Is candidate data safe with an AI worker in a recruitment agency?

It can be, if a consultant and not software decides who goes forward. Two more things must hold. The agency answers for the data, under a written contract with whoever runs the AI worker. And a candidate's details go to a client for the purpose of finding that candidate work, or with their consent. UK GDPR across the UK, and the Equality Act 2010 and the Conduct Regulations in England, Wales and Scotland, put those duties on the agency, and none of them moves to a supplier.

Whose data is it?

A recruitment agency decides why and how it holds candidates' details, which makes it the controller under UK GDPR, the law that applies across the UK. The recruitment guidance of the Information Commission's Office (ICO) covers agencies by name. A provider that runs an AI worker for the agency, on the agency's instructions, processes the data on the agency's behalf, and the law requires a contract between the two with terms it lists: our article on AI workers and client data under UK GDPR goes through them.

Candidates ask two things about AI: where are my details, and are they used to train it? An agency needs an answer it can repeat, and this is ours: Your data is stored in the UK, and is never used to train AI models.

Can an AI worker shortlist or reject a candidate?

An AI worker can rank and give reasons. The decision is a consultant's.

Articles 22A to 22C of UK GDPR, in force since 5 February 2026, require safeguards where a significant decision about a person is taken with no meaningful human involvement, and restrict such a decision where it is based wholly or partly on special category data, which includes health, ethnic origin and trade union membership. The article on UK GDPR linked above sets those rules out.

The ICO's recruitment guidance says what meaningful involvement looks like. Where the person reviewing an AI recommendation has no power to overturn it, the decision has still been made by automated means. The same guidance says an organisation must carry out a data protection impact assessment for its use of AI in recruitment, and should have measures to check for bias. That page is under review following the Data (Use and Access) Act 2025 and may change.

In CV screening and shortlisting an AI worker's job is to read each application against criteria a consultant has approved, rank it and say why. The consultant sees the ranking and the reasons, can disagree with any of them, and decides who is shortlisted. No candidate is rejected by the worker.

What about discrimination?

In England, Wales and Scotland the Equality Act 2010 says an employment service-provider must not discriminate in the arrangements it makes for selecting people, and it counts both finding employment for people and supplying employers with people to do work as an employment service. The duty is the agency's whoever applies the criteria. In this role the criteria are drafted from the brief, edited and approved by a consultant, and kept on record.

Who can see a candidate's details?

The Conduct of Employment Agencies and Employment Businesses Regulations 2003, which apply in England, Wales and Scotland, say that neither an agency nor an employment business may disclose information relating to a work-seeker without that person's prior consent, with three exceptions: for the purpose of providing work-finding services to them, for legal proceedings, and to their professional body. An agency may not disclose it to a work-seeker's current employer without consent.

An AI worker changes none of that. It files a CV against the job the candidate applied for, in candidate pipeline and ATS upkeep, and it does not send a CV to a client. Putting a candidate forward, and to whom, is the consultant's act.

What stays with a person at the agency?

• Who is shortlisted and who is rejected. A consultant decides, with the power to overrule the ranking.

• The screening criteria. Approved by a consultant for each brief before a CV is read.

• Submitting a candidate to a client. The consultant's decision.

• The right to work check. The worker can gather what is needed and track what is outstanding, as described under right-to-work checks. A person on your team carries out the check.

• A candidate's request about their data. A request for a copy, a correction or deletion goes to a person at the agency.

What to settle before the worker starts

1. What the worker reads. A CV can carry more than the job needs. The specification says which parts of an application the worker uses.

2. What candidates are told. What your privacy information says about the use of AI is the agency's decision under its own policies. The impact assessment is the agency's to carry out, and the ICO says its supplier must assist.

3. Who reviews it. Each time a consultant changes the worker's ranking it is recorded, and a named consultant or manager reviews those records.

This article states the duties and does not advise on how to meet them. The roles themselves are on our recruitment page, and how to scale a recruitment agency without hiring sets out where they fit.

An AI worker in your agency would log each applicant and rank it against criteria a consultant approved, giving reasons, and your consultants would decide who is shortlisted, who is put forward and to whom. Has a client or a candidate asked how you use AI, and could you answer in one sentence? Talk to our agent.