UK GDPR Compliance Checklist for AI Screening Tools

If you are the compliance officer, DPO or in-house counsel who has to sign off an AI CV screening tool, the vendor's assurance slide is not evidence. You need to work through the actual obligations and record your conclusions, because if it goes wrong the question will be what assessment you performed, not what the supplier told you.

This is a working UK GDPR compliance checklist for AI screening tools, organised in the order an assessment usually needs to run. It is written for the person doing the review rather than the person buying the product.

1. Purpose and Lawful Basis

Is the processing purpose defined narrowly and specifically, rather than as "recruitment"?
Which lawful basis applies? For recruitment screening, legitimate interests is commonly relied on; consent is usually inappropriate because of the power imbalance and because you will process the application regardless.
If relying on legitimate interests, has a legitimate interests assessment been completed and recorded, covering the purpose, the necessity of this processing to achieve it, and the balance against candidates' rights?
Is the assessment method necessary and proportionate to the decision being made, or are you processing more than the decision requires?

2. Transparency

Does your candidate privacy notice state that automated tools assist in assessment?
Does it explain, in plain language, what is assessed and what role a human plays in the outcome?
Is it provided at or before the point of application, not buried post-submission?
Does it identify categories of recipients, including the screening supplier and any onward sub-processors?
Does it state retention periods for applications and for assessment records?
Are international transfers disclosed, with the safeguard identified?

3. Data Protection Impact Assessment

Has a DPIA been completed before processing began? Large-scale automated evaluation of individuals is the kind of processing that ordinarily requires one.
Does it describe the processing, assess necessity and proportionality, identify risks to candidates and set out mitigations?
Does it specifically address the risk of discriminatory outcomes, not just security risk?
Has the DPO been consulted and the advice recorded?
Is there a review trigger, so material changes to the tool or its configuration prompt reassessment?

4. Automated Decision-Making and Human Involvement

This section carries the most risk and deserves the most care.

Is any decision with significant effect on a candidate made solely by automated means? If so, it is restricted and you need to establish an applicable exception plus the required safeguards, or redesign.
If a human is in the loop, is the involvement meaningful? Test honestly: does the reviewer have authority to reach a different conclusion, access to the underlying evidence rather than only a score, sufficient time to consider it, and competence to assess it?
Is the human decision recorded, with the reviewer identified and a reason captured?
Are override rates monitored? Near-zero overrides suggest rubber-stamping, which means the involvement is nominal rather than meaningful.
Can candidates obtain an explanation of an assessment affecting them, in terms they can understand?
Is there a route to contest an outcome and have it reviewed by a person?

5. Data Minimisation

Are only the fields necessary for assessment processed? Date of birth, national insurance number, full address and equality monitoring data are typically unnecessary for screening.
Is equality monitoring data held separately from the assessment process, so it cannot influence scoring?
Where policy requires anonymised sifting, is anonymisation applied to the text being assessed rather than only to the display?
Are features with no job-related justification excluded from scoring? Postcode, institution name and employment continuity all act as proxies for protected characteristics.

6. Special Category and Criminal Offence Data

CVs and covering letters frequently contain health information, religious affiliation via organisational membership, or other special category data that you never asked for. Is there a position on how incidental special category data is handled?
Is it excluded from scoring, and is that exclusion technically enforced rather than a policy statement?
If criminal offence data is processed, is there an identified condition for doing so and an appropriate policy document in place?

7. Accuracy

Are parsed and inferred fields distinguished from asserted fields? A model's inference about seniority is not a fact the candidate stated.
Are unverified credential claims labelled as unverified so downstream readers do not treat parsing as proof?
Is there a correction route if a parsing error affects a candidate?
Is known error behaviour documented, including how the tool handles non-standard CV formats, career breaks and overseas qualifications?

8. Fairness and Discrimination Testing

Is outcome data monitored by protected characteristic at cohort level, using monitoring data held separately from assessment?
Is there a defined response if a disparity without job-related justification is found?
Has the risk of fluency bias been considered? Systems that reward polished prose advantage first-language English speakers and coached applicants, with no job-related justification for most roles.
If any component learns from historic decisions, is it understood what it learned from, and whether that encodes past patterns you are trying to move away from?
For public authorities, has the equality duty been discharged and documented in respect of the adoption decision itself?

9. Retention and Deletion

Is there a stated retention period for unsuccessful applications, and a separate one for assessment records?
Is deletion enforced automatically, or does it depend on someone remembering?
Where a working copy has been exported to a screening tool, does that copy have its own shorter, enforced lifespan?
Does deletion extend to backups, within a stated timeframe?
Is retention justified by reference to something real, such as the period needed to defend a challenge, rather than by convention?

10. International Transfers

Where is data stored, backed up and replicated, by named region?
Where does model inference run? If an AI feature calls a third-party API abroad, that is a transfer of every CV processed.
Can support or engineering staff outside the UK access production data?
Do logs, error tracking or analytics tools export personal data?
For each transfer identified, is there adequacy or an appropriate safeguard, plus a transfer risk assessment?

11. Model Training

Is candidate data used to train or fine-tune the supplier's models? The answer you want is no.
Is it used to train any third-party model in the processing chain? Terms vary by provider and tier, and change.
Is the position contractual, not merely stated in a policy page that can be edited?
Is there a zero-retention arrangement with any external model provider in the path?

12. Processor Contracts and Supply Chain

Is the supplier engaged as a processor under a contract containing the required terms: processing only on instruction, confidentiality, security, sub-processor authorisation, assistance with rights requests, audit, and deletion or return on termination?
Is there a complete, current sub-processor list with regions and data categories?
Is there notification of sub-processor changes, with a right to object?
Are breach notification obligations and timeframes specified?

13. Security

Encryption in transit and at rest, with key custody identified.
Role-based access control, with least privilege and access logging.
Multi-factor authentication for administrative access.
Recognised independent certification, understood as evidence of process rather than of data location.
Penetration testing cadence and remediation practice.
An incident response plan that names who does what, and within what timeframe.

14. Candidate Rights in Practice

Can you fulfil a subject access request that includes assessment records? Remember that internal scoring notes about a candidate are their personal data.
Can you locate and delete all copies of one candidate's data, including the screening tool's working copy?
Can you rectify an inaccurate parsed field?
Can you handle an objection to processing based on legitimate interests?
Are your scoring rationales written in language you would be content for the candidate to read? They may well read them.

Frequently Asked Questions

Is AI CV Screening Legal Under UK GDPR?

Yes, subject to conditions. The main ones are a valid lawful basis with a recorded assessment, transparency to candidates, a DPIA before large-scale automated evaluation begins, and meaningful human involvement in decisions with significant effects. None of that prohibits AI-assisted screening; it defines how it must be built, documented and operated.

What Counts as Meaningful Human Involvement?

A reviewer with genuine authority to reach a different conclusion, access to the underlying evidence rather than just a score, adequate time, and the competence to assess it. Token confirmation of a machine output is not meaningful, and monitoring your override rate is the practical way to check which one you actually have.

Do We Always Need a DPIA?

You need one where processing is likely to result in high risk, and large-scale automated evaluation of individuals for decisions affecting them generally meets that threshold. In reality, if you are screening substantial applicant volumes with automated assistance, assume yes and document it.

Can We Rely on Consent from Candidates?

Usually not. Consent must be freely given, and a candidate is not in a position to refuse without prejudicing their application, so it fails the test. Legitimate interests, supported by a recorded assessment, is the more defensible basis for recruitment screening.

What Is the Most Frequently Missed Item on This List?

Model inference location, followed by the contractual position on training data. Both concern AI screening specifically, and neither appears on most standard data protection questionnaires, which were written for software that stored data rather than software that transmits it for processing.

Using This List

Work through it, record the answer to each item and the evidence relied on, and keep the record. A completed assessment with documented gaps and mitigations is a far stronger position than an incomplete one with no gaps identified, because the second usually means nobody looked.

CVSense is designed around a zero-model-training position on customer candidate data, localised architecture, evidence attached to every score and a recorded human confirmation behind every outcome, which maps onto sections 4, 10 and 11 above, where most assessments run into trouble. If you need those answers in writing to complete a review, they are available as documentation rather than as a demonstration.

Sources

Information Commissioner's Office. Guidance on AI and Data Protection.
https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/artificial-intelligence/guidance-on-ai-and-data-protection/

Information Commissioner's Office. Data Protection Impact Assessments.
https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/accountability-and-governance/data-protection-impact-assessments-dpias/

Information Commissioner's Office. Rights Related to Automated Decision Making Including Profiling.
https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/individual-rights/individual-rights/rights-related-to-automated-decision-making-including-profiling/

Information Commissioner's Office. International Transfers.
https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/international-transfers/

Information Commissioner's Office. Employment Information and Guidance.
https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/employment/

InsightCircle