Manual search or social media screening software?
Decide whether the role justifies a check before choosing how to run it. The rules are the same either way: the ICO's draft guidance expects a specific, documented risk, notice to candidates, a researcher who does not make the hiring decision, and destruction of the raw results as soon as reasonably practicable. You remain accountable for any service you use.
The routes differ in where the work and the risk sit. In our view, a manual search by a trained person following a written method is close to the ICO's own care home example and keeps the data small, but depends on that person's records. A specialist service can bring consistency and an audit trail, but adds a processor contract, questions about which sources it reaches, and the automated decision rules if its scores or flags decide outcomes without meaningful human involvement.
What does not change
Our main social media screening page sets out the rules from the ICO's draft vetting guidance, and none depends on who does the searching. Using a service does not move responsibility either. The ICO says an employer will typically be a controller, because it decides what candidate information to collect and what to use it for, and is ultimately accountable for the data protection compliance of any processor it engages.
The two routes side by side
| Factor | Manual documented search | Specialist service |
|---|---|---|
| Evidence and records | Only as good as the reviewer's written record | Depends on what the service logs and lets you export |
| Consistency | Needs a written method and training for each reviewer | Applies the same method each time, including its errors |
| Accuracy | Reviewer judges context; can miss or misread | Matching and flags can be wrong at scale |
| Data minimisation | Reviewer can stop at what is relevant | Ask which sources it searches and what it keeps |
| Automated decisions | Not engaged if a person decides | Articles 22A to 22D apply to any solely automated significant decision |
| Contract | None needed for your own staff | Article 28 processor contract |
| DPIA | Consider one; required if high risk | Required if it scores, profiles or makes automated decisions |
| Cost and time | Reviewer time, training and supervision | Fees, plus contract, due diligence and DPIA work |
Evidence chain and record keeping
Either way you need to show what was checked, when, by whom and what reached the decision maker. Where findings do not match what a candidate told you, the ICO says you should keep records of your decisions, and you could keep a record of the outcome and your decision after destroying the vetting information itself.
For a manual search, our view is that the record should name the sources searched, the date, the reviewer, the criteria and exactly what was passed to the panel. For a service, ask to see the same record for a test candidate; our software evaluation guide covers audit trails.
Consistency and accuracy
Acas warns that you might be breaking the law if you look at some applicants' social media profiles but not others. A manual route needs a written method applied to every candidate at the same stage, and the ICO says staff involved in vetting should be trained on the correct process. Our view: a service applies one method each time, but repeats the same mistake each time too.
The ICO warns that information found online may not be accurate and that a decision based on it alone is unlikely to be fair and lawful. For automated recruitment tools it says there is always likely to be a margin of error. Our guide to false positives covers handling a wrong match.
Privacy and data minimisation
The ICO's draft guidance is explicit: "It's unlikely to be lawful, appropriate or necessary to conduct intrusive or targeted checks of candidates on social media or online (eg by using specialist software to check information that is not publicly available)." So ask any service which sources it searches and how it confirms they are public.
You must collect only the minimum information you need. A reviewer can stop once the criteria are answered; a service may collect far more. Ask what it gathers, what it passes to you, how long it keeps it and whether it uses candidate data for its own purposes. Article 28 says a processor that infringes the UK GDPR by determining the purposes and means of processing is considered a controller for that processing.
Automated decision-making rules
Articles 22A to 22D of the UK GDPR replaced the old Article 22 and have been fully in force since 5 February 2026; our software evaluation guide explains the definitions. The ICO's draft guidance, updated on 31 March 2026, gives e-recruiting practices without meaningful human involvement as an example of a similarly significant effect.
Article 22B restricts two kinds of solely automated significant decision. One based entirely or partly on special category data is allowed only with the person's explicit consent, or where it is necessary for a contract or required or authorised by law and a substantial public interest condition applies. Social media profiles often reveal exactly this kind of data. And no such decision may rely on the recognised legitimate interests lawful basis. Where such a decision is lawful, the Article 22C safeguards apply.
The ICO's draft guidance says that for meaningful involvement a person should, among other things, review the decision before it is applied, have the authority and discretion to change it, be trained to understand the system's outputs and limitations, and take into account the data and factors behind it, every time: ad hoc spot-checking is not enough. Our view: never let a service's flag or score reject a candidate on its own.
Processor contract and DPIA
If a service processes candidate data on your behalf, Article 28 requires a written contract setting out the subject matter, duration, nature and purpose of the processing, the types of data and the categories of people, with the terms our software evaluation guide lists.
The ICO's draft recruitment guidance, under review since the 2025 Act, says you must do a DPIA if you plan to use solely or partly automated decision-making and profiling for recruitment, because both are high risk, and that you must understand the data protection implications of software even if you did not develop it. Its recruitment guidance lists collecting information from sources other than the candidate without giving them privacy information among the processing that may need a DPIA. Whichever route you use, the ICO says you should do a DPIA for any new recruitment project involving personal information, even without a specific indication of high risk.
Cost, time and choosing
We do not quote prices or timings. In our view a manual route, which costs reviewer time, training and supervision, suits occasional checks for a few roles. A service costs fees plus contract, due diligence and DPIA work, and may suit employers who check regularly at volume. Either way, justifying the check in writing comes first.
HRjoy works with screening partners and can introduce employers to them. The same rules apply whichever route you choose.
Sources
- Pre-employment vetting of candidates · ICO
- Responsibility for data protection compliance during the recruitment process · ICO
- Data protection and recruitment · ICO
- Automated decision-making and profiling for recruitment and selection · ICO
- What does the UK GDPR say about ADM? · ICO
- What are the ADM safeguards? · ICO
- What needs to be included in the contract? · ICO
- UK GDPR Article 22A: Automated processing and significant decisions · legislation.gov.uk
- UK GDPR Article 22B: Restrictions on automated decision-making · legislation.gov.uk
- UK GDPR Article 22C: Safeguards for automated decision-making · legislation.gov.uk
- UK GDPR Article 22D: Further provision about automated decision-making · legislation.gov.uk
- UK GDPR Article 28: Processor · legislation.gov.uk
- Choosing who to interview · Acas
General information for employers in the UK, not legal advice. HRjoy advises on screening policy and fair process. We do not run checks ourselves; where you need checks run, we can introduce you to our screening partners. Check the official sources for your situation.
Questions
Something else? Ask us.
Is it lawful to use a social media screening service?
No rule bans it, but the same tests apply as for a manual search: a documented risk, notice to candidates, public information only, and destruction of the results. Ask any service how it confirms its sources are public.
Can a service's risk score reject a candidate?
Only within Articles 22A to 22D. A rejection without meaningful human involvement is a solely automated significant decision, restricted where special category data is involved and subject to the Article 22C safeguards. Our view: have a trained person review every adverse flag before it affects anyone.
Who should do a manual search?
Someone trained in your written method who is not making the hiring decision. The ICO says the staff who research a candidate's social media should not also make recruitment decisions about them, and that staff involved in vetting should be trained on the correct process.
Related checks
- Social media checks on job candidates When a UK employer can review a candidate's public social media, what to tell them, who should look, and what to do with what you find.
- Adverse media checks on job candidates When a UK employer can search the press and online sources for negative coverage of a candidate, and how to handle namesakes and allegations.
Guides
- Choosing background screening software: an evaluation framework for UK employers Criteria for UK employers assessing background screening software: statutory check routes, processor contracts, data handling and automated decisions.
- False positives in online background checks: name matching and context How UK employers avoid acting on the wrong person or a misread post in online checks: namesakes, old posts, fake accounts, tags and context.
- What a good social media screening report looks like A fictional, annotated social media screening report for a care worker role, showing what a UK employer should record at each step and why.
- Employee monitoring vs candidate social media checks Why checking a candidate's public social media and monitoring an employee's are different legal activities, compared side by side for UK employers.
Related answers
- What should employers consider when using AI in recruitment? Employers remain responsible under data protection and equality law when they use AI to source, screen or score candidates. The ICO expects a data protection impact assessment, a lawful basis, clear contracts with the provider, checks for bias, transparency with candidates and minimal data collection. Employers should also plan reasonable adjustments for disabled applicants.
- How should employers handle an employee subject access request? Employers should recognise the request, which can be made verbally or in writing, confirm the person's identity if needed, make a reasonable and proportionate search and respond without undue delay and within one month. Complex requests can be extended by up to two months. A fee usually cannot be charged, and information about other people may need redacting.