Introduction: what is ADM and why are we focusing on it in recruitment?

Contents

What is ADM, and why does it apply in a recruitment context?

ADM is where you use personal information to make a significant decision about someone using solely automated processing, including profiling ⁴. These decisions can be based on information obtained from a person or inferred about them.

Article 22A of the UK GDPR defines ADM as where a decision:

is based solely on automated processing (ie there is no meaningful human involvement in the decision); and
has a legal or similarly significant effect on a person (which the UK GDPR refers to as a ‘significant decision’).

A ‘legal effect’ is something that affects a person’s legal status or their legal rights. A ‘similarly significant effect’ is something that has an equivalent impact on a person’s circumstances, behaviour or choices – including their employer opportunities. This is likely to include recruitment decisions.

ADM often involves profiling. Profiling is where you analyse, evaluate or predict aspects of someone's personality, behaviour, characteristics, interests or habits.

Profiling can use algorithmic systems that find correlations between different features or attributes. An algorithm is a sequence of instructions or a set of rules designed to complete a task or solve a problem. Algorithms can be simple and may be part of more complex AI systems. Both simple algorithms and complex AI systems are capable of ADM, but organisations can use them in two main ways:

ADM, where an AI system or algorithm makes a decision without meaningful human involvement.
Decision-support, where the AI system or algorithm only supports a human decision-maker.

The recruitment process involves making decisions about whether a person is suitable for a particular role. It can also involve inferences or predictions about their personality or future behaviour. This profiling and decision-making can have a significant impact on a person’s circumstances and may, in extreme cases, lead to exclusion or discrimination.

Whether employers use automated recruitment tools to make or support recruitment decisions, data protection law generally applies. Where they are used to make decisions, the specific legal protections that govern the use of ADM will apply. These provide people with additional information rights and protection from harm, as we explain below.

Legal context: how the law has changed, and what this means for recruitment

When we began this piece of work, the ADM provisions in the UK GDPR were set out in article 22 . Article 22(1) prohibited the use of ADM as a general rule. Article 22(2) set out three conditions (known as “exceptions”) under which this prohibition did not apply:

When the decision was necessary for a contract.
When the decision was required or authorised by law.
When the decision was based on the explicit consent.

Article 22(3) required organisations to take suitable measures to safeguard people’s rights, freedoms and legitimate interests. This meant at least the right for people to obtain human intervention by the organisation, to express their point of view and to contest the decision.

Finally, article 22(4) included additional restrictions on using special category data to carry out ADM.

The Data (Use and Access) Act 2025 (DUAA) became law on 19 June 2025. Amongst other things, it replaced the previous article 22 with articles 22A, 22B, 22C and 22D, with the changes to these provisions taking effect on 5 February 2026. The amendments reframe the ADM provisions from a prohibition with exceptions to a right of challenge with safeguards. This means organisations can make solely automated decisions with legal or similarly significant effects on almost any of the lawful bases in article 6 ⁵. But for each decision, they must apply the ADM safeguards in article 22C. ⁶

Using special category data to carry out ADM is still prohibited ⁷. To do this, organisations must now meet a condition in article 22B, as well as applying the safeguards set out in article 22C.

These changes reduce the compliance burden on organisations and therefore make it easier for them to use ADM. For example, organisations can now rely on legitimate interests to carry out ADM provided they meet the requirements of the three-part test ⁸. If the ADM does not involve special category data, they don’t need to identify either an article 9 condition or an article 22B condition. This means that for organisations looking to undertake automated recruitment processes there will be greater opportunities to do so.

Where we have used the term “ADM provisions” throughout the rest of this report, this refers to both the pre-DUAA provisions under article 22 and the post-DUAA provisions under articles 22A – 22D unless stated otherwise.

The emergence of automated recruitment

Businesses are increasingly automating their recruitment processes. According to a recent report by LinkedIn, “AI is reshaping hiring from the ground up” ⁹. Hiring managers across many sectors are gaining access to various tools capable of a range of recruitment tasks, including:

scoring candidate competencies and skills based on CVs and written applications;
predicting the likelihood of a candidate being successful in the recruiter’s selection process; and
assessing a candidate’s skills and fit for a role based on their performance in AI-powered behaviour games or psychometric assessments.

We’ve recognised this shift. In October 2024, we published our AI in recruitment report ¹⁰. This was based on consensual audits with developers and providers of AI tools used in recruitment. In the report, we highlighted areas for improvement but also recognised the benefits that these technologies could bring.

There is increasing evidence of these benefits. Automation can enable hiring managers to handle potentially high volumes of applications and process them consistently and quickly. This can also benefit applicants used to lengthier, more traditional processes. There’s also important evidence that people see automated processes as potentially fairer than human decision-making ¹¹. This evidence includes public perception research that we commissioned ¹².

We also recognise that candidates are increasingly using generative AI tools to help produce and submit applications with more ease. This creates further changes and challenges, as employers need to deal with a higher volume of applications which may not fully reflect a candidate. It’s understandable that both sides of the recruitment process have a desire to improve the recruitment experience through new technologies.

While we recognise these potential benefits, the use of ADM in recruitment, alongside that of AI and automation in the wider workplace, is an established concern. This is true across society, including among:

industry bodies;
trade unions ¹³;
civil society ¹⁴, ¹⁵;
members of the public ¹⁶;
government ¹⁷; and
parliamentarians ¹⁸.

The shift towards greater ADM use is ‘sociotechnical’. This means that there’s a relationship between the technologies, the people who use and the people are affected by them. At the heart of recruitment are the people whose personal information is being processed and about whom decisions are being made. This often means that power imbalances and the potential for bias and discrimination are present. Where employers use personal information to make or support decisions in the recruitment process, our remit applies.

Why we’ve focused on automated recruitment

In our AI and biometrics strategy ¹⁹, we set out key challenges that need to be addressed so the benefits of AI and biometric technologies can be realised. These challenges are:

a lack of regulatory certainty and confidence within organisations; and
a lack of transparency and trust about how organisations use people’s personal information in this context.

We know that concerns about automated recruitment exist and that people have certain expectations. We know that people:

want to know when employers use automated tools and how they make decisions;
fear that automated tools may reflect and reinforce social inequalities, particularly in how they rank or filter candidates; and
are concerned about serious consequences of inaccurate outputs and unfair outcomes, such as being overlooked for a job.

If people don’t trust a technology, then they’re less likely to use it or agree to their own information being used to power it ²⁰. In a worst-case scenario, people could be harmed by being incorrectly overlooked or discriminated against. This, of course, takes place in a context in which it is widely understood that the recruitment process is not discrimination and bias free to begin with. This is why we’re seeking to ensure transparency between people and organisations. Ensuring safe and responsible deployment of automated recruitment can, in fact, overcome many bias and discrimination issues.

We’ve focused strongly on understanding and clarifying how much employers use automated recruitment tools to make or support decisions. A driving question has been: are employers engaging in ADM when they use these tools? As we explain in this report, our view is that in many cases, it is likely that they are.

It is vital that we address this issue openly with both employers and developers of this technology. In our previous AI in recruitment report ²¹, we highlighted that while developers may explicitly design tools to support decisions, these tools can sometimes be used to make decisions instead. We understand that in practice, identifying whether a tool is making or supporting a decision can be challenging. However, if employers don’t get this right, then information rights won’t protect people in situations where they should. This is why we’re seeking to provide regulatory certainty.

We know that developers and employers want to get this right. While the recruitment process is complex and multi-layered, ours goal are simple:

To ensure that people’s experiences of all automated recruitment processes are transparent and fair.
To ensure that they are protected by the right safeguards.

This will prevent harm and promote trust.

How we’ve examined automated recruitment practices

The changes made to article 22 by DUAA didn’t prevent us from undertaking this work on ADM in recruitment. We considered legislative changes carefully in planning our activity.

Throughout 2025, we contacted 37 employers that we identified as likely to be using automated recruitment tools. In our letters, we explained that we hoped to gather information about their use of the tools and the extent to which they were using ADM. Talking to us was voluntary, but we reserved our right to act if we identified serious non-compliance.

The areas we focused on in our discussions with employers and in this report reflect areas of the provisions relating to ADM that are largely consistent between the old and new law, in particular:

the extent of meaningful human involvement in decision making;
the provision of transparent information, as well as the principles of fairness and transparency;
the safeguards within the ADM provisions; and
the use of any special category data.

To select employers to contact, we:

identified candidates through open-source research, including:
- web searches; and
- identification of employers named in case studies on over 10 tool provider websites;
narrowed down our list by examining the selected employers’ privacy notices or careers pages for evidence of ADM; and
conducted an internal prioritisation process to ensure that we covered a range of:
- sectors;
- tool providers; and
- stages of the recruitment process.

As this shows, we intended our engagement to be a cross-economy exercise.

Employers spoke to us in good faith, and we received a strong response. In total, there were:

16 virtual face-to-face meetings; and
21 discussions by correspondence, in which we received information via email.

Employers explained their use of the tools, and some provided technical demonstrations from both the candidate and employer perspectives. We also received:

privacy notices;
data protection impact assessments (DPIAs);
other assessments (eg equality and security) in various forms; and
records of processing activity (ROPAs).

We reviewed the information provided to assess whether the employers were using automation to make or support recruitment decisions. Most employers we spoke to considered it unlikely that their processing fell within scope of the ADM provisions.

However, following these discussions, we determined that 16 employers were likely to be using ADM to make decisions about candidates. We sent letters to these employers explaining why we thought this and providing recommendations. We also wrote to the employers where we did not see clear evidence of them carrying out ADM. In these letters, we provided advice and guidance on the compliant use of ADM in a recruitment context.

In addition to our engagement with employers, we also carried out wider work, including:

public perceptions research conducted by a third-party research agency ²²;
discussions with recruitment-based trade associations to give them an overview of our work and seek their views; and
a roundtable with representatives from civil society, trade unions, law firms, a tech industry body and other regulators.

We refer to this wider work throughout this report. We recommend reading the public perceptions research alongside this report.

At the time of this report, all 16 employers identified as using ADM have agreed to act on our recommendations and work with us further. We’ve requested that they provide further information to demonstrate this. We continue to engage with developers, employers and wider industry to provide regulatory clarity. We will not hesitate to take further action if we consider it necessary.

⁴The UK GDPR

⁵The only one that can’t be used for ADM is the new lawful basis of recognised legitimate interest.

⁶In practice, the ADM safeguards are similar to those formerly set out in article 22(3).

⁷Special category data is defined as personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership; genetic data; biometric data (where used for identification purposes); or data concerning health, a person’s sex life and a person’s sexual orientation. See our guidance on special category data for more detail.

⁸Lawfulness

⁹The Future of Recruiting 2025 | LinkedIn

¹⁰AI in Recruitment Outcomes Report

¹¹When AI is Perceived to Be Fairer than a Human: Understanding Perceptions of Algorithmic Decisions in a Job Application Context

¹²Understanding public perceptions towards automated decision-making in recruitment

¹³ Building a pro-worker AI innovation strategy | TUC

¹⁴BosswareWebVersion.pdf

¹⁵Algorithmic hiring systems: what are they and what are the risks? - IFOW

¹⁶AI hiring tools may be filtering out the best job applicants - BBC Worklife

¹⁷Responsible AI in Recruitment - GOV.UK

¹⁸AI Regulation Report - Lord Holmes of Richmond MBE

¹⁹ See our AI and Biometrics strategy here: Why we need to act