AI CV screening can be GDPR-compliant, but it isn't automatically. Under UK GDPR and the EU GDPR, using AI to score or reject job candidates triggers a specific set of obligations: a lawful basis for processing, a Data Protection Impact Assessment (DPIA), human oversight on any decision with "significant effect" on the candidate (GDPR Article 22), a signed data-processing agreement with the AI vendor, and enforceable candidate rights around access, erasure, and objection. Get those seven things in place and you can use AI screening lawfully. Skip any of them and you're exposed to complaints, ICO investigations, and potentially very large fines under the new EU AI Act tier.

This is a practical guide for hiring teams, DPOs, and founders. It maps every clause to a specific AI-screening scenario so you can implement it, not just cite it.

The legal framework at a glance

Four instruments actually matter for AI CV screening in 2026:

Instrument	What it governs	Applies to
UK GDPR + Data Protection Act 2018	Processing personal data of anyone in the UK	Any UK-based hiring
EU GDPR	Processing personal data of anyone in the EU / EEA	Anyone hiring EU-based candidates, wherever the employer sits
Equality Act 2010	Discrimination outcomes	UK hiring, regardless of tech used
EU AI Act	High-risk AI systems, including recruitment AI	EU-hiring, from Aug 2026

CV screening always sits under GDPR. From August 2026 it also sits under the EU AI Act's "high-risk" tier if any candidate is EU-based. Both frameworks apply at once - this guide covers the GDPR side; the EU AI Act rules are covered separately (deep-dive coming).

Article 22 - the "not solely automated" rule

Article 22 GDPR gives every person the right not to be subject to a decision based solely on automated processing that produces "legal effects" or "similarly significantly affects" them. Rejecting a job application is universally accepted as a "significant effect." So the moment an AI reject decision goes out without a human ever looking at it, Article 22 is engaged.

Three practical scenarios:

AI auto-rejects a candidate → triggered. A human must review each rejection or the tool must be configured never to auto-reject.
AI ranks candidates and a recruiter reviews the top 20 → probably not triggered. The AI's ranking still shaped who a human ever saw, but the reject step was human. Best practice is to log the ranked list so the audit trail exists.
AI scores each CV and the score is visible to the recruiter alongside the CV, then a human decides → not triggered. The decision is human. The AI is a decision-support tool.

The 2023 CJEU Schufa ruling extended Article 22 to intermediate scoring: the score itself can be a decision if it substantially determines the outcome. The safest posture: assume any AI screening step is Article 22-relevant and design a human-in-the-loop workflow accordingly.

The three exceptions to Article 22

Article 22 has carve-outs. In hiring, only one really applies:

Necessary for a contract - the "pre-contractual necessity" clause. Screening candidates for a role you're offering falls here. This is the usual lawful basis. Even under this exception you still owe the candidate the right to human intervention, to express a view, and to contest the decision.
Authorised by member-state law with safeguards - narrow, mostly public-sector use.
Explicit consent - technically available, but fragile. Consent must be freely given, informed, specific, and revocable. In an employment context that "freely given" test is hard to meet - candidates who want the job aren't in a position to refuse.

Use pre-contractual necessity. Document the assessment in your DPIA.

Which lawful basis fits AI CV screening?

GDPR requires a lawful basis for any processing, separate from the Article 22 rules above. Six exist. For AI screening:

Consent - fragile in a hiring context, avoid unless you have a specific reason.
Contract - the pre-contractual necessity basis. Usual fit.
Legal obligation - rarely applies to screening.
Vital interests - no.
Public task - public-sector employers only.
Legitimate interests - a good backstop, but requires a documented Legitimate Interests Assessment (LIA) balancing your interest against the candidate's rights.

Most private-sector employers rely on legitimate interests plus contract, with the LIA on file. Write it down. If challenged, "we hadn't formally documented it" is not a defence.

When is a DPIA mandatory?

A Data Protection Impact Assessment is mandatory whenever processing is "likely to result in a high risk to the rights and freedoms of natural persons." The ICO explicitly lists AI-driven decisions, systematic candidate evaluation, and high-volume processing as high-risk triggers. AI CV screening ticks all three.

A workable DPIA has these sections:

Purpose - why AI screening is being used
Necessity + proportionality - why AI (not just manual review) is needed
Data flow - what data is processed, where, by whom, for how long
Risk register - Article 22 exposure, bias, data breach, over-retention
Mitigations - human-in-the-loop, bias audits, retention policy, vendor DPA
Sign-off - DPO if you have one, else the senior stakeholder accountable

Refresh the DPIA whenever the vendor, model, or scope changes. Not once-and-forget.

Data minimisation in practice

CVs are personal data. They often contain special-category data (health, religion, ethnicity - sometimes inferable from names, addresses, or club memberships). GDPR's data-minimisation principle says: only process what you actually need.

Practical rules:

Anonymised mode when available. Strip name, DOB, photo, and address from the CV before scoring. Many AI tools offer this as a toggle - turn it on for early-stage screening, turn it off once a human is reviewing.
Don't ingest fields you don't need. If your role doesn't legitimately need a driver's licence number, don't ingest it. If you don't need date of birth, strip it.
Retention: bin CVs after the hiring decision + the minimum legal window. In the UK that's typically 6–12 months to cover the discrimination-claim window. Document your retention rule; don't just leave CVs in the tool forever.

Vendor + processor obligations

You (the hiring company) are the data controller - you decide the purpose and means of processing. The AI vendor is the data processor - they process CVs on your instructions. GDPR Article 28 requires a written contract (a Data Processing Agreement) between you.

A compliant DPA covers:

Sub-processors: who else touches the data, and can you object
Data-residency: which country the data is stored and processed in
Confidentiality obligations for vendor staff
Security measures (encryption at rest and in transit, access controls, audit logs)
Breach notification within 72 hours
Deletion or return of data at end of contract
Cooperation with data-subject rights requests

Ask your vendor for their DPA before you sign. If they can't produce one, walk. If it doesn't cover the above, ask them to amend before you go live.

Candidate rights - the checklist

Every candidate whose CV enters the AI system has these rights under GDPR, and you must have a process ready for each:

Right to be informed - the job ad or privacy notice must mention AI screening is used, what it does, and what data it processes.
Right of access - the candidate can ask for a copy of their data. You must respond within one month.
Right to rectification - correct inaccurate data.
Right to erasure - delete their data (subject to your retention window and any legal-hold exceptions).
Right to object - object to legitimate-interests processing.
Right to explanation of automated decisions - the exact scope is contested but the ICO expects meaningful information about how the AI reached its decision.
Right to human review of automated decisions - where Article 22 applies, always.

Publish a candidate-rights page. Route requests to a named DPO or privacy contact. Log responses.

What good compliance looks like - checklist

Print this. Tick everything before you go live.

Privacy notice on the job ad mentions AI screening
Legitimate Interests Assessment on file
DPIA signed off by DPO or senior stakeholder
Signed Data Processing Agreement with the AI vendor
Human reviews every reject decision (Article 22)
Ranking output logged for audit
Bias audit scheduled at least quarterly
Retention rule documented and enforced (typically 6–12 months post-decision)
Candidate rights process defined and staffed
Anonymised mode enabled at the early-screening stage where possible

If you can't tick all ten, don't ship AI screening in production yet. Fix the gaps first.

Where SwiftShortlist sits on this

Short and factual. We store data in the EU. Our default retention is 90 days after a candidate is marked as rejected or hired, extensible by admin toggle. We offer a "delete CV after ranking" setting that removes the source PDF once the structured analysis is stored. We don't use your CVs to train models. Our DPA is available on request. See the security page for detail and the GDPR page for the full policy.

Where to go next

For the wider context - what AI CV screening is, how the scoring model actually works, and how to think about accuracy - read the complete guide to AI CV screening. For the bias question specifically, read is AI CV screening biased?. For tool selection, see our hands-on ranked comparison of the best AI CV screening tools of 2026.

If you want to trial SwiftShortlist with the compliance-safe defaults on (anonymised mode + 90-day retention + no training use), start free - no credit card.

This guide is a starting point, not legal advice. Regulations evolve; for material decisions consult your DPO or a qualified data-protection lawyer. Last reviewed: 14 August 2026.

AI CV Screening & GDPR: The Complete Compliance Guide (2026)