AI Recruitment Candidate Data Privacy UK

UK GDPR does not pause because the person reviewing an application is a piece of software instead of a person. The moment your AI recruitment tool ingests a candidate's CV, covering letter, or answers to screening questions, that data is personal data under UK GDPR, and every one of the usual obligations, lawful basis, purpose limitation, storage limitation, applies in full.

The plain-English answer

Using an AI screening tool to process job applications is legal under UK GDPR. What isn't automatically legal is what a lot of businesses do around it by default: collecting more candidate data than the role needs, keeping rejected applicants' data indefinitely "just in case," and giving candidates no real way to find out how a decision about them was made. Those are the three areas the ICO has specifically flagged after auditing AI recruitment tools operating in the UK market.

Why this matters for your business

A 40-person logistics company running 200 applications a week through an AI screening tool isn't a hypothetical, it's a fairly typical mid-size UK employer. At that volume, a manual data retention process breaks down fast unless it's built into the hiring workflow from the start. The risk isn't abstract: the ICO can open an investigation off the back of a single candidate complaint, and "we didn't think about it" is not a defence once your business is the data controller for that person's information.

There's also a quieter cost. Candidates increasingly ask what happens to their data after they apply, and a business that can't answer clearly looks worse than one that never used an AI tool at all. Getting this right isn't only a compliance exercise, it's part of how a candidate experiences your business before they've even had an interview.

What UK data protection law actually says

The relevant framework is UK GDPR, enforced by the Information Commissioner's Office (ICO). Between August 2023 and May 2024, the ICO carried out consensual audits of AI recruitment tool providers operating in the UK and published a report of its findings and recommendations. The report doesn't create new law, it clarifies how existing UK GDPR obligations apply specifically to AI-driven sourcing, screening, and selection tools, and it's the clearest signal available on what UK regulators actually look for in this area.

Three of the ICO's findings are the ones most relevant to a business using, not building, an AI screening tool. First, on data minimisation: the ICO found some tools collected far more personal information than the role required, and retained it indefinitely to build searchable candidate databases without those candidates' knowledge. Second, on fairness and bias: the ICO's guidance calls for monitoring a tool's performance to check it isn't systematically disadvantaging candidates who share a protected characteristic. Third, on human oversight: where a tool makes or heavily influences a decision about a candidate, the ICO's guidance points toward a straightforward way for that candidate to understand and challenge the outcome, automated decisions should not be the final word with no route to human review. Read the ICO's own summary of its AI recruitment audit findings for the full detail, and its guidance on special category data if your screening process touches health, disability, or similar sensitive information.

What this looks like in practice

Picture the HR manager at a 40-person logistics company, running roughly 200 applications a week through an AI tool that ranks candidates automatically before a human looks at the shortlist. Left on the tool's default settings, rejected candidates' full application data, CV, cover letter, screening answers, sits in the system indefinitely. Nobody made a decision to keep it that long, it's simply what happens when retention isn't actively managed.

The fix isn't complicated once it's deliberate. The HR manager sets a written retention policy: shortlisted candidates' data is kept for the length of the hiring process plus a defined period afterwards, in case a dispute arises or a similar role reopens. Everyone else's data is deleted or anonymised on a fixed schedule, typically within a few months of the role closing. That single change turns an open-ended liability into a bounded, defensible process, and it's exactly the kind of evidence an ICO investigation looks for if a complaint ever lands.

What you can do about it

A few practical steps cover most of the ICO's stated concerns without needing a legal team to implement them:

• Set a written retention period for rejected candidates' data, and configure the AI tool to delete or anonymise it automatically once that period passes.
• Check what data the tool actually collects by default. Many pull in more than the role needs, including social media activity or inferred demographic signals, and turn off anything you don't have a genuine reason to keep.
• Ask the vendor directly whether any decision is ever made by the tool alone with no human review, and if so, build a manual review step into your process before you get the answer.
• Tell candidates, in plain language on the application page, that an AI tool is used in screening and where they can go for more detail.

For a broader look at vetting an AI vendor before you commit to one, see our AI vendor due diligence checklist. For the wider legal picture on recruitment tools generally, beyond data privacy specifically, see AI recruitment tools: what's legal and what's not.

Related reading: our AI governance by region.

Free tools: AI Privacy Risk Scorer to score your current AI tool setup against data-privacy best practice | AI Compliance Checker to check whether your AI tools meet your compliance obligations.