UK Data Regulator Calls For Review Of Automated Recruitment

The UK’s Information Commissioner’s Office (“ICO”) has called on businesses to review their use of automated decision-making (“ADM”) in recruitment.

The Data (Use and Access) Act 2025 relaxed existing rules on ADM, permitting its use in broader circumstances (except where special category data is processed), including fully automated decisions without human involvement. The ICO engaged with a selection of employers and found that while automation delivered significant benefits - particularly at early stages of hiring - there was a need for greater transparency, more consistent human involvement, and improved monitoring for bias.

The ICO expects organizations using ADM in recruitment to proactively monitor for bias (including through regular testing and monthly bias reviews), be transparent with jobseekers about how ADM is used, and explain candidates' rights to challenge decisions and request human review. The ICO has launched a consultation on draft ADM guidance, which is open until May 29, 2026.

• Meaningful human involvement: According to the ICO’s proposed guidance, businesses are expected to thoroughly assess the level of human involvement and apply caution in allowing ADM tools to make final decisions, rather than merely analyzing candidate data.
• Transparency and safeguards: The ICO expects businesses to consider whether the privacy information provided to candidates is sufficient to inform candidates that ADM is being used and how their personal data will be processed. The ICO considers that general information and/or references to a third-party privacy policy are unlikely to be sufficient.
• Fairness, bias and discrimination: The ICO’s proposed guidance provides that businesses should consider assessing the fairness of their use of ADM and whether outcomes have resulted in bias or discrimination.
• Data Protection Impact Assessment: The ICO expects businesses to complete a Data Protection Impact Assessment before processing candidate information and to take steps to mitigate any identified risks.

Takeaway: AI is increasingly popular for screening job applications. However, ADM in recruitment is a central area of scrutiny under the ICO's AI strategy. Businesses using AI in recruitment will want to treat compliance as a live regulatory risk and implement appropriate safeguards to protect jobseekers' data protection rights. Businesses should also note that unlike the UK, the EU has not loosened restrictions on ADM in recruitment under the EU GDPR. While individual member states have enacted national provisions authorizing ADM in certain circumstances, fully automated recruitment decisions without meaningful human involvement remain significantly more constrained under both the EU GDPR and member state implementing legislation.