1. Purpose

Campbell Rochford recognises that artificial intelligence (“AI”) tools can support operational efficiency, communication quality, research capability and administrative effectiveness within executive search and recruitment activities.

This policy establishes the governance framework governing the responsible, lawful and proportionate use of AI-assisted technologies across the business.

The objectives of this policy are to:

protect candidate, client and company confidential information;
ensure compliance with applicable data protection legislation including the General Data Protection Regulation (“GDPR”);
maintain human oversight over recruitment activities and decision-making;
promote responsible and ethical use of AI-assisted technologies; and
ensure appropriate governance, accountability and risk management controls are in place.

2. Scope

This policy applies to:

all employees;
contractors;
consultants;
researchers; and
any third parties acting on behalf of Campbell Rochford.

The policy applies to all AI-assisted technologies used in connection with company business activities.

3. Approved Uses of AI

AI-assisted tools may be used for legitimate business support activities including:

drafting recruitment correspondence;
summarising interview notes;
formatting candidate profiles;
preparing market intelligence summaries;
refining job descriptions;
generating interview preparation materials;
administrative workflow support;
research assistance; and
internal productivity support.

AI tools are used solely as assistive technologies and not as substitutes for professional judgement.

4. Prohibited Uses

The following activities are strictly prohibited:

uploading passports, driving licences or identity documents;
uploading special category personal data unless expressly authorised and legally justified;
uploading medical information;
uploading financial account information;
uploading confidential client information beyond what is necessary for the specific task;
using AI tools to make automated hiring decisions;
discriminatory profiling or assessment of candidates;
entering unnecessary personally identifiable information into AI systems; and
using unapproved AI tools for company business.

5. Human Oversight

All recruitment decisions remain human-led.

AI-generated outputs must be reviewed by an appropriately authorised individual before being relied upon, shared externally or used in decision-making processes.

Campbell Rochford does not use AI systems to make solely automated decisions producing legal or similarly significant effects on individuals.

6. Data Minimisation & Redaction

Users must apply data minimisation principles at all times.

Where possible, users should remove or redact:

full names;
home addresses;
dates of birth;
personal contact details;
identification numbers;
references; and
other unnecessary identifying information.

Only the minimum information necessary for the relevant task should be processed.

7. Confidentiality

All users remain bound by existing confidentiality obligations, client agreements and professional standards.

Confidential client information must not be shared with AI tools unless:

the use is proportionate and necessary;
appropriate safeguards are in place; and
the tool has been approved in accordance with company governance procedures.

8. Vendor Assessment & Approval

AI vendors must undergo appropriate due diligence prior to approval, including assessment of:

data protection standards;
security controls;
retention policies;
international data transfer mechanisms;
confidentiality protections; and
contractual safeguards.

Only approved tools may be used for company business.

9. Security & Access Controls

Users must:

use strong authentication controls;
maintain device security;
avoid sharing company data through personal accounts; and
report suspected security incidents immediately.

10. Incident Reporting

Any suspected:

data breach;
accidental disclosure;
confidentiality issue; or
inappropriate AI usage

must be reported immediately to management for review and escalation where necessary.

11. Monitoring & Review

This policy will be reviewed periodically to reflect:

legal developments;
regulatory expectations;
operational changes; and
evolving AI technologies.

AI-Assisted Processing Privacy Notice

Campbell Rochford

Use of AI-Assisted Technologies

Campbell Rochford may use AI-assisted technologies to support certain administrative and operational recruitment activities.

These activities may include:

drafting communications;
summarising information;
formatting documents;
market research support;
workflow efficiency; and
administrative assistance.

AI-assisted technologies are used under human supervision and are not used to make automated hiring decisions.

Campbell Rochford applies data minimisation, confidentiality and access control measures designed to protect personal data where AI-assisted tools are used.

Where appropriate, information may be anonymised or redacted prior to processing.

Campbell Rochford does not use AI systems to make solely automated decisions producing legal or similarly significant effects on candidates or clients.

Lawful Basis for Processing

Campbell Rochford processes personal data in connection with recruitment and executive search activities on the basis of:

legitimate interests;
steps prior to entering into a contract;
compliance with legal obligations; and
other lawful bases where appropriate.

Campbell Rochford maintains safeguards to ensure that processing remains proportionate, necessary and balanced against the rights and freedoms of individuals.

Data Protection Rights

Individuals may have rights under applicable data protection legislation including rights to:

access personal data;
request correction of inaccurate data;
request erasure in certain circumstances;
object to certain processing activities; and
request restriction of processing.

Requests relating to personal data may be directed to Campbell Rochford using the contact details provided on this website.

Recruiter Guidance: AI Redaction & Data Minimisation Protocol

Campbell Rochford

Core Principle

If identifiable information is not required for the task, it should be removed before using AI-assisted tools.

Information to Remove Where Possible

Before using AI-assisted technologies, recruiters should remove or redact unnecessary:

full names;
dates of birth;
home addresses;
personal email addresses;
phone numbers;
PPS/NI numbers;
signatures;
references; and
other directly identifying information.

Information That Must Never Be Uploaded

The following must never be uploaded into AI tools unless expressly authorised and legally justified:

passports or identity documents;
medical information;
diversity or protected characteristic information;
disciplinary records;
bank or financial account information;
family information; and
other special category personal data.

Approved Use Cases

Examples of appropriate use include:

drafting candidate summaries;
refining outreach messages;
summarising interview notes;
formatting market intelligence;
preparing interview questions; and
administrative workflow support.

Human Review Requirement

All AI-generated outputs must be reviewed by a recruiter before being:

shared externally;
submitted to clients; or
relied upon operationally.

Recruiters remain responsible for the accuracy, appropriateness and fairness of all outputs.

AI Vendor Assessment Questionnaire

Campbell Rochford

Vendor Information

Vendor Name:
Website:
Jurisdiction:
Hosting Location:
Data Protection Contact:
Subprocessors Used:

Data Categories Processed

Please identify which categories of information may be processed:

Candidate CV information
Contact details
Employment history
Interview notes
Client business information
Other

Security Controls

Please confirm whether the following controls are in place:

Encryption in transit
Encryption at rest
Multi-factor authentication
Access controls
Audit logging
Data retention controls
Incident response procedures
Independent security certifications

Data Protection & GDPR

Please confirm:

Whether a Data Processing Agreement is available;
Whether customer data is used for model training;
Whether data retention controls exist;
Whether data can be deleted upon request;
Whether international transfers occur;
Which transfer safeguards are used.

AI Governance

Please describe:

Human oversight controls;
Bias mitigation approaches;
Explainability measures;
Output review capabilities; and
Customer confidentiality protections.

Internal Assessment

Risk Rating

Low
Moderate
High
Prohibited

Approved for Use

Yes
No
Conditional

Reviewer

Review Date

Lawful Basis & Legitimate Interests Statement

Campbell Rochford

Purpose of Processing

Campbell Rochford processes personal data for the purposes of:

executive search;
recruitment services;
candidate assessment;
market mapping;
client advisory services; and
associated business operations.

Certain administrative and operational activities may involve AI-assisted technologies operating under human supervision.

Lawful Basis

Processing is undertaken pursuant to:

Article 6(1)(f) GDPR — Legitimate Interests;
Article 6(1)(b) GDPR — Steps prior to entering into a contract;
Article 6(1)(c) GDPR — Compliance with legal obligations where applicable.

Legitimate Interests Assessment

Purpose Test

The processing is necessary to identify, assess and communicate with appropriately qualified candidates and support efficient recruitment operations.

Necessity Test

AI-assisted technologies may support proportionate operational efficiency, communication quality and administrative consistency while remaining subject to human oversight.

Balancing Test

Campbell Rochford applies safeguards including:

data minimisation;
confidentiality controls;
restricted access;
human review;
limited retention; and
prohibition of solely automated decision-making.

These safeguards help ensure that the rights and freedoms of individuals are appropriately protected.