Social Media Screening and UK GDPR: What Employers Can Legally Check

Jurisdiction: This article covers UK data protection law, including the UK GDPR, the Data Protection Act 2018, and ICO guidance. Equality Act 2010 references apply in England, Wales, and Scotland.

This article is for informational purposes only and does not constitute legal advice. Employment law and screening regulations vary by jurisdiction. Consult a qualified legal professional before making compliance decisions.

A candidate's public social media profile is easy to find, which makes it tempting to check. Under UK law, though, easy to find does not mean fair to use. The Information Commissioner's Office (ICO) treats social media checks as a form of pre-employment vetting, with clear expectations on when they are justified and how they should be run.

Done well, social media screening can help employers in roles where public conduct genuinely matters. Done casually, it collects information employers do not need and should not weigh.

What is social media screening?

Social media screening is the review of a candidate's publicly available social media activity as part of recruitment. The aim is to identify conduct relevant to the role, such as public behaviour that would conflict with the responsibilities of the job.

Screening usually takes one of three forms:

Manual checks: a staff member reviews public profiles against defined criteria

Third-party checks: a screening provider reviews public content and reports findings

Automated tools: software scans and categorises public content, sometimes using AI

All three are processing of personal data, so UK GDPR applies to each of them.

What does UK GDPR say about screening candidates' social media?

UK GDPR allows social media screening only where it is necessary for an identified, role-specific risk, transparent to candidates, and limited to public information relevant to the job. The ICO's draft recruitment and selection guidance sets out what that means in practice.

Justify it by role, not by default

The ICO expects employers to identify and document a specific risk before checking social media. Vetting of any kind should not be applied routinely to every candidate unless the law requires it. A care home checking carers for conduct that would make them unsuitable to support vulnerable people is the ICO's own example of a justified purpose.

Choose a lawful basis and assess it

Employers often rely on legitimate interests for social media checks, as in the ICO's own example of a charity screening candidates for a public-facing role. That basis requires a legitimate interests assessment weighing the employer's purpose against the impact on the candidate. One assessment can cover a group of candidates where the reasons and information are the same.

Tell candidates first

Candidates must be told if social media will be checked. The ICO expects employers to explain what will be checked, why, who will see it, and how long it will be kept.

Keep it public and proportionate

The ICO says intrusive or targeted checks are unlikely to be lawful, appropriate, or necessary. An example is using specialist software to access information that is not publicly available.

Retain as little as possible, for as short a time as possible

Information gathered through vetting should be destroyed securely as soon as reasonably practicable once the recruitment decision is made. Employers can keep a record of the outcome and the decision.

What does ICO guidance say about candidate data and AI-assisted screening?

ICO guidance expects AI-assisted screening to be fair, transparent, and limited to necessary data, with meaningful human involvement in decisions. The same expectations apply directly to automated social media tools.

Lessons from the ICO's AI audits

In November 2024, the ICO published the outcomes of audits of AI recruitment tool providers. Its findings are especially relevant to social media scanning:

Some tools inferred characteristics such as gender and ethnicity from names rather than collecting them directly

Some collected far more personal information than necessary

Some retained information indefinitely to build databases of potential candidates without their knowledge

The ICO's recommendations focused on fair processing, data minimisation, monitoring for discrimination, and clear privacy information, including retention periods.

Automated decisions need safeguards

Under Article 22A of the UK GDPR, solely automated decisions with significant effects, such as rejecting a candidate, need safeguards. The required safeguards include the ability to obtain human intervention and to contest the decision. In practice, an automated social media report should inform a person's review, never decide on its own.

Accuracy and the candidate's right to respond

Information found online may be inaccurate or out of context. The ICO expects employers to give candidates a chance to explain or challenge anything they intend to rely on, and to make decisions on factual evidence rather than assumptions.

Where does the discrimination risk sit in social media screening?

The discrimination risk sits in what a reviewer sees. Social media often reveals protected characteristics, such as religion, sexual orientation, pregnancy, or disability, which have no place in a hiring decision.

Under section 39 of the Equality Act 2010, an employer must not discriminate in the arrangements it makes for deciding who to offer employment. A screening process that exposes decision-makers to protected characteristics makes it harder to show that a decision rested on job-related grounds.

The "made public" trap

UK GDPR allows special category data that a person has manifestly made public to be processed in some circumstances. The ICO is clear that this does not make it fair to use in recruitment. Its example is a candidate who blogs about living with a disability to raise awareness. The information is public, yet using it to judge suitability for a marketing role would be unfair.

Separating screening from decision-making

The ICO's practical safeguard is a firewall:

One trained person carries out the social media check

That person screens findings against defined, job-related criteria

Only relevant information passes to the people making the decision

The person doing the check does not also make the recruitment decision

That structure keeps irrelevant personal information away from the hiring decision, and reflects the wider shift described in the future of hiring compliance.

How do you build a defensible, compliant screening process?

Build a defensible process by deciding which roles justify social media checks, documenting why, telling candidates in advance, and separating screening from decisions. Then keep only what you need for as long as you need it.

Here is how a casual approach and a defensible approach compare directly.

In summary, a defensible process is narrower, more transparent, and better documented, which makes it fairer to candidates and easier to justify.

A six-step process

Identify the roles where public conduct is genuinely relevant, and record why.

Complete a legitimate interests assessment, and a data protection impact assessment where the processing is high risk.

Tell candidates in the application process what will be checked and when.

Assign a trained reviewer who is separate from the decision-makers.

Give candidates the chance to respond to anything you plan to rely on.

Record the outcome and destroy the underlying findings securely.

Fitting social media checks into wider screening

For most roles, other checks matter more than social media. Identity, employment history, qualifications, criminal records where the role justifies them, and the Right to Work check carry more weight for most roles. TRACE, TraqCheck's AI background verification agent, runs identity, employment, education, and criminal record checks in one consent-to-report workflow, with a human verification specialist reviewing every result. TRACE is GDPR-ready and keeps a full audit trail for every check.

Where your policy also includes social media checks for specific roles, keeping them within the same documented, role-based framework supports consistent compliance and regulatory screening for compliance and risk teams.

Getting social media screening right

Social media screening can be lawful and useful in the right roles, provided it is justified, transparent, limited to relevant public content, and separated from decision-making. For many roles, verified identity, employment history, and qualifications tell employers far more. To see how TRACE runs human-reviewed background checks within a documented, audit-ready process, book a demo.

Frequently asked questions

Is social media screening legal in the UK?

Yes, where it is justified. UK GDPR and ICO guidance allow employers to check public social media profiles when there is a documented, role-specific reason, candidates are told in advance, and the checks are proportionate.

Do employers have to tell candidates about social media checks?

Yes. The ICO expects employers to inform candidates if social media will be checked, including what will be checked, why, who will see it, and how long it will be kept.

Can employers look at private social media accounts?

The ICO says intrusive or targeted checks are unlikely to be lawful, appropriate, or necessary. Its example is using specialist software to access information that is not publicly available.

What is the UK GDPR requirement for storing candidate background check data?

Employers must keep it only as long as necessary and store it securely. The ICO's draft guidance expects vetting information, including social media findings, to be destroyed as soon as reasonably practicable after the decision. A record of the outcome can be kept.

What is the ICO's position on using AI to process candidate background check data?

The ICO supports AI when it is lawful, fair, and transparent, with data kept to a minimum and meaningful human involvement in decisions. Its audits found some tools inferred characteristics from names and retained data indefinitely, which it asked providers to change.

Who should carry out social media checks?

A trained reviewer who is not involved in the hiring decision. The ICO recommends that this person screens findings for relevance and passes only job-related information to the decision-makers.