The Data (Use and Access) Act 2025 updated the data protection legislation with the intention of making it more straightforward for firms to innovate responsibly with people’s personal information, including using automation to make decisions without human involvement.    

Automated decision making (ADM), used appropriately, can benefit both candidates and employers by improving the efficiency of the hiring process, helping to handle high volumes of applications consistently and quickly. 

However, it can also pose risks to candidates if not used lawfully, such as unfair or biased decisions.  

The ICO has suggested, if firms wish to take advantage of the new laws, proper safeguards must be in place to protect jobseeker’s data protection rights and ensure any automated decisions are transparent, fair and easy to understand.  

In a report published today, the ICO sets out its expectations for any organisation using ADM for hiring decisions. 

The ICO expects organisations to proactively monitor for bias. They need to work hard to build trust with people when there are engrained concerns about bias and discrimination. They must test regularly for biased outputs and take steps to mitigate this, so people can trust that all decisions are fair. Good practice also includes asking developers about their own bias testing when procuring tools and considering monthly bias reviews. 

Organisations must be transparent with jobseekers, notifying candidates if ADM is being used and explaining how it works.  

Additionally, organisations must explain rights to recourse. Organisations must tell candidates how to exercise their right to challenge a decision and request a human review if they believe it is incorrect.   

William Malcolm, Executive Director for Regulatory Risk and Innovation at the ICO, said: “Use of AI and automation is rapidly transforming recruitment across the UK – from helping sift CVs to scoring online assessments. We want to support organisations to take advantage of both recent changes to the law and these new tools. But responsible innovation and adoption of this new technology require safeguards to be in place to protect jobseekers – which are foundational to public trust.”  

Over the last year, the ICO has engaged with more than 30 employers to better understand the use of ADM in recruitment. The ICO suggested employers reported significant benefits from using automation, which tended to be applied at early stages of the hiring process.  

However, the ICO also identified a need for greater transparency and improved safeguards, consistency in any human involvement, and adoption of good practice when it comes to monitoring for bias. The regulator wrote to 16 organisations likely to be using ADM to make decisions about candidates, and they have now committed to acting on recommendations to improve practices. 

The ICO also conducted public focus groups where participants raised concerns about automated decisions without human oversight – including a lack of transparency and the potential for existing biases to be amplified.  

Malcolm added: “Jobseekers want to work for an employer they can trust – this trust is built and maintained by using people’s personal information fairly and respecting their rights. Being transparent about how you are using AI and automation in your recruitment processes gives people confidence. We are here to help you get this right, providing certainty on what the law requires to ensure consistent practices across the economy.”   

Recommended reading

• How Is AI Impacting Traditional Hiring?
• OpenAI to Launch AI-Powered Jobs Platform in 2026
• PwC: Firms Now Pay a 56% Premium for AI Talent

Keith Rosser, Chair at the Better Hiring Institute, said: “AI has the potential to be the biggest single change to hiring since the internet. Whether this change is positive or negative depends on how we – the UK hiring community – harness and apply it. It should be about hiring outputs, leaving humans to focus on the outcomes”.

The ICO has launched a consultation on its draft ADM guidance. The new guidance provides clarity on how all organisations can use ADM and sets out where and how safeguards must be used. The consultation is open until 29 May, allowing organisations to respond.