What's allowed in AI sourcing on LinkedIn under UK GDPR
What's allowed in AI sourcing on LinkedIn under UK GDPR? Learn what you can and can't do, including lawful basis, Article 14 and practical guidelines.
Storing or analysing LinkedIn profiles with AI immediately triggers GDPR obligations such as a legal basis and transparency. It's essential to carry out a balancing of interests and maintain human oversight over automated processes.
With AI sourcing under UK GDPR on LinkedIn, you can view profiles without any problem. As soon as you store, analyse or enrich data with AI, you're processing personal data, and UK GDPR rules apply. You then need a clear purpose, a lawful basis and transparency towards candidates. This determines what's allowed in practice and what isn't.
In this article, you'll learn how to recognise this boundary and how to apply AI sourcing safely in your day-to-day work.
- Looking at LinkedIn is usually allowed, but storing and analysing fall under UK GDPR.
- The fact that profiles are public doesn't mean you can use the data freely.
- Legitimate interest is often the lawful basis in recruitment, but this requires a careful assessment.
- AI and automation increase the privacy risk and require extra checks.
- Transparency and a human review remain necessary at all times.
Why AI sourcing under UK GDPR is different from normal LinkedIn use
Many recruiters think that public profiles are free to use under UK GDPR. That's not correct. The fact that a profile is visible means you're allowed to view it, but not that you can simply store the data or combine it with other data. This distinction is crucial for AI sourcing on LinkedIn under UK GDPR.
When you only search and read within LinkedIn, there's still little at stake. However, as soon as you copy information into an ATS, make notes, or use an external tool, the process of processing LinkedIn profiles begins. That moment determines your legal obligations.
AI massively speeds up this process. You gather more data faster and spot connections you wouldn't see manually. As a result, the line between simply looking and actually processing data shifts faster than many recruiters expect.
The three phases of AI sourcing under UK GDPR, and what they mean
Phase 1: Looking within LinkedIn
You view profiles and run searches, but you don't store anything outside the platform. In this phase, there's usually no data processing in your own systems. The risk stays low as long as you don't record anything.
Phase 2: Storing or making notes
As soon as you add candidates to a system or make notes, you're processing LinkedIn profiles. For this, you need a clear purpose, such as filling a specific vacancy. You also need a lawful basis, which in recruitment is often based on legitimate interest.
You need to carefully weigh whether your business interest outweighs the candidate's privacy. That's why you record why you're storing someone, how long you keep that data, and who has access to it. This forms the core of privacy-friendly candidate sourcing.
Phase 3: Enriching and automating
When you use AI to analyse profiles or combine them with other sources, this falls under AI sourcing under UK GDPR. This can lead to profiling, which increases the risk, especially when systems automatically rank candidates.
In some situations, a DPIA (Data Protection Impact Assessment) is mandatory for AI recruitment. This lets you examine the impact on privacy in advance. Scraping LinkedIn also falls into this phase under UK GDPR. This carries extra risks, because you're collecting large volumes of data without clear control.
Want to better understand which phase of the process you're in? Take a look at how the process works step by step and at exactly what point the data processing takes place.
What AI sourcing under UK GDPR means for lawful basis and transparency
The most commonly used lawful basis in recruitment is legitimate interest. After all, you have a business interest in finding suitable candidates. This is allowed, provided you handle personal data carefully and keep the impact on privacy limited. Think of targeted searches and only storing relevant information.
Sometimes, however, explicit consent is needed. This mainly applies when you use sensitive data or keep profiles for a long time without a concrete, direct purpose.
In addition, Article 14 of UK GDPR is crucial within recruitment when you collect data indirectly, such as via LinkedIn. You're required to inform candidates about exactly what you do with their data. This usually happens during the first point of contact.
AI recruitment under UK GDPR also requires a transparent explanation. If you use artificial intelligence to support decisions, you need to be able to explain how the technology works. For good compliance in AI recruitment, it's also a requirement that a human always reviews the case before a candidate is actually approached.
Tip: Elvatix gets more out of every InMail credit. Higher response rates, lower cost per contact.
See how →Common situations in AI sourcing under UK GDPR: risks and alternatives
Using scraping tools
The big risk here is that you collect a lot of data without a clear, defined purpose. This quickly clashes with UK GDPR rules around scraping LinkedIn, as well as with the platform's own terms. A safer alternative is manual, targeted searching, after which you only store relevant candidates.
Using AI during sourcing
The risk here is that you input personal data into external tools without control. So use AI purely as support, and avoid sharing privacy-sensitive information in your prompts.
Exporting profiles to an ATS or Excel
This often results in overly broad access to data and unclear retention periods. Limit who can view the data, and set clear rules for storing and promptly deleting profiles.
Automatic selection by AI
When AI decides, you risk losing insight into the choices made. Make sure a recruiter always does the final review, and that the tool only acts in an advisory capacity.
Enriching data with external sources
This creates the risk of processing unreliable or irrelevant data. Always check the source, and only use the information that's actually needed for your sourcing goal.
How to apply AI sourcing under UK GDPR in a safe workflow
Always start with a clearly formulated purpose per vacancy. Without a concrete purpose, you simply can't store data. This prevents unnecessary data processing and helps you account for your actions to your Data Protection Officer (DPO) or legal department.
Also limit the amount of data you keep. Only record the information that's strictly necessary. Set fixed retention periods and remove candidates from the system as soon as they're no longer relevant to the process.
Ensure transparency at all times. Inform candidates promptly and clearly explain why you're processing their data. This ties in directly with the duty to inform under Article 14 of UK GDPR within recruitment.
Finally, always work with human review. AI can support the process, but the recruiter makes the final decision. Find out in how this works in practice with review how such a process stays scalable without you losing control over the data.
For agencies handling high volumes, a solid structure is extra important. Read on how staffing agencies handle this how efficiency and careful handling of personal data come together successfully.
Tools and processes for AI sourcing under UK GDPR within LinkedIn
The choice of specific tooling largely determines the data flows within your organisation. Solutions that stay entirely within the LinkedIn environment offer considerably more control than standalone scraping tools. This reduces privacy risks and helps you keep a better overview.
Check on how this keeps working within LinkedIn how smart integrations help keep processes manageable, without you having to move data around unnecessarily.
Also make sure to record clearly who carries out which actions. Careful logging and clear working steps make your sourcing process auditable. Avoid entering sensitive personal data into external AI tools; after all, everything you enter becomes part of the data processing.
Checklist for AI sourcing under UK GDPR: talking to your DPO or legal team
- What is the purpose of the processing?
Describe very specifically why you're storing and using certain candidate data. - Which lawful basis are you using?
Explain how you're relying on legitimate interest within recruitment, and thoroughly justify this assessment. - How long do you keep the data?
Work with fixed retention periods and ensure automatic clean-up of your systems. - How do you inform candidates?
Make sure clear communication properly meets the requirements of Article 14 of UK GDPR. - Do you work with external parties?
Check the data processing agreements, the security measures and the overall data processing. - Is there human review?
Be able to demonstrably show that AI only supports the process and never makes decisions on its own.
Frequently asked questions about AI sourcing under UK GDPR
Can you store LinkedIn profiles without consent?
Yes, that's possible, provided you have a legitimate interest and handle the data with the utmost care. You do need to be able to justify why you're doing this and inform the candidates concerned.
When is a DPIA needed for AI sourcing?
A DPIA is necessary when the processing carries a high privacy risk, for example in the case of large-scale profiling or fully automated assessments.
Is scraping LinkedIn allowed?
This carries significant risks. It can easily conflict with UK GDPR and with LinkedIn's specific platform rules. Manual, targeted sourcing is always a much safer alternative.
Can AI select candidates automatically?
That's highly risky. There always needs to be a human review to critically check the proposed decisions.
Want to know how your process measures up against these guidelines? Then get in touch and discuss your situation with us to gain insight into what works practically within your organisation.
Write a personal message right here
Enter a name or LinkedIn URL and get a personalised message within 30 seconds. No account needed.
Make your AI sourcing fully GDPR-proof?
Elvatix offers features for transparent data processing and human oversight of AI analyses. This keeps you in control of privacy while efficiently finding the right candidates.
