European Union: General Data Protection Regulation (Regulation (EU) 2016/679)

European UnionRegulationApplicable

The General Data Protection Regulation (Regulation (EU) 2016/679) - GDPR - establishes an EU-wide legal framework governing the processing of personal data by organizations established in the EU or targeting individuals within the Union. While the regulation applies horizontally across all economic sectors, Warden Watch focuses specifically on its provisions governing automated decision-making and profiling within recruitment and employment. Article 22 establishes a general restriction prohibiting employers and deployers from subjecting individuals to decisions based solely on automated processing - including profiling - that produce legal effects or similarly significantly affect them, such as automated candidate filtering without human intervention. Solely automated decisions are permissible only under narrow exceptions: contractual necessity, statutory authorization, or explicit consent, and must be accompanied by mandatory safeguards including the right to human intervention, to express one's point of view, and to contest the decision. Controllers must also provide advance notice explaining the logic involved and conduct data protection impact assessments for high-risk automated evaluations. The regulation does not ban automated tools outright where meaningful human oversight is maintained.

Impact

What this means for HR and vendors

HR and recruitment teams

HR teams and recruitment specialists using automated screening or workforce assessment tools must avoid fully automated rejection or selection workflows unless an Article 22 exception applies and strict safeguards are implemented. Organizations should ensure that human involvement in hiring and talent management decisions is meaningful, substantive, and capable of changing algorithmic recommendations, rather than serving as a superficial sign-off. This increases the importance of documenting decision workflows, providing clear pre-screening notices explaining algorithmic logic, offering candidates straightforward channels to contest automated outcomes, and conducting data protection impact assessments before deploying automated evaluation systems.

HR technology vendors

While GDPR primarily places statutory compliance duties for automated decision-making on employers as data controllers, HR technology providers face significant commercial expectations and processor obligations. Providers must design recruitment and talent platforms that support meaningful human oversight, preventing purely automated decision-making by default. Vendors should equip employer clients with clear technical documentation detailing algorithmic logic, key decision factors, and model limitations to enable statutory transparency disclosures. Additionally, providers should facilitate auditability, provide DPIA support collateral, and ensure system architectures allow human reviewers to intervene, review underlying profiles, and easily adjust or reverse automated recommendations.

Key obligations

What organizations need to do

Practical obligation briefings focused on what the requirement is, who it applies to, when it applies and what teams should consider doing.

DeployerAutomated Decision Safeguards

Provider Technical Documentation and Support

OBLIGATION

APPLIES TO

STATUS

Keep up with changes to employment AI rules and cases.

Get an email when we add important regulation or litigation, or when a tracked matter materially changes.

Not legal advice

This page is regulatory intelligence only. Organizations should seek guidance from legal counsel before making compliance decisions.

Employment-focused extraction

This may be part of wider regulation. The Warden Watch extracts and displays the parts relevant to employment, HR and recruitment decision-making.

HR and recruitment teams

HR technology vendors

Restriction on Solely Automated Decision-Making

Human Oversight and Decision Contestability Safeguards

Automated Decision-Making Notice and Logic Disclosure

Data Subject Access to Profiling and Decision Logic

Data Protection Impact Assessment for Automated Evaluation

Algorithmic Tool Procurement Due Diligence

Provider Technical Documentation and Support

Keep up with changes to employment AI rules and cases.

Manage Consent Preferences