GDPR and AI Hiring for UK Marketing Agencies

Using AI to screen resumes at a UK agency puts you under the UK GDPR's automated decision-making rules. As of February 2026, those rules changed. The near-total prohibition under old Article 22 has been replaced by a framework that allows AI screening, provided you put specific safeguards in place.

The short version: you can use AI to rank and shortlist candidates. You cannot let the AI make the final call without real human involvement. And you need to tell candidates what you're doing.

The Fuller Context

The Data (Use and Access) Act 2025 came into force on 5 February 2026 and rewrote how UK GDPR handles automated decisions. The old regime was structured as a near-prohibition with narrow exceptions. The new one is structured as a permission with required safeguards.

In practice, for a marketing agency using a CV screening tool, the key obligations are:

• Tell candidates. Your job application process needs to inform applicants that AI tools are used in screening. A brief note in the application form or privacy notice covers this. It doesn't need to be detailed, but it must be present.

• Ensure meaningful human review. The ICO published a recruitment-specific report on 31 March 2026 drawing on engagement with over 30 UK employers. Its central finding was that many employers claimed human review was happening, but in practice the human was rubber-stamping whatever the AI produced. The ICO is explicit: the reviewer must have the authority, discretion, and genuine competence to change the outcome before it takes effect. Scrolling through a ranked list and clicking confirm is not meaningful review.

• Run a DPIA if processing at scale. A Data Protection Impact Assessment is required when AI screening is likely to result in high risk to individuals. For a small agency processing occasional hiring batches, the threshold may not trigger automatically, but documenting your process and the tool you use is sensible practice regardless.

• Candidates have a right of challenge. Under the new framework, candidates can contest a decision that was significantly influenced by automated processing and request human reconsideration. You need a process for handling that request, even if it's rarely used.

Where special category data is involved, health conditions, disability, ethnicity, the stricter pre-2026 rules still apply. Most standard CV screening doesn't touch special category data explicitly, but worth being aware of.

The ICO has flagged recruitment as a priority enforcement area for 2025-26. Final guidance from the consultation that closed in May 2026 is expected in summer 2026.

Related Questions

Q1: Do I need to tell candidates I'm using AI to screen their CVs?

Yes, under UK GDPR. Your privacy notice or application process should state that automated tools are used in initial screening. The ICO's March 2026 recruitment report makes clear this is expected of employers regardless of company size.

Q2: Does GDPR apply to my small agency if I'm only hiring occasionally?

UK GDPR applies to any organisation processing personal data in the UK, regardless of size or hiring frequency. The scale of your processing affects whether a DPIA is mandatory, but the core obligations-transparency, lawful basis, data subject rights, apply from the first application you receive.

Q3: Can I use CVShelf and stay GDPR compliant?

The compliance responsibility sits with you as the employer, not with the tool provider. What matters is that you use any screening tool as decision support rather than a final decision-maker, that candidates are informed, and that the human reviewer genuinely engages with the shortlist rather than rubber-stamping it. CVShelf produces a ranked list with per-candidate explanations, which supports genuine human review rather than replacing it. For a full picture of what to look for in resume screening software that fits a small agency compliantly, the breakdown covers the key questions.

Q4: How long do I need to keep candidate data?

The ICO recommends retaining unsuccessful candidate data for no longer than six months unless there is a specific justification. If you use an AI screening tool, the data processed through it falls within this retention guidance. Check your tool's data retention settings and ensure candidate data is deleted or anonymised after the appropriate period.

What This Means for How You Screen Candidates

Three practical steps that put you on the right side of these rules without needing a legal team.

Add a sentence to your application form. Something like: "We use AI-assisted tools to support initial CV screening. A member of our team reviews all shortlisting decisions before candidates are progressed or rejected." One sentence. Done.

Use a tool with explainable scoring. The ICO's concern about rubber-stamping is legitimate. If your AI tool gives you a score with no explanation, your reviewer has nothing to engage with. A tool that shows why each candidate ranked where they did gives the human reviewer something to actually evaluate, agree with, or override. That's the difference between meaningful review and rubber-stamping.

Keep a record. Not a complex audit trail, but a note of what criteria you screened against, which tool you used, and that a human reviewed the shortlist before decisions were communicated to candidates. If a rejected candidate raises a challenge, you'll want to be able to explain the process.

CVShelf's explanation layer, a short note per candidate covering what the AI found and flagged, is specifically useful for compliance purposes. It gives the reviewer something substantive to engage with, and it produces a record of the reasoning behind the shortlist.

Try it complimentary at cvshelf.com.

UK GDPR and AI hiring is not a reason to avoid AI screening tools. It's a reason to choose them carefully and use them properly. The law now supports using AI in recruitment. The conditions are transparency, genuine human review, and basic documentation. That's achievable for any agency, regardless of size.