Do Recruitment Agencies Need An AI Privacy Policy?

Yes - if your recruitment agency uses AI tools to screen, rank, match or communicate with candidates, your privacy documents need to say so.

The slightly more nuanced answer is that you may not need a separate document called an AI privacy policy. In many cases, you can update your candidate privacy notice, client terms, supplier contracts and internal data processes so they properly cover how your tools work.

AI can be genuinely useful in recruitment. It can help you review large numbers of CVs, match candidates to roles faster and keep your database organised. But because recruitment data is so personal, UK GDPR expects you to be clear, fair and careful about how you use it.

The good news is that this doesn't have to be complicated. You just need to map what your tools are doing, tell candidates in plain English, put the right supplier terms in place and keep a human grip on decisions that affect people's job opportunities.

Do Recruitment Agencies Need A Privacy Policy For AI Tools?

Yes, if you're using AI in your recruitment process, your privacy notice should explain that clearly.

Under the UK GDPR and the Data Protection Act 2018, you need to tell candidates what personal data you collect, why you use it, who you share it with and what rights they have. If AI is involved in screening, matching, ranking or profiling candidates, that's part of how you use their data.

For most recruitment agencies, the better approach is to update your existing documents rather than create a separate AI document that sits on its own. You may need to review:

• Your candidate privacy notice
• Your client privacy notice or client terms
• Your data processing agreements with software providers
• Your data sharing terms with clients
• Your internal data retention policy and information security policy
• Your process for handling candidate access requests and complaints

Say Maya runs a tech recruitment agency in Manchester. Her team uses a platform that scans CVs, extracts skills, gives candidates a suitability score and suggests roles from the agency's database. Even if Maya's consultants make the final call, the scoring process is still a use of personal data. Candidates should be told that this type of matching happens and what it means for them.

A basic privacy notice that only says you collect CVs to provide recruitment services will usually be too light if AI is doing meaningful work behind the scenes.

What Candidate Data Does UK GDPR Protect?

Almost all of the information you handle about candidates will be personal data under UK GDPR.

Recruitment agencies often deal with far more sensitive information than they realise. A CV isn't just a work history. It may reveal a person's age, location, education, employment gaps, salary expectations, career goals and professional networks.

Your recruitment data may include:

• CVs, cover letters and application forms
• Interview notes and call recordings
• References and referee contact details
• Test results, skills assessments and portfolio materials
• AI-generated scores, tags, rankings or recommendations
• Emails, text messages and LinkedIn messages
• Salary, availability and notice period details
• Identity documents and work eligibility information
• Client feedback about a candidate

Some recruitment data may be special category data. This includes information about health, disability, racial or ethnic origin, religion, trade union membership, sexual orientation and biometric data used for identification.

You might collect this directly, such as where a candidate asks for reasonable adjustments. You might also infer it indirectly from a CV, interview notes or screening tool. For example, a CV may refer to a disability advocacy role, religious community work or a health-related career break.

Criminal offence data is treated separately and has extra rules under the Data Protection Act 2018. If your agency deals with background checks or DBS information, you need to be particularly careful about your lawful basis, access controls, retention periods and written policy documents.

AI outputs can also be personal data. If your system produces a score that says a candidate is a 72 percent match for a role, that score is information about an identifiable person. You need to treat it as part of the candidate's data file.

Can You Use AI To Shortlist Candidates Under UK GDPR?

Yes, you can use AI to help shortlist candidates, but you need to do it fairly, transparently and with proper human oversight.

UK GDPR doesn't ban AI recruitment tools. It does expect you to think carefully about risk, especially where technology could affect whether someone gets considered for work.

There are four key issues to get right.

Lawful Basis

You need a lawful basis for processing candidate data. For many recruitment activities, agencies rely on legitimate interests, steps before entering into a contract, or legal obligations depending on what is being done.

Consent isn't always the best fit in recruitment because candidates may feel they have little real choice. If you do use consent, it needs to be freely given, specific, informed and easy to withdraw.

Special category data needs both a lawful basis under Article 6 of UK GDPR and a separate condition under Article 9. Depending on the context, this might relate to employment law obligations, explicit consent for genuinely optional diversity monitoring, or another condition under the Data Protection Act 2018.

Transparency

Candidates shouldn't be left guessing whether a person or a system has assessed them. Your privacy notice should explain the role AI plays in practical terms.

For example, you could say that you use software to help extract skills from CVs, compare profiles against role criteria and suggest potential matches for consultant review. That's clearer than simply saying you use technology to improve services.

Human Review

Articles 22A to 22D of UK GDPR now set out the UK's rules for automated decision-making. A significant decision is one that has a legal or similarly significant effect on a person. In recruitment, automatic rejection, automatic exclusion from a shortlist or a decision that materially affects a job opportunity can be significant. A decision is solely automated where there's no meaningful human involvement.

For significant solely automated decisions, the rules require safeguards. In broad terms, candidates should be given information about the decision-making, be able to make representations, ask for meaningful human intervention and contest the decision. If special category data is involved, extra restrictions can apply.

If your tool only supports your consultants and a trained person makes a meaningful decision, the risk is lower. But the review needs to be real. If your team always accepts the AI ranking without checking it, that may not be meaningful human involvement.

The Data (Use and Access) Act 2025 has changed the UK automated decision-making regime. All data protection provisions are now in force, although some ICO guidance on ADM and profiling is still being updated. For recruitment, it's safest to treat fully automated rejection, ranking or exclusion as high risk and get tailored advice before relying on it.

Fairness And Accuracy

AI tools can make mistakes. They can also amplify bias if they're trained on poor data or if the criteria favour certain career paths, education backgrounds or wording styles.

You should test whether the tool is producing sensible results, keep records of how you use it and give candidates a way to raise concerns. The Equality Act 2010 can also be relevant if your process disadvantages people with protected characteristics.

What Should Your Candidate Privacy Notice Say?

Your candidate privacy notice should explain your AI use in clear, everyday language.

If you collect data directly from a candidate, you should give them privacy information at the time you collect it. If you get their data from another source, such as LinkedIn, a job board, a referral or a client, UK GDPR generally requires you to provide privacy information within a reasonable period and no later than one month, unless an exception applies.

A strong candidate privacy notice for an AI-enabled recruitment agency will usually cover:

• Who you're and how candidates can contact you
• What personal data you collect, including CVs, communications, references and AI-generated outputs
• Where you collect data from, such as candidates, referees, job boards, clients and public professional profiles
• Why you use the data, including recruitment services, candidate matching, client introductions, compliance and database management
• Your lawful bases for processing
• How AI or automated tools are used in screening, matching, ranking or communications
• Whether decisions are made solely by automated means or reviewed by a person
• Who you share data with, including clients, referees, background check providers and software suppliers
• Whether data is transferred outside the UK and what safeguards apply
• How long you keep candidate data
• Candidate rights, including access, correction, deletion, objection and complaints to the Information Commissioner's Office

You don't need to reveal confidential details about your algorithms. But you do need to give candidates enough information to understand how their data affects their recruitment journey.

Templates often miss the practical details that matter for recruitment agencies, especially around AI scoring, talent pools, client sharing and special category data. Your documents work best when they reflect what your business actually does.

Do You Need A Data Processing Agreement With AI Vendors?

Yes, if an AI vendor processes personal data on your behalf, you need a data processing agreement that meets Article 28 of UK GDPR.

This is common where you use recruitment software, CV parsing tools, video interview platforms, chatbot tools or AI matching platforms. If the supplier stores or analyses candidate data for you, they're likely to be your processor for at least some activities.

Your data processing agreement should cover:

• What data the supplier processes and for what purpose
• Your instructions to the supplier
• Confidentiality obligations
• Security measures
• Use of sub-processors
• Help with candidate rights requests
• Help with data breaches and regulator queries
• Rules for deleting or returning data when the service ends
• Audit rights or other ways to check compliance
• Restrictions on using candidate data to train the supplier's own AI models

That last point is especially important. Some AI providers want to use customer data to improve their tools. That might be acceptable in limited, anonymised or aggregated ways, but you shouldn't assume it's fine for identifiable candidate data to be used for model training.

You also need to check international transfers. If your supplier or its sub-processors access data from outside the UK, you may need an appropriate transfer safeguard, such as the UK IDTA or the UK Addendum to the EU SCCs, and a transfer risk assessment.

Sometimes the supplier isn't just a processor. If they decide their own purposes for using candidate data, they may be an independent controller or joint controller. That changes the contract and what you need to tell candidates.

How Should You Handle CVs, References And Special Category Data?

You should handle CVs, references and sensitive data with tighter controls than ordinary business contact details.

Recruitment moves quickly, so it's easy for data to spread across inboxes, spreadsheets, shared drives and software tools. That creates risk when a candidate asks to see their data, withdraws from a process or wants their profile deleted.

CVs And Profiles

Keep CVs in your recruitment system where possible, not scattered across personal inboxes. Limit access to people who need it and avoid uploading CVs into AI tools unless the tool has been approved for personal data.

Set a retention period for your talent pool. There's no single UK GDPR period that fits every agency, but you need a reason for keeping data. Many agencies use different periods for active candidates, placed candidates and inactive candidates.

References

Tell candidates that you may collect references and explain when you do this. You should also think carefully before sharing detailed reference comments with clients or storing them for future roles.

If a candidate makes a data subject access request, you generally have one month to respond. You may be able to extend by up to two further months for complex requests, but you need to tell the person within the first month. References can raise tricky confidentiality issues, so it helps to have a process ready.

Special Category And Criminal Offence Data

Only collect special category data if you genuinely need it. For example, you may need health information to arrange reasonable adjustments, but you usually don't need broad medical history.

If you process criminal offence data, DBS checks or sensitive background screening information, you need a clear legal basis and strict access controls. In many cases, the Data Protection Act 2018 also requires an appropriate policy document explaining how you handle this type of data.

If you have a personal data breach that's likely to risk people's rights and freedoms, you generally need to report it to the ICO within 72 hours of becoming aware of it. If the risk to individuals is high, you may also need to tell affected candidates.

Practical AI Privacy Checklist For Recruitment Agencies

A practical way to get this under control is to review your tools, documents and day-to-day process together.

Start with these steps:

1. Map your tools. List every platform that touches candidate data, including ATS software, AI matching tools, chatbots, video interview tools, background check providers and email automation.
2. Record what each tool does. Note whether it extracts data, scores candidates, ranks applications, drafts messages, records interviews or suggests matches.
3. Check your lawful bases. Match each processing activity to a UK GDPR lawful basis and, where needed, an Article 9 or criminal offence data condition.
4. Run a DPIA where risk is high. A data protection impact assessment is likely to be needed for profiling, large-scale processing, special category data or automated decision-making in recruitment.
5. Update your candidate privacy notice. Explain AI use, data sources, sharing, retention, rights and automated decision-making in plain English.
6. Review supplier contracts. Make sure you have Article 28 terms, security commitments, sub-processor controls and clear limits on AI training uses.
7. Train your consultants. Your team should know when they can use AI, when human review is required and what not to upload into public AI tools under your acceptable use policy.
8. Keep evidence. Save records of your DPIA, supplier checks, policy decisions and tool reviews so you can show your reasoning if a client, candidate or regulator asks.

You may also need to pay the ICO data protection fee unless an exemption applies. The ICO has a self-assessment process to help organisations work out whether they need to pay and which tier applies.

This is also a good moment to check your client contracts. Clients may expect you to confirm that candidates were sourced lawfully, that you have permission to share their details and that any screening technology is used in a compliant way. Clear terms can stop privacy issues turning into client disputes later.

Key Takeaways

• If you use AI to screen, rank, match or communicate with candidates, your privacy notice should explain it clearly.
• CVs, references, interview notes, AI scores and matching outputs are usually personal data under UK GDPR.
• Fully automated shortlisting or rejection can create higher risk, so keep meaningful human review in your process.
• You may need Article 28 data processing agreements with AI vendors and tighter terms around model training and overseas access.
• Special category data, criminal offence data and DBS information need extra care under the Data Protection Act 2018.
• A DPIA, updated candidate privacy notice and clear internal AI rules can help protect your agency while you grow.

If you'd like help with candidate privacy notices, AI supplier contracts and recruitment data processes, you can reach us at 08081347754 or team@sprintlaw.co.uk for a free, no-obligations chat.