Lumo360  /  ICO AI recruitment questions

UK compliance guide

The ICO's six questions for AI recruitment tools, answered in plain English.

After auditing AI recruitment tools, the UK Information Commissioner's Office published six questions organisations should ask before buying one. Here's what each means, what a good answer looks like, and how Lumo360 answers it.

Book a demo Go to the questions

Background

Why the ICO is asking

In November 2024 the ICO published the results of audits of AI tools used in sourcing, screening and selection. It made almost 300 recommendations to the developers and providers it audited1, and summarised its expectations in seven recommendations for providers and recruiters2.

Some findings were encouraging: many providers monitored their tools for accuracy and bias. Others weren't: some tools inferred characteristics such as gender or ethnicity from a candidate's name, and some collected more personal information than they needed1.

Alongside the report, the ICO set out six questions to ask before procuring an AI recruitment tool3. They're a good checklist for any vendor conversation, including one with us.

The six questions

What to ask, and what a good answer looks like

The ICO's questions are quoted as published. The explanations are ours; they aren't legal advice.

Question 1

Have you completed a DPIA?

A data protection impact assessment identifies the risks of a new kind of processing and how you'll reduce them. The ICO expects it early, before processing starts, and updated as the tool or your use of it changes.

A good vendor answer: the vendor gives you the information you need to complete your DPIA: what data it processes, where, for how long, and what safeguards apply.

Lumo360: We don't yet have a standard DPIA pack. Ask us and we'll tell you what data Lumo360 processes, where, and for how long, so you can complete your own assessment.

Question 2

What is your lawful basis for processing personal information?

You need a lawful basis under UK GDPR for using candidates' information, and an extra condition if any special category data is involved. Both should be documented and appear in your privacy notice.

A good vendor answer: the vendor is clear about what data the tool needs, and whether it processes or infers any special category data, so you can choose and document your basis.

Lumo360: Lumo360 assesses candidates against job-related competencies from your job description. Lumo360 does not collect or infer special category data, such as ethnicity or health, from interviews.

Question 3

Have you documented responsibilities and set clear processing instructions?

You need to know who is the controller and who is the processor for each part of the processing, with a contract that says so, and written instructions the provider follows.

A good vendor answer: a data processing agreement that sets out roles, instructions, sub-processors and what happens to data at the end of the contract.

Lumo360: We don't yet publish a standard data processing agreement. Ask us about roles, instructions and sub-processors before you sign, and get the answer in writing.

Question 4

Have you checked the provider has mitigated bias?

AI can repeat or amplify bias. The ICO expects providers and recruiters to monitor for fairness, accuracy and bias, and to act on what they find.

A good vendor answer: a clear explanation of how candidates are assessed, what the tool does and doesn't consider, and how bias is tested and monitored over time.

Lumo360: Every candidate for a role is assessed against the same structured competency framework and rubric, every score links to the evidence in the transcript, and a recruiter reviews every result before anyone moves forward. We don't yet run a formal bias-testing programme, so these structural safeguards are what we rely on today. Ask us for the latest position.

Question 5

Is the AI tool being used transparently?

Candidates should be told that AI is used, how it's used and how it affects them, and how to challenge a decision. The ICO points to its guidance on explaining decisions made with AI.

A good vendor answer: you can see and explain how any individual result was reached, in terms a candidate would understand.

Lumo360: This is what Lumo360 is built around. The full transcript is kept, the reason for each question is visible, and every score links to the moments in the conversation that support it, so you can explain any result to a candidate.

Question 6

How will you limit unnecessary processing?

Collect only what you need for the purpose, don't reuse it for something else, and don't keep it longer than necessary.

A good vendor answer: a short, specific list of the data collected, a retention period you can configure, and a commitment not to use your candidates' data for unrelated purposes.

Lumo360: Candidate data is kept for a fixed retention period, and it is not used to train models. Ask us for the data we collect and the current retention period.

Human oversight

Why a person should make the call

The ICO's recommendations come back repeatedly to fairness and explanation. The simplest safeguard is also the most effective: AI runs and scores the first round, and a person reviews the evidence and decides.

In Lumo360, nobody moves forward or is rejected without a recruiter reviewing their result.

How Lumo360 works

From job description to shortlist

Step 01

Start with the role

Upload the job description. Lumo360 identifies the competencies that matter and turns them into a structured interview framework. You review and adjust it before going live.

Step 02

Candidates have a real conversation

Candidates join when it suits them. The interviewer follows the framework, asks relevant questions and follows up based on each answer.

Step 03

You review the evidence

See how each candidate performed against every competency, with each score linked to the conversation. Your team decides who moves forward.

FAQ

Common questions

Is it legal to use AI in recruitment in the UK?

Yes, but data protection law applies. The ICO expects organisations to process candidates' information lawfully, fairly and transparently, to complete a DPIA, and to check that the tool's provider has mitigated bias. This page summarises the ICO's guidance and isn't legal advice.

What did the ICO find in its audit of AI recruitment tools?

Some providers monitored accuracy and bias well. Others inferred characteristics such as gender or ethnicity from candidates' names, or collected more personal information than they needed. The ICO made almost 300 recommendations to the providers it audited.

Do I need a DPIA for an AI recruitment tool?

The ICO expects a DPIA to be completed before processing starts, and updated as the tool or the processing changes.

What questions should I ask an AI recruitment vendor?

The ICO's six: have you completed a DPIA; what is your lawful basis; have you documented responsibilities and set clear instructions; has the provider mitigated bias; is the tool used transparently; and how will you limit unnecessary processing.

How does Lumo360 support transparency?

Every score links to the transcript moments that support it, the reason for each question is visible, and a recruiter reviews every result, so any outcome can be explained to the candidate.

Give candidates a conversation.
Give your team the evidence.

See a Lumo360 interview and the report it produces, using one of your own job descriptions.

Book a demo

Sources

  1. Tech Monitor, "ICO publishes 296 recommendations for AI recruitment software providers", November 2024.
  2. A&O Shearman, "UK ICO makes recommendations on AI in recruitment", November 2024.
  3. ICO, "Thinking of using AI to assist recruitment? Our key data protection considerations", November 2024. See also the ICO's AI tools in recruitment audit outcomes report.