The Information Commissioner's Office, the UK data protection regulator, has published “Recruitment rewired”, with findings and regulatory expectations on automation in recruitment. The document draws on voluntary discussions with more than 30 employers between March 2025 and January 2026.

The systems can support application screening, assessment or the ranking of profiles. The ICO stresses that technology does not relieve employers of duties to process personal data lawfully, fairly and transparently.

The findings indicate that many employers in practice rely on solely automated decisions with significant effects on candidates. Such cases fall under UK GDPR provisions on solely automated decision-making, which require stricter safeguards than those observed so far.

Organisations must explain what data is collected, why, and whether a decision is made or influenced by automation. A vague notice is not enough. Human oversight, if claimed, must be real and applied consistently, not merely formal.

The report also calls for impact assessments, data quality and testing for potentially discriminatory outcomes. The employer remains accountable even when a tool comes from an external supplier. The material is not an audit and does not prohibit automation.

The practical message is to check compliance before deployment and throughout use. The ICO treats the topic as a regulatory priority, not as a general ban on such tools.

Image: Loominade, LOOM office workspace, 19 September 2020, CC0, Wikimedia Commons. An empty office, no identifiable candidates. Cropped to 16:9.

Source consulted: Recruitment rewired — Information Commissioner's Office.