Using AI in Recruitment? Your UK DPIA Checklist

The ICO's recruitment guidance says organisations using AI for recruitment and selection must conduct a DPIA because this use is likely to result in high risk, and recommends doing it before processing begins, ideally during procurement. That timing matters: privacy questions are much easier to solve before candidate data has entered a vendor's system.

The DPIA should stay live. If the model, data, purpose, vendor or decision-making workflow changes, revisit the assessment rather than treating it as a one-time procurement document.

• What candidate information enters the system?
• Does the tool score, rank, filter, infer or recommend?
• Does it process special category data or infer sensitive characteristics?
• Which decisions are automated, AI-assisted or entirely human?
• How long is candidate data retained and is it reused to train or improve models?
• Where is the data processed and which subprocessors receive it?

Recruiters should not assume the AI vendor is simply a processor. The ICO says responsibilities depend on who determines the purposes and means of processing. If a provider uses candidate information for its own purposes, for example to develop a shared model, its role may differ for that processing.

Record the roles clearly and make sure processor contracts contain explicit processing instructions where required.

AI does not create a separate lawful basis under UK GDPR. Identify the lawful basis for each processing purpose and, where special category data is involved, the additional condition that permits that processing. The DPIA should test necessity, proportionality and risks to candidates rather than beginning with the assumption that a useful feature is automatically justified.

A recruiter who sees an AI score but routinely accepts it without meaningful scrutiny may have very little practical oversight. Document who can challenge an output, what information they receive, when they must intervene and how candidates can raise concerns or correct inaccurate information.

If the workflow also falls within the EU AI Act, read our recruitment AI high-risk guide. The UK GDPR analysis applies independently of whether the EU AI Act applies.

A good DPIA should result in decisions: controls you add, processing you stop, contractual questions for the vendor and residual risks someone accepts. Clausely's UK GDPR & DPIA Pack covers the privacy evidence set, while the Recruitment AI Pack addresses recruitment-specific AI governance.