ICO guidance for recruitment with practical CV screening steps

Hiring teams want faster shortlists without risking a data complaint. If you recruit in the UK, the Information Commissioner’s Office expects you to handle candidate data lawfully, fairly, and transparently. This article turns those expectations into concrete steps for AI CV screening so you can move quickly and explain every call you make.

ICO expectations for automated CV screening

The ICO’s view of recruitment sits on familiar GDPR principles: lawfulness, fairness and transparency; purpose limitation; data minimisation; accuracy; storage limitation; integrity and confidentiality; and accountability. These apply even when software helps you assess candidates.

Automation creates extra duties. If you rank, score, or bucket candidates using software, do not let the tool make decisions that have legal or similarly significant effects without meaningful human involvement. That means:

• People set and approve screening criteria before any processing.
• Reviewers examine the tool’s reasoning for each candidate, can change outcomes, and record why.
• Candidates can request an explanation and challenge a decision.

In practice, avoid “silent automation” where a score alone determines rejection. Treat automated outputs as input to a human decision. Keep risky or vague criteria out of your rubric. For example, replace “culture fit” with job-related evidence such as “managed 3+ enterprise accounts” or “built data pipelines in SQL and Python.”

Lawful basis, DPIA, and audit-ready records

Most UK employers rely on legitimate interests for early screening. Contract may apply where steps are necessary to enter into a contract. Consent is rarely suitable because it is hard for candidates to refuse without disadvantage. If special category data appears on CVs (for example, health, religion, or trade union membership), avoid using it for decisions unless you have a clear Article 9 condition. Design your process to ignore that data where possible and keep minimisation front of mind.

When to complete a DPIA

Do a Data Protection Impact Assessment when you introduce new technology, profile at scale, or process data that could significantly affect people. Large-pool CV screening with AI usually meets that bar. Document:

• Your purpose and lawful basis for screening.
• The data you will process and why it is necessary.
• Risks to candidates (bias, error, exclusion) and mitigations.
• How meaningful human review works in your flow.
• Retention, security, and how candidates can exercise their rights.

Records that explain your choices

Accountability means proving what you did and why. Keep an audit-ready record that ties together:

• Criteria versions and weights, who approved them, and when.
• Per-candidate explanations, scores, and reviewer notes.
• Any bucket changes and the reason for overrides.
• Communications with candidates about decisions when relevant.

How Marxel supports human control

Marxel keeps people in charge through criteria generation and approval, which produces a weighted rubric from your job brief that you edit and sign off before any run. Bias-aware checks flag vague or risky items during setup. Explainable assessments show which criteria a candidate met, concerns, and confidence. Reviewers can manually rebucket candidates and add notes. An audit trail and governance record ties criteria, reviewer notes, changes, and decision reasons to each candidate, and CSV shortlist export passes the rationale to hiring managers.

A practical screening workflow

1. Map your basis and risks: Set legitimate interests or contract, and explain why. Complete a DPIA for large-scale or profiling-based screening, noting where humans can change outcomes.
2. Define a focused, reviewable rubric: Use Marxel’s criteria from brief to draft the rubric from the job description and notes. Use editable weighted criteria to keep must-haves tight (for example, “2+ years in B2B SaaS account management,” weight 5; “SQL proficiency,” weight 3). Let bias-aware criteria checks surface vague wording to fix before screening.
3. Run a controlled batch with humans in the loop: Upload a defined pool and use bulk CV screening to process up to 200 CVs. Processing progress tracking shows runtime and batch progress. Review the four decision buckets (Aligned, Potential, Hold, Unclear), then use manual rebucketing where explanations point to a different call. Use candidate-pool queries to compare similar applicants across evidence and notes for consistency.
4. Document outcomes and share responsibly: Keep the audit trail for criteria versions, notes, decisions, and reasons. Use CSV shortlist export for tidy handoffs while preserving reasoning.
5. Secure handling and speed where it helps: Use GDPR-conscious data handling. Data is encrypted in transit and not used to train Marxel-owned models. Keep access controlled within your team. If timing matters, priority processing on Pro plans reduces turnaround without skipping review.

Minimise, secure, and retain only what you need

Minimisation starts at the rubric. Keep signals that show job-related ability and drop the rest. Examples:

• Keep: named technologies used in projects, scale of responsibility, industries served, certifications tied to duties.
• Drop: personal hobbies, photos, references to protected characteristics, or broad “soft skills” that cannot be verified in a CV.

With Marxel’s editable weighted criteria you can remove non-essential checks and focus on evidence. A reusable scoring rubric then gives consistency across similar roles without pulling extra data each time. During screening, bulk CV screening evaluates up to 200 CVs in a run while processing progress tracking shows status so you do not reprocess needlessly.

Security and reuse matter. Marxel applies GDPR-conscious handling: data is encrypted in transit, access is permissioned, and uploaded CVs are not used to train Marxel-owned models. Your organisation should still set retention periods in its own systems. A common pattern is to retain unsuccessful candidate data for a set window (for example, six months after the campaign) unless legal or regulatory needs require a longer hold. Delete data when you no longer need it.

Transparency and candidate rights in practice

Explain the process clearly in your privacy notice and candidate communications. Cover what you collect, why you collect it, how long you keep it, the role automation plays, and how humans review outcomes. Make it easy for candidates to use their rights to access, rectification, objection (where applicable), restriction, and, in limited scenarios, portability and erasure.

A short example you can adapt for a privacy notice: “We use software to organise CVs against job-related criteria set and approved by our hiring team. A recruiter reviews the software’s assessment, may change the outcome, and makes the final decision. You can ask us to explain any decision, request access to your data, or object to our use of your data where the law allows.”

Explain decisions without rereading CVs

Marxel’s explainable reasoning maps each recommendation back to approved criteria. The four candidate buckets (Aligned, Potential, Hold, Unclear) are a staging ground, not a final say. Reviewers add notes and move candidates as needed. That record helps answer candidate queries like “Why was I not shortlisted?” with specific evidence instead of a generic response.

Be open about tools on both sides

Many applicants now use AI to search and apply. Services such as ApplyTop’s AI resume builder and job search service scan LinkedIn, career sites, and many ATS platforms to send matched alerts and create tailored resumes and cover letters. Being open about how you screen reduces confusion and shows that humans still make the calls.

Key takeaways

• Keep humans in charge of criteria and final calls, and record how they review and override outcomes.
• Pick a clear lawful basis, do a DPIA for large-scale or profiling-based screening, and maintain an audit trail you can stand behind.
• Minimise the rubric to job-related signals, and encrypt and control access while data is in transit and at rest in your own systems.
• Explain automation in your privacy notice, and be ready to give per-candidate reasoning on request.
• Use AI CV screening to speed review, not to replace accountability. This approach suits teams choosing resume screening software or cv screening software uk wide.

If you are moving to AI CV screening, choose tools and workflows that show their workings, keep people in the loop, and support gdpr compliant cv screening practices. Marxel focuses on explainable reasoning, human-approved criteria, and an audit trail that makes decisions easier to justify.