Skip to content

Knowledge base · AI in HR

May software automatically reject applicants without a person looking at it?

In principle, no. An applicant has the right not to be subject to a decision based solely on automated processing that significantly affects them; the GDPR itself gives e-recruiting without human intervention as an example. It is allowed only under one of three exceptions, and then with at least human intervention, the opportunity to express a point of view and the right to contest the decision.

In force now (since 25 May 2018)Trusq editorial · checked against the official textLast verified:

Next step: Map your AI tool

The main rule

A data subject has the right not to be subject to a decision based solely on automated processing, including profiling, that produces legal effects or similarly significantly affects them [1]. The recitals of the GDPR give e-recruiting without human intervention as an example [2].

The exceptions

The prohibition does not apply if the decision is necessary for entering into or performing a contract, is authorised by law with suitable safeguards, or is based on explicit consent [3]. For a contract or consent you must provide at least human intervention, the right to express a point of view and the right to contest the decision [4]. Such decisions may not be based on special categories of personal data, except with explicit consent or for reasons of substantial public interest, with suitable measures [5].

The Dutch implementing act

The UAVG exempts automated decisions that are not based on profiling and are necessary to comply with a legal obligation or for a task in the public interest [6]. An organisation that is not an administrative authority has in any case taken suitable measures if it safeguards human intervention, the right to express a point of view and the right to contest the decision [7]. For the selection of applicants by a private employer, that exception will rarely fit.

What you do in practice

Have an employee who genuinely assesses the outcome and can deviate take every rejection. State in your information to applicants whether and how automated decision-making takes place [8].

Sources

  1. [1] GDPR Art. 22(1) (General Data Protection Regulation (GDPR), Regulation (EU) 2016/679). A data subject has the right not to be subject to a decision based solely on automated processing that produces legal effects or similarly significantly affects them.
    The data subject shall have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning him or her or similarly significantly affects him or her.
    Source, retrieved on 2 October 2026.
  2. [2] GDPR, recital 71 (General Data Protection Regulation (GDPR), Regulation (EU) 2016/679). The GDPR expressly mentions the processing of job applications online without human intervention as an example of such a decision.
    such as automatic refusal of an online credit application or e-recruiting practices without any human intervention.
    Source, retrieved on 2 October 2026.
  3. [3] GDPR Art. 22(2) (General Data Protection Regulation (GDPR), Regulation (EU) 2016/679). Solely automated decisions are allowed only if they are necessary for a contract, authorised by law with suitable safeguards, or based on explicit consent.
    Paragraph 1 shall not apply if the decision: (a) is necessary for entering into, or performance of, a contract between the data subject and a data controller; (b) is authorised by Union or Member State law to which the controller is subject and which also lays down suitable measures to safeguard the data subject's rights and freedoms and legitimate interests; or (c) is based on the data subject's explicit consent.
    Source, retrieved on 2 October 2026.
  4. [4] GDPR Art. 22(3) (General Data Protection Regulation (GDPR), Regulation (EU) 2016/679). For the exceptions for a contract or explicit consent, the employer must provide at least human intervention, the right to express a point of view and the right to contest the decision.
    In the cases referred to in points (a) and (c) of paragraph 2, the data controller shall implement suitable measures to safeguard the data subject's rights and freedoms and legitimate interests, at least the right to obtain human intervention on the part of the controller, to express his or her point of view and to contest the decision.
    Source, retrieved on 2 October 2026.
  5. [5] GDPR Art. 22(4) (General Data Protection Regulation (GDPR), Regulation (EU) 2016/679). Such decisions may not be based on special categories of personal data, unless explicit consent or a substantial public interest with suitable measures.
    Decisions referred to in paragraph 2 shall not be based on special categories of personal data referred to in Article 9(1), unless point (a) or (g) of Article 9(2) applies and suitable measures to safeguard the data subject's rights and freedoms and legitimate interests are in place.
    Source, retrieved on 2 October 2026.
  6. [6] UAVG Art. 40(1) and (3) (Dutch GDPR Implementation Act (UAVG); Dutch law, unofficial translation). Article 22(1) GDPR does not apply to automated decision-making that is not based on profiling and is necessary to comply with a legal obligation or for a task in the public interest; a controller that is not an administrative authority then safeguards at least human intervention, the right to express a point of view and the right to contest the decision. Original Dutch text:
    Artikel 22, eerste lid, van de verordening geldt niet indien de in die bepaling bedoelde geautomatiseerde individuele besluitvorming, anders dan op basis van profilering, noodzakelijk is om te voldoen aan een wettelijke verplichting die op de verwerkingsverantwoordelijke rust of noodzakelijk is voor de vervulling van een taak van algemeen belang.
    Source, retrieved on 2 October 2026.
  7. [7] UAVG Art. 40(3) (Dutch GDPR Implementation Act (UAVG); Dutch law, unofficial translation). If the controller is not an administrative authority, suitable measures have in any case been taken if human intervention, the right to express a point of view and the right to contest the decision are safeguarded. Original Dutch text:
    Indien de verwerkingsverantwoordelijke geen bestuursorgaan is, dan zijn passende maatregelen als bedoeld in het tweede lid, in ieder geval getroffen indien het recht op menselijke tussenkomst, het recht voor betrokkene om zijn standpunt kenbaar te maken en het recht om het besluit aan te vechten, zijn geborgd.
    Source, retrieved on 2 October 2026.
  8. [8] GDPR Art. 13(2)(f) (General Data Protection Regulation (GDPR), Regulation (EU) 2016/679). When collecting data from the data subject, the controller states the existence of automated decision-making referred to in Article 22, with meaningful information about the logic involved, the significance and the envisaged consequences.
    the existence of automated decision-making, including profiling, referred to in Article 22(1) and (4) and, at least in those cases, meaningful information about the logic involved, as well as the significance and the envisaged consequences of such processing for the data subject.
    Source, retrieved on 2 October 2026.

Related questions

What do we have to tell applicants if we use AI to process their data?Can an applicant or employee demand an explanation of a decision taken with AI?Do we have to carry out a DPIA before we use AI in recruitment or personnel management?

Next step

Describe one AI tool, for example your recruitment or planning software, in four questions. You see at once which rules may apply, with the source, before you enter any data.

Map your AI tool

Looking for a specialist? We will look with you for a suitable specialist; mediation is not guaranteed.

This page gives general information based on the text of the law. It is not legal advice for your situation.