This is an illustrative model driven entirely by the figures you enter — not a regulatory assessment, and it invents no statistics. Every case named below is real and sits on the ICO's public enforcement register. The model rests on the law that already applies to UK recruitment agencies using automated tools:
Regulatory & remediation. Article 35 UK GDPR requires a Data Protection Impact Assessment before high-risk processing — and automated screening of candidate data at volume is very likely to qualify. The ICO is enforcing this now: Reddit was fined £14,472,500 in February 2026 partly for an Article 35 failure, alongside MediaLab (£247,590) the same month. And in July 2024, a UK school was reprimanded under Article 35(1) for introducing facial-recognition cashless catering without a DPIA — if a school's dinner-hall scanner is in scope, so is AI screening across thousands of candidates. This figure estimates the cost of doing reactively, under pressure, what should have been done up front: a defined block of specialist remediation work plus a DPIA, scaled by your AI use and missing safeguards. The ICO's maximum penalty is £17.5m or 4% of turnover.
Client & PSL loss risk. Large employers increasingly run data-protection due diligence on suppliers — DPAs and audit clauses written into PSL frameworks. This estimates the expected value of losing one key contract if a client's audit surfaced an unaddressed gap: contract value × an estimated probability, capped at 30% so the model never overstates.
Complaint & SAR handling. Under Article 15 UK GDPR, any rejected candidate can request all data held about them — including an AI-generated score or ranking — within a statutory one-month deadline; Article 22 gives them the right to contest a solely-automated decision and obtain human review. The ICO pursues subject-access failures relentlessly — multiple recent enforcement actions across police forces, councils and NHS trusts, including the personal prosecution of a company director for refusing one. Since the Data (Use and Access) Act 2025 complaints process came into force on 19 June 2026, a formal handling route is also mandatory. This figure estimates the staff time that volume consumes when no process exists.
We'd rather show our working than impress you with numbers we can't stand behind. Every coefficient above is a stated assumption you can see and challenge — and every case is one you can look up.