CV screening and UK GDPR: the DPIA, LIA and candidate notice

Screening CVs with software means processing personal data under UK GDPR. Before you start, it helps to have the paperwork in order. This is general information, not legal advice; check the ICO's guidance for your situation.

The usual documents

• DPIA (data protection impact assessment): describes the processing, the risks and how you reduce them. The ICO expects one for processing likely to be high risk.
• LIA (legitimate interests assessment): records why legitimate interests is your lawful basis, if you rely on it.
• ROPA (record of processing activities): your log of what personal data you process and why.
• Candidate notice: tells applicants how their data is used.

What HireSieve provides

HireSieve ships draft DPIA, LIA, ROPA and candidate notices for you to adapt. It also includes a 12-month retention sweep, and it keeps a person in charge of every decision, which matters because UK GDPR restricts decisions based solely on automated processing.

Good habits that help compliance

• Only collect what the job needs.
• Delete on schedule.
• Keep a record of why each candidate progressed.

See also what fair screening leaves out, and the Braivex guide to right to work checks. Small shops handling customer data in marketing tools can see how VirtualPA keeps keys encrypted.

A short checklist before you screen

• Candidate notice published and linked from the job advert
• Lawful basis recorded
• DPIA completed if the processing is likely to be high risk
• Retention period set and a deletion routine in place
• A named person who makes and records each decision

Multi-site employers handling customer feedback can keep it in one place with Loculens.

More from Braivex

• ReelSieve turns an Airbnb listing link into a walkthrough video saved to your own Google Drive.
• Housieve scores London listings from Rightmove, Zoopla, OnTheMarket and Gumtree every morning.
• Loculens brings every branch's Google reviews into one dashboard, with reply drafts a person sends.
• VirtualPA gives small shops a daily marketing brief from their ads, email, sales and stock.
• Reachwyn plans a week of LinkedIn posts in your own voice, and nothing publishes until you approve it.

Read more guides on the Braivex blog.