The short answer
Automate the steps that only move information about a candidate: acknowledgements, document handling, chasing paperwork, offering interview times. Leave anything that scores or ranks applicants until last, because that step forms a view about a person, and in UK data protection law forming a view is a different activity from moving a file. The cheap work is also the low risk work, which is rarer than it sounds.
Key takeaways
- Order the work by what each step does to a person, not by the hours it returns. The two orders point in opposite directions.
- Moving information between systems is the boring half of a placement and the half a consultant loses most of the day to.
- The moment a tool evaluates applicants, the assessment duty sits with the agency as controller, before processing begins, and no supplier invoice discharges it.
- The record of processing activities already names which steps touch candidate data, so the sort is a reading exercise rather than an audit.
- A supplier will propose the screening first because it demos well. That is a reason to be careful, not a reason to buy.
A director of a twenty person recruitment agency asks a supplier what to automate and gets a demonstration of candidate scoring: upload two hundred CVs, watch a ranked list appear. It is a good demonstration. It is also the most expensive thing on the list to specify properly, and the one step in the whole placement that changes what the agency is obliged to do before it turns the thing on.
Meanwhile the consultants are still typing interview times into emails.
Sort the placement by what each step does to a person
Every step in a placement either moves information about a candidate or forms a view about one, and the two halves sit under different obligations and cost different amounts to build. Run the steps of one placement in order and draw the line where it actually falls. For most agencies it falls late, which is the useful part: almost everything before it is fair game.
Application arrives
Acknowledgement sent, record created, source recorded against the vacancy.
Moves information
Document handling
A CV or a certificate read into the fields your applicant tracking system expects.
Moves information
Chasing paperwork
Reminders for the missing right to work document, and for the certificate nobody uploaded.
Moves information
Scheduling
Interview slots offered against two calendars, and the reschedule handled when it comes.
Moves information
Keeping the client warm
Status updates on candidates already submitted, and the reminder nobody sends on a Friday.
Moves information
Screening and ranking
Applicants scored or ordered against criteria, so that some are seen and some are not.
Forms a view
Why the line falls where it does
Article 35 of the UK GDPR puts the duty to assess the impact on the controller, before processing begins, and the controller is the agency rather than the supplier. The Information Commissioner's Office sets out nine indicators of likely high risk and says a combination of two usually means an assessment is needed. A tool that evaluates people using a technology new to the agency has met two before anybody has written a line of configuration. What that assessment costs in partner time, and why it belongs in the budget rather than in the contingency, is set out against the rest of the run rate.
None of that applies to a reminder about a missing certificate. That is the whole argument for the order. The work that gives a consultant an hour back is sitting in the half of the placement where nobody has to write an assessment, and it is being skipped because it does not look like artificial intelligence.
You have already written down which steps touch candidate data
The record of processing activities required by Article 30 of the UK GDPR names the purposes, the categories of personal data and of data subjects, the recipients and the retention periods, which is most of the sort already done. Its exemption for organisations employing fewer than 250 persons falls away where the processing is not occasional, and placement work is not occasional by any reading, so a recruitment agency of this size is generally inside the requirement. Open it beside the track above rather than commissioning a fresh audit. Where the record and the working process disagree, the disagreement is the finding, and it is the same measurement discipline that decides whether a task is worth briefing at all.
Before you shortlist a supplier
Not sure which step is worth paying for?
Free to your agency. The supplier pays us, and only if the relationship works, which is why we would rather tell you the scheduling is a setting in the system you already license than introduce somebody to rebuild it.
Get a recommendationThe test to run on a step before you brief it
Four questions place any single step on one side of the line or the other, and a partner can answer them about one step in an afternoon. Run them on the step you were about to buy first.
Does the step change who gets seen?
If the output decides which candidates a consultant looks at, it is forming a view, whatever the supplier calls it.
A yes puts the step in the last group, and into the assessment.
Could a person check the output in seconds?
A parsed phone number is either right or wrong. A ranking is neither, and nobody will audit two hundred of them.
If errors are not visible, the step needs a review design before a build.
Is the data it reads already clean?
Count how many of your last fifty records carry the fields the rule depends on.
Below about four in five, fix the records first. This is the usual answer.
How many consultant minutes does one pass take?
Time it twice on different days rather than recalling it.
Under about two minutes a pass, the build will outlive the saving.
What crossing the line obliges the agency to do
Four things move from nice-to-have to required, and every one of them lands on the agency rather than on the supplier.
- The assessment happens before processing begins. Not at go-live, and not once the results look odd. It is a document, and it dates from before the data moved
- The data decision is made on paper. Article 25 requires appropriate measures at the time the means of processing are determined, and the means are determined when the specification is written, not when the build starts
- The supplier becomes a processor and the contract has to say so. Article 28 sets out what that contract must contain, and a service agreement that never uses the word is not it
- Somebody owns the output. Name the consultant who reviews what the tool rejected, and how often. A queue with no owner is how a filter becomes a decision
The pattern of which steps a rule will accept and which ones still need a person is the same one that applies in an accountancy practice, with one difference that matters here: the thing being sorted is a person who applied for a job.
When a recruitment agency should not automate anything yet
Two conditions make the whole exercise premature, and neither is about the supplier.
- The candidate records are not clean enough to trust. Automation applied to patchy data produces worse output faster, and the confidence it arrives with is the dangerous part
- The team is part way through changing its applicant tracking system. Build against the workflow that will still exist in a year rather than the one being retired
Saying so costs us the introduction fee, since we are paid by the supplier and only when a relationship works. When a supplier genuinely is needed, what we assess before recommending anyone, including the cases where we recommend nobody, is set out for professional services firms across the UK.
Frequently asked questions
What agency directors ask us before they commission anything.
What should a recruitment agency automate first?
The steps that only move information from one place to another: acknowledging an application, reading a document into the database, chasing a candidate for a missing certificate, offering interview times against a calendar. They consume the most consultant minutes and carry the least risk, and none of them requires anyone to form a view about a person.
Which recruitment tasks should be automated last?
Anything that scores or ranks applicants against criteria, because that step forms a view about a person rather than moving information about one. It is the step where the obligations change, and where a wrong answer is hardest to detect. Do it once the cheap work is running and you can see how clean your data really is.
Does automating candidate screening need a data protection impact assessment?
Often, and the duty is the agency's rather than the supplier's. Article 35 of the UK GDPR puts the assessment on the controller before processing begins. The Information Commissioner's Office lists nine indicators of likely high risk and says a combination of two usually means an assessment is needed. A tool that evaluates candidates using something new to the agency has met two.
How does a recruitment agency decide which steps touch personal data?
It usually already has the answer written down. Article 30 of the UK GDPR requires a record of processing activities naming purposes, categories of personal data and of data subjects, recipients and retention periods. The exemption for organisations employing fewer than 250 persons falls away where the processing is not occasional, which describes ordinary placement work.
When should a recruitment agency not automate anything yet?
When the candidate records are not clean enough to trust, because automation applied to bad data produces bad output faster and with more confidence. The other case is a team in the middle of changing its applicant tracking system. Automate the workflow that will still exist in a year rather than the one being replaced.
Sources and useful reading
- Information Commissioner's Office, when do we need to do a DPIA, for Article 35, the nine indicators of likely high risk, and the combination of two.
- Article 30, records of processing activities, for what the record must contain, and for the paragraph 5 exemption and what removes it.
- Article 25, data protection by design and by default, for the obligation attaching at the point the means of processing are determined.
- Article 28, processor, and the Information Commissioner's Office on what the contract must contain.
This article is commercial decision support and is not legal or regulatory advice. It makes no claim about discrimination law, which is a separate question about automated screening and one to put to your own advisers. Whether any given step in your process triggers an assessment is a judgement for the agency.