For recruitment, GDPR means having a lawful basis for processing applicant data, telling candidates in a privacy notice what is collected and why, keeping data secure and holding it only as long as needed. Candidates can request a copy of their data, ask for corrections or deletion, and object in some cases. The UK kept its own version after Brexit, the UK GDPR, alongside the Data Protection Act 2018.
Article 22 restricts decisions based solely on automated processing that have legal or similarly significant effects, which can include hiring outcomes, and the UK has been updating its rules in this area. Keeping meaningful human review of every decision, explaining how tools are used and being able to show how a score was reached all help. The requirements are detailed and evolving, so legal advice is sensible for specific cases.