Quick answer: Do not assume an automated rejection is lawful or fair. Assess the purpose, data, impact, transparency and applicable data-protection and employment duties; keep meaningful human review and a route to correct inaccurate information.
Describe the employment decision
Identify whether the tool ranks applicants, analyses video or voice, flags performance, predicts absence or recommends discipline. Explain which decision remains with a person, who can override the score, and what evidence the manager must consider. Do not let a vendor’s product description replace your own risk assessment.
Map employee and applicant data
List information collected, inferred or bought; the source and purpose; retention; access; vendor and sub-processors; storage and support locations; and whether special or sensitive data is involved. Check privacy notices, lawful basis, data minimisation, security, data-subject requests, and whether ODPC registration applies.
Test fairness and accuracy before use
Use representative data and realistic scenarios. Measure false positives and negatives across relevant groups where lawful, test whether a proxy reproduces bias, and keep a record of model versions and known limits. Provide a human contact who can explain, review and correct a result.
Review workplace and vendor obligations
Check employment contracts, policies, consultation duties and applicable law before introducing monitoring or changing how people are assessed. Vendor terms should address confidentiality, security, incident reporting, audit support, subcontractors, retention, deletion and use of data to train general models.
Run a limited and reversible pilot
Set a narrow purpose, time limit, user group and success criteria. Keep the human decision-maker accountable. Tell affected people what the tool does in understandable language. Pause the pilot if accuracy or impact concerns cannot be resolved.
Keep a defensible record
Retain the use-case statement, data map, vendor review, DPIA decision, test results, staff notice, human-oversight procedure, complaint route and review date. Reassess when the vendor changes the model or the employer expands its use.
Questions people ask
Can an employer use AI to reject applicants automatically?
Do not assume an automated rejection is lawful or fair. Assess the purpose, data, impact, transparency and applicable data-protection and employment duties; keep meaningful human review and a route to correct inaccurate information.
Do employers need to tell staff about monitoring software?
The organisation should assess and communicate the purpose and nature of personal-data processing, its lawful basis, proportionality, access and retention. Obtain advice on the particular monitoring and workplace context.
Is a DPIA needed for AI in HR?
ODPC guidance says a DPIA is relevant where processing is likely to result in high risk to data subjects’ rights and freedoms. Assess the specific system and document why a DPIA is or is not required.
Official sources and scope
For the current rule and any forms or rates, check the official sources: Data Protection Act 2019 · Employment Act 2007 · ODPC guidance notes · ODPC DPIA guidance. This guide is general information, not advice on a particular transaction or dispute. Laws, regulations and administrative requirements can change; check the position that applies to your facts before acting.
Related guidance
CS Advocates LLP employment law practice. Related reading: Employee monitoring and workplace privacy · When a DPIA is required · Handling workplace complaints fairly.
This is general information, not legal advice on a particular matter, and does not create an advocate-client relationship. For advice on your specific situation, contact CS Advocates LLP for a confidential, conflict-checked consultation.