Spanish Data Protection Agency issues warning to company over AI-driven resume screening

What happened

On 23 September 2026 the AEPD sent a formal warning to a company planning to use an AI tool for analysing CVs and assigning scores. The agency stresses that data protection must be built in from the start, including DPIA for high‑risk processing, transparency to candidates, and effective human oversight. The warning cites GDPR provisions on automated decision‑making and the right to not be subject to solely automated decisions.

Why it matters for trust and compliance

• Its status is published. It is enacted but may not be in force yet. Check the effective date before planning around it.
• The AEPD’s warning highlights GDPR compliance requirements for AI use in recruitment, emphasizing transparency, human control, and risk assessment.

Who is affected

Recommended actions

1. Check that privacy notices describe the practices this addresses.
2. Revisit retention schedules and data minimisation for the data involved.
3. Inventory AI or automated decision systems in scope and their assessments.