CV Screening Software and UK GDPR

CV screening software that scores, filters, or ranks candidates falls under UK GDPR's automated decision-making rules. The Data (Use and Access) Act 2025, in force from 5 February 2026, changed those rules from a near-prohibition to a permissive framework with required safeguards. You can use AI screening. The conditions are transparency, genuine human review, and basic documentation.

What the Law Actually Covers

The rules apply to any organisation processing candidate data in the UK. Size doesn't matter. If you're using a tool that automatically ranks or filters CVs, you're running automated decision-making under UK GDPR.

What triggers it specifically: any tool that scores, sorts, or filters candidates without a human manually reviewing every individual application first. That covers CV screening tools, ATS ranking features, and any software that produces a shortlist rather than just storing documents.

Three things are now required:

• Transparency. Candidates must be told that automated tools are used in screening. A sentence in your application form or privacy notice is enough. It doesn't need to be a paragraph.

• Meaningful human review. This is the part most agencies get wrong. The ICO's recruitment report, published March 2026, found that many employers claimed human review was happening but in practice a human was rubber-stamping whatever the AI produced. That doesn't count. The reviewer needs the authority, the time, and the actual information to change the outcome before it's communicated to the candidate.

• Right of challenge. Candidates can ask for human reconsideration of a decision that was significantly influenced by automated processing. You need a process for handling that, even if it's simple.

One additional point: if your screening tool processes any special category data, health conditions, disability, ethnicity, the stricter pre-2026 rules still apply. Standard CV screening usually doesn't touch this explicitly, but it's worth confirming with whichever tool you're evaluating.

The ICO has flagged recruitment as a priority enforcement area.

What This Means for a 10-100 Person Agency

You don't need a legal team to get this right. You need three things in place.

• A disclosure sentence. Add something like this to your application process: "We use AI-assisted tools to support initial CV screening. A member of our team reviews all shortlisting decisions before candidates are progressed or rejected." One sentence, added once, covers the transparency requirement.

• A real review step. The human reviewing your AI shortlist needs to actually look at the rankings and the reasoning, not just approve the output. This means your screening tool needs to show its reasoning, not just a score. If your reviewer can't see why a candidate ranked where they did, they can't meaningfully engage with the decision.

• Basic recordkeeping. Note what criteria you screened against, which tool you used, and that a human reviewed the output before decisions were communicated. If a rejected candidate raises a challenge, this documentation is what you'll need.

On data retention: the ICO recommends not keeping unsuccessful candidate data beyond six months without a specific justification. Check your screening tool's data settings and make sure candidate data is deleted or anonymised after the appropriate period.

A Data Protection Impact Assessment may be required if your screening is likely to result in high risk to candidates, for most small agencies processing occasional hiring batches, the threshold may not trigger automatically, but documenting your process is sensible regardless.

None of this requires a solicitor to implement. It requires a 20-minute setup once.

How CVShelf Fits Into This

Compliance sits with you as the employer, not the tool. But the tool you choose affects how easy compliance is in practice.

CVShelf produces a ranked list with a per-candidate explanation, what the AI found relevant, what it flagged as missing, why the ranking landed where it did. That explanation is what gives your reviewer something to actually engage with rather than rubber-stamp. A reviewer who can read the reasoning can agree with it, push back on it, or override it. That's what meaningful human involvement looks like.

For a COO building out a compliant, practical screening process, the full breakdown of CV screening software that fits an agency at this size is worth reading alongside this.

CVShelf starts at $29 per month. Try it complimentary at cvshelf.com.

FAQs

Q1. Does GDPR apply to small agencies using CV screening software?

Yes. UK GDPR applies to any organisation processing personal data in the UK, regardless of size. The obligations around automated decision-making, transparency, human review, and data subject rights apply from the first CV you process through a screening tool. Company size affects some thresholds (such as whether a DPIA is mandatory), but not the core requirements.

Q2. What counts as "meaningful human involvement" when reviewing an AI shortlist?

The ICO is specific on this. The reviewer must have the authority to change the outcome, the relevant competence to evaluate the candidates, and must actually engage with the reasoning before a decision is communicated. Clicking approve on a ranked list without reviewing the individual candidate explanations does not count. Your screening tool needs to show its reasoning, not just scores, so the reviewer has something to engage with.

Q3. How long can I keep rejected candidates' CV data?

The ICO recommends retaining unsuccessful candidate data for no longer than six months unless there is a clear, documented reason to keep it longer. This applies to data processed through an AI screening tool as much as data held in any other format. Check your tool's data retention settings and make sure auto-deletion or anonymisation is configured appropriately.

Q4. Do I need to tell candidates I'm using AI to screen their CVs?

Yes, under the updated UK GDPR framework. A brief, clear statement in your application form or privacy notice is sufficient. The ICO's March 2026 recruitment report makes clear this is expected of all employers using AI in recruitment, regardless of size.

Q5. What happens if a candidate asks to challenge an automated screening decision?

Under UK GDPR, candidates have the right to request human reconsideration of a decision significantly influenced by automated processing. You need a process for handling this, in practice, that means being able to explain the criteria used, show that a human reviewed the shortlist, and reconsider the specific candidate's application if requested. CVShelf's per-candidate explanations make this straightforward to document.

NOTED: This post is not legal advice. Speak to an employment lawyer or data protection adviser before making compliance decisions for your business.