You have found an AI tool that could speed up your CV searches. Before you switch it on, ask one question: do you need a DPIA? For most small agencies, the answer is probably yes, and it is less work than it sounds. A data protection impact assessment is a short-written check of what a new tool does with candidate data, what could go wrong, and how you will reduce the risk.
What is a DPIA?
A DPIA is a process to help you identify and minimise the data protection risks of a project. That is the DPIA meaning in the ICO’s own terms. It comes from Article 35 GDPR, which carries over into UK GDPR, and it used to be called a privacy impact assessment.
Three things to know:
- It is yours. As the agency, you are the data controller, so the assessment belongs to you, not your software vendor.
- It comes first. Complete it before the tool goes live.
- It is ongoing. Revisit it when your tool or process changes.
When Is a DPIA Required?
You need one when processing is likely to be high risk to candidates. The ICO’s guidance draws on European guidelines with a simple rule of thumb: if two or more high-risk criteria apply, plan to do a DPIA.
| Criterion | What it looks like in an agency |
|---|---|
| Evaluation or scoring | AI ranks candidates against a role |
| Innovative technology | A new AI tool reads your CVs |
| Sensitive data | CVs mentioning health or other special category data |
| Large-scale processing | A big candidate database built over years |
Using AI to rank CVs already ticks two boxes. If you decide you do not need a DPIA, write down why. The ICO expects that record. For the full detail, see the ICO’s DPIA guidance.
How to Do a DPIA in 7 Steps
There is no fixed format, and the ICO DPIA template is a good place to start.
- Explain the need. What will the tool do, and which criteria apply?
- Describe the processing. Where CVs come from, where they are stored and processed, who sees results, and when they are deleted.
- Consult. Ask the consultants who will use the tool.
- Check it is necessary. Confirm your lawful basis and use only the CV data you need.
- Assess the risks. Note how likely and how serious each one is.
- Reduce them. Human review of AI results, clear retention periods, staff training.
- Sign off and review. The owner approves it. If a high risk remains that you cannot reduce, consult the ICO before you start.
For a small agency, this can fit on two pages. Our guide to GDPR for small businesses covers the wider basics.
Where Do Your CVs Go? Data Controller vs Data Processor
Step 2 is where your tool choice matters most.
With most cloud AI tools, CVs are sent to the vendor’s servers. The vendor acts as your data processor, so you need a data processing agreement, and your DPIA must cover the vendor and where its servers are. With an on-device tool, the AI runs on the recruiter’s phone, so there is less to map.
| Question | Typical cloud AI tool | On-device AI tool |
|---|---|---|
| Where are CVs processed? | Vendor servers | Your device |
| Data processing agreement for AI processing? | Usually needed | Less likely; check with the vendor |
| Works offline? | Usually not | Yes, once set up |
An example: EdgeTal
EdgeTal is our product, and we include it as one example of the on-device approach. It is currently in a limited beta. CVs are imported and stored on the phone, and search and AI analysis run on the device after a one-time model download of about 1.3 GB. In the EICON 2026 research paper, every stage of the search pipeline ran on the device with no external server connection, and testing was done fully offline in airplane mode.
You can read the technical detail on our privacy and architecture page. An on-device tool does not remove your DPIA. You still need device security, a lawful basis and retention rules.
Keep a Person in the Loop
Article 22 GDPR covers decisions made solely by automated means that significantly affect people. The practical answer is simple: let AI help, but have a consultant review every shortlist and be able to explain it. Our article to human in the loop AI shows how.
Conclusion
A DPIA is a short record that shows you thought about candidates before switching on a new tool. Start with one question: where does the AI process my CVs?
If you want an AI tool where CV search and analysis stay on your phone, EdgeTal is in a limited beta, onboarding small groups of UK agencies.
Frequently Asked Questions
Do I need a DPIA to use AI for CV screening?
In most cases, yes. AI CV screening usually means evaluating candidates with new technology, which are two high-risk signals. Even if it is borderline, working through the steps helps you choose the right tool and answer candidate questions with confidence.
Who should complete a DPIA in a small agency?
The owner or director, because the agency is the data controller. They can write it with input from the consultants who will use the tool. Get specialist advice if the risks feel complex or unclear.
Does an on-device AI tool remove the need for a DPIA?
No. It can reduce some risks, because CVs are not sent to an external server for AI processing. But you are still the data controller, so you still need a lawful basis, retention rules, human review and device security.