendations.

On 31 March 2026 the ICO published an update called "Recruitment rewired". It is based on voluntary conversations with more than 30 employers between March 2025 and January 2026, and it is not an audit or an investigation. The ICO says automated decision-making was mostly used at the early stages of hiring, and that it wrote to 16 organisations likely to be using it, which committed to act on its recommendations.

The ICO's six questions before you use an AI recruitment tool

In its November 2024 blog on key data protection considerations, the ICO lists six things organisations should address when they procure an AI tool for recruitment.

1. Complete a data protection impact assessment (DPIA). The ICO says to do this before using the tool, "ideally at the procurement stage", and to keep it up to date.
2. Identify a lawful basis. The ICO gives consent and legitimate interests as examples. If you process special category data, you also need a specific condition under the law.
3. Be clear about roles and contracts. Identify who is the controller and who is the processor, and record this clearly in a contract. Where the provider is a processor, the ICO says to set explicit written instructions and performance measures, such as targets for statistical accuracy and bias.
4. Monitor for fairness, accuracy and bias. Raise any issues with the provider and seek assurances that bias has been mitigated.
5. Be transparent. Give candidates clear privacy information that explains how the tool works and how they can challenge automated decisions.
6. Minimise data. Make sure the tool collects only the minimum personal information required, and that it is not used for incompatible purposes.

Solely automated decisions: the ICO's main concern

The ICO's key finding in "Recruitment rewired" is that many employers using automated recruitment are likely relying on solely automated decisions. The ICO describes these as decisions with no meaningful human involvement that have a legal or similarly significant effect. When that is the case, the UK GDPR's provisions on solely automated decision-making apply, and the ICO says employers' current safeguards fall short of what those provisions require. The ICO's notes cite Article 22A of the UK GDPR for this definition.

The ICO also points out that the Data (Use and Access) Act 2025 updated data protection legislation, including by making it easier to use automation to make decisions without human involvement. The pages reviewed for this post do not set out the detail of those changes, so check the ICO's current automated decision-making guidance rather than relying on a summary.

The ICO also launched a consultation on draft automated decision-making guidance on 31 March 2026, which it said would run until 29 May. The ICO's page on its planned guidance lists the consultation as closed and the final guidance as expected in winter 2026, with no exact date. Check the ICO website for the current status.

What the ICO says employers should do

From the March 2026 material, the ICO's expectations for employers using automated hiring tools include the following:

• Tell candidates clearly when automated decision-making is used, including when decisions are solely automated, and explain how it works.
• Tell candidates how to challenge a decision and ask for a human review if they believe it is wrong.
• Where human involvement is used, apply it consistently to all candidates at each stage of hiring.
• Test regularly for biased outputs and mitigate them. The ICO suggests asking software developers about their bias testing and considering monthly bias reviews.
• Apply data protection law correctly when adopting new tools.

The ICO says its public research found people accept that automation can reduce bias, but worry it could add new bias, especially with profiling-based tools such as online behavioural assessments.

Practical steps for HR teams (our suggestions)

The points below are Learnsignal's own practical suggestions for turning the ICO's material into a working process. They are not ICO guidance.

• Keep a list of every automated step in your hiring process, so you can see where decisions are made without a person.
• Ask suppliers for their bias-testing results and put the answers on file alongside the contract.
• Check that the privacy information candidates see matches how the tool really works.
• Make sure the people who review or challenge decisions have been trained for the task. Our guide to AI literacy at work covers what staff need to understand about the tools they use.

Frequently asked questions

Does this apply if a person makes the final decision?

The ICO's concern is with decisions that have no meaningful human involvement. The pages reviewed for this post do not explain in detail what makes human involvement meaningful, so check the ICO's current automated decision-making guidance for that point.

Do we need a DPIA for an AI recruitment tool?

The ICO says to complete one before using the tool, ideally at the procurement stage, and to keep it up to date.

Is the provider or the employer responsible?

The ICO says to identify who is the controller and who is the processor and to record this clearly in a contract. That decides who carries which responsibilities.

If your team uses AI tools more widely, our guide to using generative AI at work and data protection covers the general principles, and our CPD courses can support your staff training.

This article is general information based on ICO publications and is not legal advice. Check the ICO website for the current position.