United Kingdom — UK GDPR and Data Protection Act (incl. the Data (Use and Access) Act 2025)
What it asks of employers
- Pick a lawful basis and give candidates the required privacy information. Before you collect candidate data, decide and record your lawful basis, and give candidates the privacy information UK law requires (who you are, why, how long, their rights, and any automated decision-making).
- Add safeguards for significant decisions made solely by software. If a decision that significantly affects a candidate is based solely on automated processing, give them the required safeguards — information about the decision, a way to make representations, to obtain human intervention, and to contest it — and don't base such a decision on special-category data without a lawful condition.
- Correct inaccurate candidate data on request. When a candidate says their information is wrong, correct it — in your applicant tracking system if the record is there, or by asking Amp to update data held in Amp, which Amp does through support on request.
- Run a data-protection impact assessment and keep processing records. Because AI-assisted screening is likely high-risk processing, carry out a data-protection impact assessment before you use it, keep records of your processing, and appoint a data-protection officer where required.
- Report personal-data breaches to the ICO. If candidate data is breached and there's a risk to candidates, notify the Information Commissioner's Office within 72 hours, and tell affected candidates when the risk is high.
What Amp does
- Amp answers candidate subject-access requests. When a candidate asks for the personal data you hold, Amp gathers the categories, sources, purposes, and the data itself so you can respond within the one-month deadline.
- Amp carries out candidate erasure requests. When a candidate asks to erase their data, or it's no longer needed, Amp deletes it across candidate records and passes the request to the services that received it.
- Amp keeps candidate data only as long as your policy allows. Amp follows your organization's retention policy and deletes candidate data once it's no longer needed for the purpose it was collected for.
- Evidence to support automated-decision safeguards. Amp scores every candidate on the same job-related setup and can produce a tamper-evident package documenting the factors and method behind a score, which you can use to give the candidate information about the decision and to support a human review.