6 Ways Your Recruitment Processes Are Breaking the Law

How do I know if my company’s hiring process is legally compliant? If you are using automation, AI, or an applicant tracking system (ATS) to screen candidates, there is a very high chance you are inadvertently breaking data protection laws.

The Information Commissioner’s Office (ICO) recently investigated 37 employers to see how they use Automated Decision-Making (ADM) in recruitment. The findings were a massive wake-up call: most employers were failing to meet legal requirements. In fact, the ICO had to issue formal warning letters and specific compliance recommendations to 16 of those organizations.

The biggest takeaway? Employers fundamentally misunderstand how UK data protection laws apply to recruitment technology. 

Here are the 6 common pitfalls the ICO uncovered and how to ensure your business doesn’t fall into them.

Key takeaways

• False “Human” Review: If your team blindly accepts AI rejections and only looks at top-tier candidates, the law views this as a solely automated decision requiring strict compliance.
• Hidden AI Use: You cannot hide behind vague privacy policies or pass the buck to your software vendor. You must explicitly tell candidates if AI is scoring them and explain how it works.
• Unchecked AI Bias: AI inherits human bias. You must regularly audit your recruitment software to ensure it isn’t generating discriminatory outcomes.
• Zero Right of Appeal: If an AI rejects a candidate, you are legally required to give them a way to contest the decision and ask for a manual human review.

1. Misjudging ‘Meaningful Human Involvement’

Many companies believe that because a human manager ultimately signs off on a hire, their process isn’t solely automated. The ICO found the exact opposite.

Most employers mistakenly thought their AI tools were just providing ‘decision support’. In reality, they were simply rubber-stamping the software’s output. For example, if your hiring managers only review the high-scoring candidates flagged by an AI and blindly accept the automated rejection of everyone else, that is legally considered an automated decision. Without genuine, critical human review of the rejected candidates, you are operating an ADM system without the proper legal framework.

2. Vague Privacy Notices & Poor Transparency

Candidates have a legal right to know how their data is being used, but most privacy information reviewed by the ICO fell short. Common compliance failures included:

• Using vague language that never explicitly mentions AI or automation.
• Failing to explain the logic behind how the automated tool scores or rejects people.
• Lazily linking candidates to a third-party software provider’s privacy policy. (Spoiler: as the employer, you are the data controller. You are responsible, not the software vendor.)

3. Failing to Implement Proper Safeguards

Because so many employers incorrectly assume they aren’t using ADM, they completely omit the legal safeguards required by law. If your system makes automated decisions that significantly impact a candidate (like rejecting their application), you are legally required to give them the opportunity to:

• Receive specific information about how the decision was made.
• Make representations or contest the decision.
• Request human intervention to review their application.

4. Neglecting Fairness and Bias Assessments

AI models are trained on historical data, which means they easily inherit historical biases. Despite this, the ICO found that many employers had failed to assess whether their automated hiring tools were producing discriminatory outcomes. Only a tiny minority of employers (a few outliers) were regularly monitoring and reviewing their systems for bias.

5. Inadequate Data Protection Impact Assessments 

Because automated recruitment is considered high-risk, a Data Protection Impact Assessment (DPIA) is a legal must. Yet, several employers hadn’t completed one at all.

Even worse, among those who did complete a DPIA, many failed to do it properly. The ICO noted widespread issues, including using outdated information, leaving risk assessment sections entirely blank, providing zero justification for data processing, and signing off on the documents without ever consulting a Data Protection Officer (DPO).

6. Relying on the Wrong ‘Lawful Basis’

Most employers are currently relying on the completely wrong legal ground to process candidate data. If you are using ‘Consent’ or ‘Contract’ for the shortlisting phase, you are likely non-compliant:

• Consent: The ICO notes this is rarely appropriate because candidates feel pressured to agree in order to be considered for the job. Therefore, consent is not freely given.
• Contract: You cannot use this during the early interview or shortlisting phase because you don’t yet know if you will enter into a contract with them. The ICO clarifies that ‘contract’ is only valid after you have made a job offer and the candidate has accepted.

For most recruitment data processing, ‘Legitimate Interests’ (or Public Interest for public sector organizations) is the correct legal basis to use.

The Bottom Line

Whether you are using advanced AI or standard recruitment software, you cannot outsource your legal responsibilities to a tech vendor. If you haven’t reviewed your privacy notices, audited your AI for bias, or mapped out your true level of human involvement, it’s time to pause, take accountability and rewire your recruitment process before the regulator knocks on your door.

Source: “Recruitment rewired: an update on the ICO’s work on the fair and responsible use of automation in recruitment,” published by the Information Commissioner’s Office (ICO).

Comparing standard approaches

The Oleeo view

Screening shouldn’t be about setting up barriers; it should be about finding the fastest route to the best talent.

How to screen candidates faster with Oleeo AI candidate screening

Screening and selection case studies

FAQ 

“What is the difference between an ATS and a recruitment CRM?”

Think of an ATS (Applicant Tracking System) as your system of record—it manages the workflow, compliance, and processing of active applicants who have applied to a specific job. A CRM (Candidate Relationship Management) is your engagement tool—it helps you build relationships with passive candidates and talent pools before they apply, or nurture them for future roles if they weren’t selected this time.

“Is an Applicant Tracking System (ATS) still necessary for recruitment?”

Yes, absolutely. While AI and social media tools are flashy, the ATS remains the backbone of the hiring process. It is essential for compliance, data management, and acting as the central hub where all your other tools (like background checks and video interviews) connect. Modern ATS platforms like Oleeo have evolved to include the advanced automation features that older systems lacked.

“Are an ATS and a Recruitment Management System (RMS) the same thing?”

They are often used interchangeably, but an RMS is typically a broader term. While an ATS focuses on tracking applicants, an RMS often implies a more holistic suite that includes the ATS, the CRM, event management, and onboarding tools all in one platform. Oleeo, for example, functions as a comprehensive RMS for high-volume hiring.