UK data watchdog tells employers: your automated screening is probably illegal
The News
The Information Commissioner's Office has published its long-awaited findings on automated decision-making in UK recruitment, and the conclusion is blunt. After voluntary discussions with more than 30 employers between March 2025 and January 2026, the ICO's key finding is that "many employers engaging in automated recruitment are likely relying on solely automated decisions" — meaning systems that filter, rank, or reject candidates without meaningful human involvement, producing legal or similarly significant effects on individuals.
This places those decisions squarely within the scope of Article 22 of the UK GDPR, which governs solely automated decision-making and imposes a "greater range of safeguards" than the ICO's evidence suggests are currently in place. The report is not an audit or formal investigation — the ICO frames it as a "call to action" — but the direction of travel is clear. The regulator has committed to scrutinising major employers and recruitment platforms, holding organisations to account for failures to respect information rights.
Three areas got specific attention. Transparency: employers must improve how they inform candidates about automated decision-making, including when decisions are made solely by algorithms. Meaningful human involvement: where human review exists, it must be applied consistently to all candidates within a hiring stage — not selectively for the ones a recruiter happens to look at. Fairness and bias monitoring: the ICO wants employers to expand and adopt good practice in monitoring, not just rely on vendor assurances that a tool is fair. The ICO's own public perceptions research found that while the public sees potential value in automated CV filtering, there are significant concerns about new biases — particularly from profiling-based tools like online behavioural assessments.
Why It Matters
The ICO's framing matters as much as the findings. This is not a regulator issuing fines — yet. It's a regulator publishing its expectations, gathering evidence, and telling an entire industry to get its house in order before enforcement begins. For UK TA leaders, the signal is unambiguous: if you cannot demonstrate that a human makes the final decision on every candidate rejection, you are likely in breach of UK GDPR. "The ATS ranked them lower" is not a defence.
This lands at a particularly interesting moment. The ICO published this alongside its broader AI and biometrics strategy, while the EU AI Act's employment deadline looms 30 days away. UK organisations get two regulatory signals simultaneously — one domestic (ICO enforcement posture), one cross-border (EU AI Act deployer obligations) — and the Venn diagram of compliance requirements has a very large overlap.
Taking Action
All action is situated in your corporate context. These are starting points, not prescriptions — choose what fits.
Connect
Who to talk with in your enterprise
Your data protection officer or privacy lead. Has your DPIA for recruitment technology been updated to reflect the ICO's findings on solely automated decision-making? Does it clearly define — for each tool — where the human decision point sits and what evidence proves it?
Your recruitment operations lead. Walk through your screening workflow end to end. At what exact point does a human review a candidate before rejection? If the answer is "the recruiter reviews the shortlist," what happens to candidates who don't make the shortlist? If they're auto-rejected, that's the problem the ICO is flagging.
Inspect
What to take a closer look at
Pick your highest-volume role from the last quarter. Pull the full candidate pipeline for it. Count how many candidates were rejected at each stage. For each rejection stage, identify whether a human made a documented, individual decision — or whether the ATS applied an automated rule (knockout question, score threshold, keyword filter). If any stage rejected candidates without human review, you have found the ICO's target. Now trace whether those candidates were informed that an automated decision was made — and whether they were given a way to contest it.
Reflect
What to think about more deeply
If the ICO required you to justify every automated rejection to the candidate who received it — personally, in writing — how many of your current screening rules would survive that conversation?