Article 22 of the GDPR gives people a right not to be subject to a decision based solely on automated processing, including profiling, where the decision has legal or similarly significant effects. In hiring, a decision to reject someone with no human involvement can fall under it. The safest approach is to make sure a real person weighs the evidence and makes each decision.
Key takeaways
- Article 22 covers decisions made solely by automated means that significantly affect a person. Refusing a job application is a typical example.
- Exceptions exist, such as explicit consent or necessity for a contract, but they come with safeguards.
- A human step must be real. Rubber-stamping a tool’s output may not count as human involvement.
- Tell applicants about automated tools and give them a way to ask for a person to review.
- The UK and the EU have different and changing rules here. Read the current official guidance.
What Article 22 says
Paragraph 1 of Article 22 in the GDPR gives the data subject the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning them or similarly significantly affects them. The recitals of the regulation mention, as an example, the automatic refusal of an online credit application and e-recruiting practices without any human intervention.
Paragraph 2 lists three exceptions: the decision is necessary for entering into or performing a contract; it is authorised by law that sets safeguards; or it is based on the explicit consent of the person. Where the first or third exception applies, paragraph 3 requires safeguards, at least the right to obtain human intervention, to express a point of view and to contest the decision. Paragraph 4 sets stricter limits where the decision uses special category data, such as health or ethnicity.
The articles on transparency also matter. People must be told about the existence of automated decision-making, including profiling, and given meaningful information about the logic involved and the significance and expected consequences. The European Data Protection Board publishes guidelines on automated individual decision-making. UK rules have been changed by recent legislation, so read the Information Commissioner’s Office pages on automated decision-making for the current position.
Does it apply to my hiring process?
Ask two questions. First, is the decision based solely on automated processing? Second, does the decision have legal or similarly significant effects on the person? A decision to refuse a job application usually has a significant effect. So the key question is the first one: is there meaningful human involvement?
| Situation | Likely position | Why |
|---|---|---|
| A tool automatically rejects applicants below a threshold, and nobody looks at the rejected ones | Likely solely automated | No human decides |
| A tool ranks applicants and a recruiter reads the top 20 only, never opening the rest | Needs careful assessment | The ranking may effectively decide who is considered, so the human step may not be meaningful |
| A tool highlights evidence in each CV and a reviewer reads every CV and decides | Human decision | The person weighs the evidence and decides |
| A tool schedules interviews | Not a hiring decision | No evaluation of the person |
| A chatbot asks knock-out questions and ends the application if an answer is “no” | Likely solely automated if no person reviews | The answer to a rule decides the outcome |
The EU Court of Justice has held, in a case about credit scoring, that producing a score can itself be an automated decision where a third party relies strongly on it to decide. The reasoning may be relevant if a hiring manager follows a tool’s score without further thought. Read the court’s judgment and the regulator’s guidance for the exact reasoning, and ask a specialist how it applies to your tools.
What makes human involvement meaningful
Regulators expect more than a click on “approve”. A human step is more likely to count when the reviewer has authority and competence to change the outcome, has access to all the relevant information including the original CV, actually considers the evidence, and the tool’s output is only one input. Use the checklist below to test your process.
| Test | Meaningful | Not meaningful |
|---|---|---|
| Reviewer authority | Can overturn the tool and often does | Never overrides, or is discouraged from doing so |
| Information | Sees the full CV and the job requirements | Sees only a score or label |
| Time | Has time to read | Approves hundreds a minute |
| Evidence | Writes a reason tied to the CV | Types “ok” or leaves no note |
| Training | Understands what the tool does and its limits | Has not been told how it works |
| Audit | The team checks a sample of decisions | Nobody checks |
Practical steps
- List every tool that touches applications. Include chatbots, parsers, screening tools and scheduling tools.
- Classify each tool. Does it only help a person, or does it decide? Describe in one sentence.
- Remove automatic rejections. Replace them with a review step, where a person reads the evidence.
- Show the evidence to the reviewer. A tool that shows the exact CV passage behind each mark makes human review practical.
- Tell applicants. In your applicant privacy notice, say which tools you use, and how a person reviews outcomes.
- Offer a route to human review. Give a contact point for applicants who want a person to check the decision.
- Train reviewers. Explain what the tool can and cannot do, and tell them they are expected to disagree with it when the CV says so.
- Check samples. Review a sample of tool-assisted decisions each quarter to see if reviewers follow the tool without thought.
- Do an impact assessment. See data protection impact assessments for hiring tools.
If you rely on an exception
Some employers rely on explicit consent or on contract necessity for limited automated steps, such as an eligibility check against a legal requirement. If you do, document the exception and the reason. Consent for an application process is hard to rely on because applicants may feel they have no real choice. Contract necessity is read narrowly; a regulator may ask whether a person could do the step. For decisions that use special category data, the exceptions are tighter still. Ask a specialist before you use an automated rejection step in the UK or EU.
Beyond GDPR: other rules to know
- EU AI Act. Some AI systems used in hiring are treated as high risk, with duties on providers and on employers who use them. We do not state dates here. Read the official text and our overview.
- United States. There is no general automated decision right. Some state and city laws apply, such as New York City rules on automated employment decision tools. Federal equal employment law still applies to results from any tool.
- United Kingdom. Equality Act duties apply to outcomes from tools just as they do to human decisions, and data protection rules on automated decisions are in change. Check current ICO guidance.
FastHire is designed so that a person makes each decision. It shows each job requirement next to the exact CV passage that supports it, which gives the reviewer the evidence in one view. FastHire does not rank, score or reject candidates. It is coming soon.
A worked example (fictional)
A retailer in the Netherlands receives 1,800 applications for seasonal warehouse roles. This case is invented to show the reasoning. The company considers two designs.
| Design | What happens | Article 22 view |
|---|---|---|
| A. Automatic cut-off | A tool compares answers with the requirements and removes everyone below a threshold. Recruiters read only the rest. | High risk. Rejections are made without a person. Needs an exception, safeguards and a DPIA, or a redesign. |
| B. Evidence view | A tool highlights where each requirement appears in the CV. Two recruiters read every application with the highlights, using a shared sheet, and decide. They can overrule the highlights. | A person decides on all applications. The tool is a support, not the decision-maker. |
The company chooses design B. It writes the review steps in the process document, tells applicants in the notice that software highlights CV text and that people decide, and adds a contact for questions. It takes a sample of 50 decisions each quarter and checks that recruiters sometimes overrule the highlights, which shows that the review is active. If recruiters never disagree with the tool, the company asks why.
Template: wording for applicants
How we use software when we read applications
We use software to help our recruiters find the parts of your CV that relate to the job requirements. The software does not decide who we interview or hire. A recruiter reads every application and makes the decision.
If you would like a person to review the outcome of your application, write to [email]. We will reply within [period].
Only write this wording if it is true. If you use a tool that does more, describe it honestly and ask a specialist to review.
Questions to ask your software vendor
- Does any feature reject, rank, score or remove applicants without a person acting? Can we turn it off?
- Can the reviewer see the underlying CV and the reasons for any mark?
- Do you record when a reviewer agrees or disagrees with the tool? Can we export that record?
- Do you provide documents to support our impact assessment?
- Which of your features does the EU AI Act regulate as high risk, and what do you provide to help us?
Keep the answers in writing. If a vendor cannot explain a feature in plain language, you cannot explain it to an applicant or a regulator.
Documenting your position
Keep a short record for each tool that supports hiring. It should say what the tool does, whether it makes any decision on its own, who reviews the output, what the reviewer can see, how often reviewers disagree, and who checked this and when. This record is useful for three readers. A regulator can use it to see how you reached your view. An applicant who asks a question can get a clear answer. And a new recruiter can learn how the process is meant to work.
Review the record when the tool changes, which can happen without notice when a vendor updates a feature. Ask vendors to tell you in writing before they add or change any automated step. A feature that was only a highlight last quarter may become a recommendation next quarter, and your notice and assessment would then be out of date.
A final practical tip: run a short drill each half year. Pick five recent applications at random and trace each from the CV to the decision. Ask the reviewer to show where in the CV the evidence sits and why they chose the outcome. If the reviewer cannot do this, or if the tool’s output seems to have decided the case, the human step needs strengthening. The drill takes under an hour and gives you real examples to use in training and in answers to any questions from applicants or regulators.
Frequently asked questions
Is a ranking of applicants an automated decision?
A ranking alone may not be a decision, but it can become one if people treat it as the outcome and do not look at lower-ranked applicants. Design the process so that people review the evidence for everyone who meets the stated requirements.
Can I use an automatic knock-out question?
Be careful. A knock-out question based on a legal requirement, for example a licence the law requires, is easier to defend than one based on a preference. Even then, offer a way for a person to review.
What should I say to an applicant who asks about automated decisions?
Explain which tools you use, what they do, and that a person makes each decision and can review their case. Give a contact point.
Do these rules apply to internal candidates?
Yes. Data protection rights apply to employees as well as external applicants.
Does Article 22 apply to employers outside the EU?
It can apply if GDPR applies to your processing, for example when you offer jobs to people in the EU. Ask a specialist about your case.
Related guides
- Hiring guides for fair and compliant hiring
- GDPR for job applicants: what employers must do
- Data protection impact assessments for hiring tools
- EU AI Act and hiring tools
- All hiring guides for employers
- New York City Local Law 144: bias audits for hiring tools
- How to handle candidate data requests under GDPR
This is general information, not legal advice.