Using AI to make employment decisions: what employers need to know from a data protection perspective

Employers are increasingly turning to AI to support decisions throughout the employment lifecycle, from recruiting candidates, screening CVs, monitoring performance to assessing employees, recommending promotions to managing absence.

However your business choses to us AI tools in the employee lifecycle, the use of ChatGPT, Claude, Copilot can involve the processing of personal data about real candidates and employees, and that brings a distinct set of data protection obligations that you as an employer need to get right.

Do your AI tools involve making automated decisions about employees?

The Data (Use and Access) Act 2025 (DUAA) amended the UK GDPR’s rules on automated decision-making, replacing the old Article 22 with a new framework (Articles 22A–22D) that came into force on 5 February 2026. Automated decisions with legal or similarly significant effects are permitted more readily, but individuals must be told when AI or automated decision making is in use, given an explanation, and given a genuine route to human review.

The question of whether an AI tool amounts to automated decision-making under UK data protection law arises whenever it scores, ranks, filters or flags people – whether that is shortlisting candidates, ranking employees for promotion, or scoring absence risk. If the outcome is determined with no meaningful human involvement and has a legal or similarly significant effect, then the employee must be told, given an explanation of the logic involved, and given the ability to seek human review.

HR teams or hiring managers who simply “approve” an AI-generated output without real control or ability to change the outcome does not count as meaningful human involvement. This applies equally at recruitment stage, in promotion decisions, or when a tool recommends action following an absence or conduct flag.

Employers should map which of their AI-supported decisions meet the automated decision-making threshold and build in a review step that is genuinely capable of changing the outcome.

Establishing a lawful basis

Every use of AI in an employment decision involves processing personal data, so employers need a clear lawful basis under Article 6 UK GDPR before use. Where AI tools touch special category data (for example health related data), a separate Article 9 condition is also needed under UK GDPR.

Your lawful basis for processing personal data under the GDPR will depend on which AI tool is being used and the purpose for which personal data is being processed. For example, a lawful basis that works for CV screening will not automatically extend to, say, ongoing performance monitoring or misconduct detection, because the nature and intrusiveness of the processing differs.

Data protection impact assessments (DPIAs)

Wherever an AI tool scores, profiles, or makes automated decisions about candidates or employees, this is very likely to be high-risk processing that requires a DPIA. The assessment should cover recruitment screening, performance monitoring, absence-pattern analysis. Many employers do not recognise that AI tools can carry out automated decision-making and that data protection impact assessments (DPIAs) are often needed to meet legal requirements under UK data protection law.

DPIAs are often too generic to meet the legal standard: a template completed once and left unreviewed will not meet the legal standard. DPIAs need to be specific to each AI tool, address how bias and discrimination risk will be monitored, and be revisited whenever the tool, its data sources, or its use changes.

Special category data

Some AI use cases inevitably touch special category data under Article 9 UK GDPR – most obviously absence management, where health information is often central, but also monitoring tools that may pick up on protected characteristics indirectly, or misconduct-detection tools that can surface information about a person’s health, beliefs, or other sensitive matters incidentally. Any AI tool that touches special category data needs its own explicit Article 9 condition, heightened safeguards, and should never simply be treated as another input.

Transparency and employee rights

Whether someone is a job candidate, an employee under performance review, or a member of staff whose absence pattern has triggered a flag, the same underlying principle applies: they are entitled to know that AI is involved in a decision about them, in terms they can understand, and to exercise their rights, including subject access requests, objections, and requests for human review in relation to that processing. Privacy notices, recruitment communications, and staff handbooks all need updating to reflect this. Generic statements that AI “may be used” are unlikely to be sufficient where the processing has a significant effect on the individual.

Practical checklist for employers

• Map every AI tool used across the employment lifecycle and record its purpose, data sources, and your lawful basis under Article 6, as well as Article 9 UK GDPR where special category data is involved.
• Identify which AI tools involve automated decision-making, profiling, or special category data, and treat each accordingly.
• Carry out specific, tailored DPIAs rather than using generic templates, and review them whenever a tool or its use changes.
• Build in genuine human review, with the authority and information needed to actually change an outcome.
• Update privacy notices and staff communications so employees understand what AI is being used and what rights they have.
• Keep records demonstrating accountability: DPIAs, review decisions, and monitoring for bias and accuracy over time.

Conclusion

If you are deploying AI in recruitment, monitoring, assessment, promotion, absence management, or misconduct detection, data protection law sets out clear, practical requirements: you need a proper lawful basis, you need to complete appropriate DPIAs, you must ensure genuine transparency and real human oversight where automated decision-making is involved, and  remember to take heightened care around special category data.

If you have any questions about using AI in the workplace, please reach out to Maria Spencer who will be happy to answer any questions.

You can find out here about our Data Protection services.