AI Candidate Sourcing and UK GDPR: What Recruiters Need to Know

AI candidate sourcing has changed how UK recruitment teams discover talent. Recruiters can now search professional profiles, identify potential candidates based on skills and experience, and build talent pipelines without relying entirely on manual searches. For businesses hiring across multiple roles, this can significantly reduce sourcing time and help uncover professionals who may never respond to a traditional job advertisement.

However, finding someone's professional profile online does not mean an organisation can automatically collect, analyse, store, or use their information for recruitment. Candidate sourcing involves processing personal data, which brings UK GDPR obligations into the picture.

For recruiters, the challenge is understanding how to use AI candidate sourcing software responsibly while maintaining the efficiency these tools promise. This guide explains the relationship between AI candidate sourcing and UK GDPR, including lawful basis, publicly available information, candidate transparency, automated profiling, and practical steps for choosing a compliant recruitment platform.

Note: This article provides general information, not legal advice. Organisations should assess their own processing activities and obtain appropriate legal or data protection advice where necessary.

Does UK GDPR Apply to AI Candidate Sourcing?

Yes. UK GDPR can apply whenever a recruiter or recruitment platform processes personal data to identify, assess, or contact potential candidates.

Personal data includes information that identifies or can identify an individual. In recruitment, this can include:

• Names, email addresses, and telephone numbers.
• Employment history and professional experience.
• Skills, qualifications, and certifications.
• LinkedIn and other professional profile information.
• Location and career history.
• Candidate search records, profile rankings, and recruitment notes.

AI sourcing tools may collect information from several sources and use it to identify people who match a hiring brief. Even when the information comes from publicly accessible professional profiles, it can still be personal data under UK GDPR.

This is an important distinction for recruiters. A public LinkedIn profile or professional portfolio is not an unrestricted source of information that employers can use for any purpose. The organisation must still establish a lawful basis, explain its processing appropriately, and comply with the relevant data protection principles.

The UK government's Responsible AI in Recruitment guidance specifically identifies candidate sourcing, screening, interviewing, and selection as areas where organisations need to consider data protection and responsible AI practices.

1. Establish a Lawful Basis Before Sourcing Candidate Data

One of the first questions a recruiter should ask when using AI candidate sourcing software is: what is our lawful basis for processing this information?

UK GDPR requires organisations to identify an appropriate lawful basis before processing personal data. Depending on the circumstances, this may include legitimate interests, consent, or another applicable basis.

For many recruitment sourcing activities, organisations may consider legitimate interests where identifying potential candidates is necessary for a genuine recruitment purpose and the individual's interests and rights do not override that purpose.

However, legitimate interests should not be treated as automatic permission to collect every available profile. Organisations should complete a legitimate interests assessment where appropriate, documenting:

• Purpose: Why does the organisation need to process this candidate information?
• Necessity: Is processing the information reasonably necessary to achieve that purpose?
• Balancing: Could the processing negatively affect the individual's privacy or expectations, and how will those risks be addressed?

For example, searching professional profiles for candidates with relevant software engineering experience may be reasonably connected to an open recruitment requirement. Collecting unrelated personal information from those same profiles would be much harder to justify.

The lawful basis should reflect the actual processing activity, not simply the fact that a recruitment tool offers a particular feature. The Information Commissioner's guidance on lawful basis provides further information. \

2. Publicly Available Candidate Information Is Still Personal Data

A common misunderstanding is that recruiters can freely use information simply because it is publicly available online. This is not how UK GDPR works.

A professional profile may be visible to anyone, but its information remains personal data when it relates to an identifiable individual. Using AI to collect, combine, rank, or analyse that information is still processing.

Recruiters should therefore consider whether the information is relevant to the vacancy, whether its use is within the individual's reasonable expectations, and whether the organisation has a lawful basis for processing it.

For example, a candidate's publicly listed employment history and professional qualifications may be relevant to a sourcing search. Their unrelated personal posts, family information, or sensitive personal details generally have no place in an ordinary candidate evaluation.

A responsible AI sourcing process should focus on professional information that is necessary for the recruitment purpose. It should also avoid collecting more data than the organisation needs.

3. Be Transparent About How AI Uses Candidate Information

Transparency is particularly important when recruiters source candidates who have never directly applied for a vacancy.

Under UK GDPR, individuals must receive appropriate privacy information about how their personal data is processed. When information is obtained indirectly, Article 14 is particularly relevant. Its requirements generally include explaining who is processing the data, the purposes and lawful basis, the categories of information involved, the source of the data, and relevant rights.

There are specific circumstances in which exemptions may apply, but recruiters should not assume that publicly available information removes the transparency obligation.

A candidate privacy notice should explain, in accessible language:

• What categories of personal data the organisation collects.
• Whether information comes from professional networks or other external sources.
• Why AI sourcing or profiling is being used.
• How candidate information may be evaluated or matched.
• How long the information will be retained.
• How candidates can exercise their data protection rights.

This information should be easy to find and should reflect the organisation's actual recruitment practices.

The UK government's Responsible AI in Recruitment guidance also highlights transparency, fairness, and assurance as important considerations when deploying AI in hiring.

4. Understand AI Profiling and Automated Recruitment Decisions

AI candidate sourcing software can do more than retrieve profiles. Some platforms analyse professional information to identify patterns, predict suitability, or rank candidates against a job description.

This may involve profiling under UK GDPR, depending on how personal data is processed and what the system is evaluating.

There is an important distinction between AI supporting a recruiter and AI making a decision that significantly affects a candidate.

For example, using AI to suggest profiles for a recruiter to review is different from automatically rejecting candidates without meaningful human involvement. The latter can raise more serious legal and governance questions.

The Data (Use and Access) Act 2025 introduced changes to the UK GDPR framework for solely automated decisions with legal or similarly significant effects. Most relevant data protection reforms came into force on 5 February 2026. The revised framework allows such decisions in wider circumstances but requires appropriate safeguards, including information about significant decisions, opportunities to make representations, and the ability to obtain human intervention.

Recruiters should therefore understand exactly what an AI sourcing platform does with candidate data. Does it recommend profiles for review, rank applicants, or automatically exclude people? The distinction should be documented and reflected in the organisation's processes.

Meaningful human oversight should involve an actual opportunity to review and reconsider the outcome, rather than simply approving an automated recommendation without examination.

5. Conduct a Data Protection Impact Assessment Where Required

AI recruitment systems can involve large-scale profiling, data matching, and innovative technology. Depending on the nature, scope, and risks of the processing, a Data Protection Impact Assessment (DPIA) may be required before implementation.

A DPIA helps organisations identify potential privacy risks and decide how to reduce them before using a system.

For AI candidate sourcing, a DPIA should consider:

• What candidate information the system collects and processes.
• Where the information comes from.
• How the AI matches or ranks candidate profiles.
• Whether sensitive or special category data could be involved.
• Whether automated recommendations could unfairly disadvantage candidates.
• How individuals can access information and exercise their rights.
• What security and retention controls are in place.

A DPIA is not simply a procurement document that can be completed once and forgotten. It should be reviewed when the organisation changes its sourcing practices, introduces new AI features, or identifies new risks.

The government's Responsible AI in Recruitment guide specifically recommends considering DPIAs when deploying AI in recruitment, particularly where high-risk processing is involved.

6. Check Your AI Sourcing Vendor's Data Protection Practices

Recruiters often focus on search accuracy, database size, and automation features when comparing AI sourcing software. Data protection should receive the same attention.

Before choosing a vendor, establish whether your organisation acts as the data controller, whether the supplier acts as a processor, or whether the arrangement involves other controller responsibilities. The roles depend on who determines the purposes and means of processing, not simply on what the contract calls each party.

Ask potential vendors:

1. Where is candidate information collected and stored?
2. Which external sources are used for candidate discovery?
3. Does the platform use customer or candidate data to train AI models?
4. How does the vendor handle data access, correction, and deletion requests?
5. What security measures protect candidate records?
6. Are subprocessors or international data transfers involved?
7. How long is candidate information retained?
8. Can the vendor explain how its matching and ranking features work?

Where a supplier processes personal data on your behalf, the contract should include the required data processing terms and instructions. The organisation should also assess the vendor's security, subprocessors, and international transfer arrangements.

The UK data protection regulator has previously highlighted concerns around AI recruitment providers, including data minimisation, transparency, lawful basis, and clear responsibilities between organisations and technology providers.

How Cooper Supports AI-Powered Candidate Sourcing

Compliance should be considered alongside functionality when selecting AI recruiting software. Recruiters need to understand how a platform discovers candidates, uses their information, and supports the hiring workflow.

Cooper is an AI recruiting platform with specialised agents for different stages of recruitment:

• Coo: AI candidate sourcing and matching for discovering active and passive candidates.
• Scout: AI candidate screening against defined qualification criteria.
• Robin: Structured AI interviews, with candidate responses and summaries for recruiter review.
• Cooper ATS: Candidate progression and hiring workflow management.

For UK recruitment teams evaluating Cooper, the important questions are how the platform's data processing arrangements align with the organisation's requirements, what information is collected, and what contractual and technical safeguards apply to the intended use.

AI sourcing can improve how recruiters discover talent, but the organisation using the technology remains responsible for ensuring that its recruitment practices comply with applicable data protection requirements.

Final Thoughts

AI candidate sourcing and UK GDPR do not have to work against each other. Recruiters can use AI to discover relevant professionals and build stronger talent pipelines while respecting candidates' privacy and data protection rights.

The key is to establish a lawful basis, use relevant information, explain how candidate data is processed, understand profiling and automated decisions, and assess the responsibilities of technology providers. Organisations should also review their processes regularly as AI capabilities and data protection requirements evolve.

The best AI candidate sourcing strategy is not simply the one that finds the most profiles. It is the one that helps recruiters find relevant talent while maintaining transparency, accountability, and trust throughout the hiring process.