AI recruitment creates several kinds of candidate data: CVs, interview responses, transcripts, assessment notes and model-generated inferences. A useful privacy review follows those records through the hiring process and asks what each organisation does with them.
Start by confirming which laws apply to your organisation and processing. A candidate's nationality or a vendor's registered address alone does not settle territorial scope. EU GDPR and UK data protection rules also need to be considered separately where both are relevant.
Choose a lawful basis for each purpose
Document why candidate information is collected and what legal basis supports each use. Do not assume that one basis for sourcing also covers training a model, recording an interview or building a talent pool. The ICO's lawful-basis guidance explains the available bases and the importance of deciding before processing begins.
Consent is not automatically the safest basis in recruitment, where candidates may feel they have little choice. If you rely on it, your privacy team should assess whether it is freely given and how withdrawal works. Special-category data requires separate consideration of the applicable additional conditions.
Explain the assessment to candidates
Describe what information is collected, how AI is used, who receives the results, the retention approach and how to raise a question. Separate the interview introduction from the fuller privacy notice. Make the explanation available before the relevant processing, in a form candidates can understand.
AI-generated scores and integrity flags are inferences. They should not be described as objective proof about a person's ability, honesty or identity. A reviewer needs enough context to examine mistakes, incomplete answers and technical interruptions.
Identify the vendor's role
Determine whether each organisation acts as a controller, processor or in another arrangement for the particular purpose. This affects the required agreements and instructions. Do not assume that every recruitment supplier is only a processor.
Review the contract alongside the real workflow: data categories, subprocessors, hosting, international transfers, access, security responsibilities and the handling of requests or incidents. Ask whether candidate data is used for any additional provider purpose and what settings or terms govern that use.
Assess automated decisions and human involvement
A structured assessment is not necessarily the final hiring decision, but its practical influence still matters. Map whether a score triggers rejection, ranking or a recruiter review, and whether the reviewer can understand and challenge it.
The ICO's AI and individual-rights guidance is a starting point for UK processing. Have your advisers check the current rules and the actual decision path, including any separate EU GDPR obligations. Adding a nominal human approval step does not answer every question.
Set retention and request handling deliberately
Choose retention according to the purpose, legal obligations and your documented needs. There is no universal rule that rejected applicants must be kept for six or twelve months, or that AI assessment logs should always be retained for five years.
Agree what happens at the end of a hiring process and after the contract ends. Confirm which records can be exported or deleted, who performs the action, and how a legal hold or backup affects it. Candidates' access, correction, objection and deletion requests should reach a named contact and be assessed under the applicable rules; not every request leads to immediate deletion of every record.
Keep the AI Act review separate
Data protection and the EU AI Act address related but different questions. The European Commission's overview identifies employment-related uses among high-risk areas. Review classification and responsibilities for the particular system; a privacy notice or a human review step is not an AI Act certification. Our twelve-step AI hiring review covers procurement questions.
Discuss the Recruo workflow before a pilot
Recruo combines assessment evidence with recruiter review. Standard recruitment includes the agreed technical and soft-skill assessment stages before finalist introduction; Recruo Pipeline provides active sourcing for 2 roles at $3,500 per month, with Recruo ATS and interview tools included. We handle candidate research, outreach and follow-ups; your team reviews interested candidates and runs interviews.
Use the security and privacy page to start the conversation about your assessment flow, candidate information, hosting, retention and access. Confirm the applicable terms and responsibilities for the service you choose before sharing candidate data.