Recruitment agency admin: what's safe to automate under UK GDPR

The desk problem nobody puts on a commission statement

You bill on placements, not on admin. But the admin is where a huge share of the week actually goes, and right now it comes with a new complication: the Information Commissioner's Office published detailed guidance in late 2024 on AI tools used in recruitment, and UK GDPR's Article 22 gives candidates a right not to be shortlisted, ranked or rejected by a decision made solely by an automated system. That's not a reason to avoid AI on the desk. It's a reason to be precise about which parts of the admin load are safe to hand to it, and which parts need a person's eyes on them regardless of how good the tool gets.

That precision matters more for recruitment than almost any other sector we assess. In our benchmark data, UK recruitment desks carry among the highest weekly admin loads of any industry we measure - typically around 15 hours a week per consultant, close to two full working days. At a blended consultant rate of roughly £60 an hour, that's in the region of £41,400 a year in time that never shows up as billed work. It shows up as the deals a consultant didn't have the hours to close.

Where the hours actually go

Ask most desks where their time goes and they'll say "everywhere." When we sit down with a desk for the AI workflow assessment, the same four or five buckets come up on repeat:

• Candidate sourcing on LinkedIn. Searching, filtering, and writing genuinely personalised outreach - typically six to ten bespoke InMails a week on an active role, because generic templated messages get ignored by candidates who've seen a hundred of them.
• CRM data hygiene. Logging calls, moving candidates between stages, recording client feedback, tagging skills, attaching documents. Unglamorous, largely invisible, and the desk falls apart within a fortnight without it.
• CV formatting and rewriting. Every CV that lands is a Word document with broken formatting that needs reworking into house style, plus a personal statement that actually reads well - typically 15 to 25 minutes each, several times a week.
• Interview scheduling. Coordinating a client's diary, a candidate's availability and your own is typically 10 to 15 minutes of admin per interview, and it adds up fast on a busy desk running multiple roles at once.
• Reference and offer-stage chasing. The candidate's said yes. Now it's two references, a contract, a start date and a nervous candidate second-guessing their notice period - typically 90 minutes of chasing per placement, often more.

None of that is glamorous, but it's real cost, and it repeats every single week regardless of how many placements land.

What's safe to automate, and what genuinely isn't

This is where the regulatory pressure actually bites, and where a lot of generic "AI for recruitment" advice gets it wrong by treating every task on the desk as equally automatable, when it isn't.

Safe to hand to AI, with a person still sending or approving the output:

• Drafting personalised sourcing messages from a strong template plus real role and candidate detail, so volume goes up without the message reading like a mailshot.
• Reformatting and rewriting CVs into house style - a mechanical, low-risk task where the AI does the heavy lifting and a consultant does a quick review and edit.
• Drafting reference requests, offer-stage reminders and candidate or client follow-up messages from a prompt library, so the sending decision still sits with a person.
• Suggesting interview slots based on stated availability, with the final booking confirmed by a human.

Not safe to fully automate:

• Any CV screening, ranking or shortlisting tool that filters candidates out without a person reviewing the result. Under UK GDPR Article 22, candidates have a right not to be subject to a decision based solely on automated processing where it has a significant effect on them - and being screened out of a role clearly qualifies. The ICO's recruitment AI guidance is explicit that this kind of processing usually needs a Data Protection Impact Assessment before it goes anywhere near live candidates.
• Feeding candidate CVs, contact details or client information into consumer-grade AI tools that retain or train on the data you upload. That risks breaching both UK GDPR and the record-keeping duties recruitment businesses already carry under the Conduct of Employment Agencies and Employment Businesses Regulations 2003, which require agencies to verify candidate identity and qualifications and keep records for at least a year.
• Letting any tool make the actual placement decision. The judgement on fit, the reference check, the final "yes" - that stays human, both because clients expect it and because the regulation requires it.

The assessment exists specifically to draw that line for your desk - which of the six admin buckets above can genuinely be handed off, which need a human-in-the-loop step built in, and which UK GDPR and REC compliance expectations mean should stay exactly as they are.

One worked example: CV reformatting

Take the CV rewrite, since it's one of the lowest-risk, highest-frequency tasks on the desk and a good illustration of what "safe automation" actually looks like in practice.

Before: a CV arrives as a Word document with three different fonts, a table that's broken in transit, and a candidate summary that reads like a job description. A consultant spends 15 to 25 minutes stripping the formatting, rebuilding it in house style, and writing a personal statement from scratch - one CV at a time, several times a week, none of it billable.

After: the same CV goes through a reformat-and-rewrite workflow built around a house-style template and a clear prompt for the personal statement, drafted by AI from the candidate's own detail. The consultant's job shifts from writing to reviewing and editing - in our experience, desks that put this in place typically get the per-CV time down to a five-minute check rather than a full rewrite. No candidate data leaves an approved, business-account tool that doesn't train on what's uploaded, and every CV still gets a human read before it goes to a client.

AI does the mechanical part, the consultant keeps the judgement call, and the time saved is real because the task was genuinely repeatable to begin with.

Find your own number

Every desk's mix is different - a 360 consultant running high-volume contract roles loses time differently to a boutique exec-search desk doing five placements a month. The averages above are a useful starting point, not your answer.

If you want a rough steer first, our admin cost calculator for recruiters will give you a working estimate of what your desk's admin load is actually costing in consultant time, based on your own rates and headcount. For the fuller picture - which of the sourcing, CRM, CV, scheduling and offer-chasing buckets is costing your desk the most, and which of it is genuinely safe to hand to AI under UK GDPR - that's what the AI workflow assessment for recruiters is built to answer. It's a 60-minute session followed by a report built around how your desk actually bills, not a generic tool list.

Not ready for a paid diagnostic yet? The free AI readiness quiz takes a few minutes and gives you a first read on where to look. For more on how the 15-hours-a-week figure breaks down across the whole desk, see our piece on why UK recruiters lose 15 hours a week to admin.

Either way, don't try to automate everything. Find the two or three tasks on your desk that are safe, repetitive and costing you selling time, and fix those first.