The Data Use and Access Act 2025 updates UK data protection law, including rules that matter when recruitment agencies handle CVs, candidate records and AI-assisted shortlisting. If you run a small UK recruitment agency, this checklist covers six practical areas to review, without needing a dedicated compliance team.
If you’re looking for a simpler way to source and screen candidates, EdgeTal combines semantic search with on-device AI in one mobile-first recruiting tool. Candidate processing stays on your device, helping you keep candidate information under your control while finding relevant CVs.
The Checklist
| Area | What to check |
|---|---|
| Candidate data | Know where CVs, contact details and candidate notes are stored. |
| Complaints | Set up a clear data protection complaints procedure and name someone to handle it. |
| Subject access requests | Know who responds and where candidate data can be found. |
| Automated decisions | Review any AI tool that ranks, scores or filters candidates. |
| Software vendors | Ask how candidate data is processed, stored and accessed. |
| Regular reviews | Check current ICO guidance and record when you last reviewed your procedures. |
1. Know What Personal Data You Hold
Personal data includes CVs, contact details, work history and notes about candidates. For a small recruitment agency, this information may be spread across emails, spreadsheets, mobile phones and recruitment software.
List where you store candidate information, who can access it and when it needs to be updated or deleted. This makes it easier to respond to subject access requests and manage candidate information properly.
2. Review Automated Decision-Making Under UK GDPR
AI recruitment tools can help agencies search CVs, rank candidates and identify relevant experience. However, you need to understand how their results influence recruitment decisions.
The Data Use and Access Act 2025 changes the rules for significant decisions made solely through automated processing. Safeguards still apply, including rights to challenge decisions and request human intervention in relevant circumstances. Special rules also apply to special category personal data.
Identify any tools that score, rank or filter candidates. Check whether they simply make recommendations or determine who progresses, and consult the latest ICO guidance.
3. Set Up a Data Protection Complaints Procedure
Candidates should know how to raise concerns about how their personal information is collected, stored or used. Your procedure can be simple: provide a clear contact method, assign someone to handle complaints and keep a record of responses.
The Act introduces requirements to acknowledge complaints within 30 days and respond without undue delay. Organisations must also take appropriate steps to help people make complaints.
Remember that candidates do not need to use legal language for their concerns to require attention.
4. Know How to Handle Subject Access Requests
A subject access request allows someone to ask for access to the personal data you hold about them. Recruitment agencies may receive requests from current or former candidates whose details remain in their records.
Decide who handles requests and where to search, including emails, spreadsheets, candidate databases and recruitment software. Keep a record of the searches and responses.
The Act clarifies that searches should be reasonable and proportionate. You should still check relevant records and follow the applicable response deadlines. The ICO's guidance on individual rights can help you understand your obligations.
5. Ask the Right Questions About Your Recruitment Software
Recruitment software can simplify candidate sourcing and shortlisting, but you should understand how it handles candidate information, particularly when AI is involved.
Before choosing a tool, ask the vendor:
- Where is candidate data processed and stored?
- Is information sent to external servers or AI providers?
- Can I understand why a candidate was matched or ranked?
- How can I find and export someone's data if they make a request?
- What happens to candidate information when I stop using the tool?
A vendor's claim that its product is GDPR compliant does not remove your responsibilities. You still need to consider lawful processing, transparency, data retention and candidates' rights.
6. Review Your Procedures Regularly
Data protection is not a one-off task. Your software, workflows and data-handling practices can change over time.
Review your candidate records, complaints procedure, subject access request process and use of automated decision-making regularly. Check ICO guidance when introducing new AI features or changing how candidate information is handled.
Record when you completed each review and any actions needed. This gives your agency a simple way to track improvements without creating unnecessary administration.
Final Thoughts
The Data Use and Access Act 2025 gives small UK recruitment agencies a reason to review how they handle candidate information, complaints and AI-assisted decisions. Start by understanding what data you hold, assigning responsibility and checking your procedures against current ICO guidance. You do not need a large compliance team to take practical steps towards better data protection.
FAQs
What is the Data Use and Access Act 2025?
The Data Use and Access Act 2025 updates UK data protection law, including rules relevant to personal data, automated decision-making, and data protection complaints.
How does the Act affect AI recruitment tools?
The Act changes the rules for significant decisions made solely through automated processing under UK GDPR. Relevant safeguards remain, including rights to challenge decisions and request human intervention in applicable circumstances.
What is a subject access request in recruitment?
A subject access request allows a candidate to ask for access to the personal data a recruitment agency holds about them, including information in emails, spreadsheets, and recruitment software.
What should recruitment agencies check before using AI recruitment software?
Agencies should understand where candidate data is processed and stored, whether information is shared with external AI providers, how AI-generated recommendations can be reviewed, and how candidate data can be accessed or deleted.