Screening tools, ranking tools and chat-based pre-screens are now standard kit. So is the regulator's interest in them. If a tool influences who gets a call and who doesn't, these five things need to be on file before it goes near a live search.
A DPIA completed before the tool goes near a live shortlist
A data protection impact assessment, done and dated before the first real candidate is processed, not written up afterwards.
ADM disclosed in the privacy notice, in plain language
Candidates are told that automated decision-making is used, what it decides, and how to ask for a human to look again.
A named human reviewer with real authority to overturn the tool's call
One person, by name, who can and does reverse a rejection. A rubber stamp is not meaningful human involvement.
A monthly bias log, checked against protected characteristics
Outcomes by age, sex, ethnicity, disability and the rest, reviewed on a fixed cycle, with what was done about any skew.
A vendor contract confirming your candidate data isn't used to train their model
In writing, from the supplier, alongside the processor terms UK GDPR already requires.
The tool is yours to answer for
The vendor built it; you deployed it on your candidates. That makes the decisions, and the paper trail behind them, your responsibility. Batiq&Co drafts the DPIA, the notice wording and the review procedure so the tool works for the desk instead of against it.
Book a 30-min consultationBatiq&Co is a commercial compliance and contracts consultancy, not a law firm. General guidance, not regulated legal advice.