Employee Data Privacy and AI: What HR Must Protect

By Kevin Kim · Updated Oct 11, 2026

Employee data privacy in AI is the set of legal and practical duties that apply when HR feeds personnel information into AI tools: knowing which data is sensitive, having a lawful reason to use it, telling people, assessing the risk beforehand, keeping humans in significant decisions, binding vendors by contract, limiting how long data is kept, and controlling where it travels. The data HR holds (health details, pay, performance notes, disciplinary history, sometimes fingerprints or faces) is some of the most sensitive in the company. Pointing an AI tool at it changes the risk, and often changes who is legally responsible for what.

This page is for HR directors, people operations leads and the managers who sign off on HR tools. It walks through the main duties under EU and UK law and the US state laws that bite hardest, then gives you a use-case table and a step-by-step process. It sits in the AI for HR collection, so for the bigger picture start with HR data foundations for AI. This is general information, not legal advice.

Key Facts

• Breaches of the GDPR's basic processing principles, consent conditions, special-category rules, data subject rights and international transfer rules can draw fines of up to EUR 20 million or 4% of worldwide annual turnover, whichever is higher; breaches of controller and processor duties (including processor contracts and impact assessments) can draw up to EUR 10 million or 2% (GDPR Article 83).
• The European Data Protection Board says it is "problematic" for employers to process current or future employees' data on the basis of consent, because it is unlikely to be freely given (EDPB Guidelines 05/2020).
• California's exemptions for employment-related personal information expired on 31 December 2022, so employees and job applicants who are California residents now fall under the CCPA (California Attorney General).
• In December 2023 the EU Court of Justice held that credit "scoring" counts as a prohibited automated individual decision when the customer attributes a determining role to the score (Court of Justice press release).
• The EU-US Data Privacy Framework rests on a Commission adequacy decision of 10 July 2023; the General Court dismissed a challenge to it on 3 September 2025 (General Court press release), and an appeal was filed on 31 October 2025 (Digital Policy Alert).

Why AI Changes the Privacy Picture

HR has always held sensitive records. AI adds three things. Reach: a tool that reads every review, ticket and chat message touches far more than a manager flipping through a file. Inference: AI derives new facts, such as a flight-risk score or a guess about health from absence patterns, and an inference about a person is still personal data about that person. Third parties: most HR AI is bought, so a vendor with sub-processors and servers in other countries sits between you and the data. You can outsource the processing. You can't outsource the accountability.

For the access-control side, data classification for AI access shows how to decide which data tiers an AI tool may see at all.

The Seven Duties HR Has to Get Right

1. Know which data is sensitive

Under the GDPR, processing certain categories is prohibited unless a specific condition applies. Article 9 lists data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs or trade union membership, plus genetic data, biometric data processed to uniquely identify a person, health data, and data about sex life or sexual orientation (GDPR Article 9). The UK regulator explains that biometric data becomes special category data when it's processed to uniquely identify someone, and that an ordinary photo doesn't qualify unless it goes through specific technical processing, such as creating a template for automated matching (ICO).

In HR, sick-leave notes, accommodation requests, union dues, diversity surveys and a fingerprint or face template used to clock in are all special category data. Even unlabelled data can reveal it: a pattern of absences, or a chatbot conversation where an employee mentions a diagnosis.

2. Have a lawful basis, and don't lean on consent

Every use of personal data needs a lawful basis. Employers often reach for consent because it feels respectful. It's usually the weakest choice. The EDPB's guidelines explain that the dependency in the employer-employee relationship makes it unlikely an employee can refuse without fearing real risk of detriment, so for most processing at work the basis "cannot and should not" be consent. Consent remains possible only in exceptional circumstances where refusing has no adverse consequences (EDPB Guidelines 05/2020). The UK ICO says the same in its guidance: freely given consent is more difficult to obtain where there is an imbalance of power, particularly for public authorities and employers (ICO).

So what do you use instead? Typically the contract of employment, a legal obligation (payroll, tax, health and safety), or legitimate interests, which needs a documented balancing test. For special category data you also need a condition from Article 9(2), and one of them covers processing necessary for employment law obligations where national law authorises it. A tick-box "I agree to AI analysis" is rarely the answer.

3. Tell people clearly

Transparency is a duty, not a courtesy. When you collect data directly, the GDPR requires you to tell people, among other things, whether there is automated decision-making including profiling and, at least in the Article 22 cases, meaningful information about the logic involved and the envisaged consequences (GDPR Article 13). "We use AI to improve HR processes" doesn't meet that bar. Name the tool's purpose, the data it uses, and what decisions it informs.

Article 88 also lets each EU Member State add more specific employment-data rules, with particular attention to transparency and to monitoring systems at the workplace (GDPR Article 88). In practice that means works council consultation in some countries before you can switch a tool on. See AI employee monitoring for that angle.

4. Do the impact assessment before you launch

A data protection impact assessment (DPIA) is a structured risk review you run before the processing starts. Article 35 requires one where processing, particularly using new technologies, is likely to result in a high risk to people's rights. It specifically requires one for systematic and extensive evaluation of personal aspects based on automated processing on which decisions with significant effects are based, and for large-scale processing of special category data (GDPR Article 35). Many HR AI uses, such as scoring, ranking or monitoring staff, fall squarely inside that.

A DPIA covers the processing and its purposes, its necessity and proportionality, the risks to individuals, and the measures that address those risks. Where appropriate, ask for the views of the people affected or their representatives. Treat it as a design tool: if no safeguard brings the risk down, scale the project back.

California now has a parallel requirement. The state's privacy agency finalised rules covering risk assessments and automated decisionmaking technology (ADMT), with risk-assessment compliance starting 1 January 2026 and ADMT obligations for "significant decisions" starting 1 January 2027 (CPPA). Law-firm summaries of those rules say significant decisions include employment (Skadden). If you employ Californians, put this on the calendar.

5. Control automated decisions

Article 22 of the GDPR gives people the right not to be subject to a decision based solely on automated processing, including profiling, that produces legal effects or similarly significantly affects them. There are exceptions (necessity for a contract, authorisation by law, or explicit consent), but even then the controller must provide at least the right to obtain human intervention, to express a view and to contest the decision. Decisions under those exceptions can't rest on special category data unless explicit consent or a substantial public interest condition applies and safeguards are in place (GDPR Article 22).

The Court of Justice has read this broadly. In the SCHUFA case it held that scoring must be regarded as an "automated individual decision" where the bank customers attribute a determining role to it in granting credit (Court of Justice). Translate that to HR: if a recruiter or manager rubber-stamps whatever the score says, the score is the decision. A person who merely clicks "approve" doesn't count as human involvement. Human oversight in HR AI covers how to make the human step real.

The UK has changed its approach. The Data (Use and Access) Act 2025 opens up the full range of lawful bases for significant automated decisions, provided safeguards stay in place, though that doesn't apply to special category data, and the ICO says the Act's data protection provisions are now in force (ICO). EU rules haven't moved in the same direction, so a multinational can't treat the UK position as the group standard.

6. Bind vendors and limit retention

When a vendor processes employee data on your behalf, Article 28 requires a binding contract. It must set out the subject matter, duration, nature and purpose of the processing, the type of data and categories of people, and your rights and obligations. It must also require the processor to act only on your documented instructions, ensure confidentiality, apply security measures, get your authorisation before engaging another processor, help with data subject requests, delete or return data at the end of the service, and make information available for audits (GDPR Article 28).

For AI vendors, add what the template doesn't ask. Does the vendor train its models on your employee data? Where are prompts and outputs stored, and for how long? Who are the sub-processors? The vendor evaluation framework for AI tools covers the commercial side.

Retention is the quiet one. The GDPR's storage limitation principle says data should be kept in identifiable form no longer than necessary for the purposes it's processed for (GDPR Article 5). AI makes that harder, because copies pile up in logs, prompt histories and vendor backups. Set a period for each and confirm the vendor can delete on request.

7. Watch where the data goes

Sending employee data outside the EU or UK needs a transfer mechanism. One route is a Commission adequacy decision, under which a transfer needs no specific authorisation (GDPR Article 45). Another is appropriate safeguards, such as binding corporate rules (GDPR Article 46). For the United States, the Commission adopted its adequacy decision for the EU-US Data Privacy Framework on 10 July 2023 (European Commission). The General Court dismissed the challenge brought by Philippe Latombe on 3 September 2025, confirming the US ensured an adequate level of protection on the date the decision was adopted (General Court), and an appeal was filed on 31 October 2025, so the framework remains in force while that appeal is pending. Check that your vendor is certified under the framework and has a fallback mechanism.

US Angles: California and Illinois

There's no single US privacy law for employee data, so the picture comes in layers. Two matter most for HR AI.

California (CCPA/CPRA). The state's exemptions for employment-related personal information expired on 31 December 2022 (California Attorney General). Since 1 January 2023, covered businesses owe California employees and applicants the rights the CCPA gives any consumer: to know what's collected, to delete, to correct, to opt out of sale or sharing, and to limit the use of sensitive personal information. The law applies to for-profit businesses that meet its thresholds, so check whether yours does. The ADMT rules in section 4 above add notice and opt-out duties for significant automated decisions.

Illinois (BIPA). The Biometric Information Privacy Act regulates the collection of fingerprints, face geometry and similar identifiers, and requires consent before collection. A 2024 amendment, Public Act 103-0769, signed on 2 August 2024, provides that repeated violations by the same method count as a single violation, with at most one recovery per person (Faegre Drinker). That reduced exposure per person but didn't remove it: aggrieved people can still bring individual and class claims. If your time clocks, building access or identity checks use fingerprints or face scans, this is the law to check first.

Other states keep adding rules for AI in employment, so see AI hiring laws for the hiring-specific picture.

What Each HR AI Use Case Needs

The same six controls keep recurring: a DPIA, a valid lawful basis, real human involvement, a tight processor contract, a retention limit and a transfer check.

How to Put It Into Practice

1. Inventory your HR AI. List every tool that touches employee or applicant data, including features inside existing HR software and tools managers adopted themselves.
2. Map the data. For each tool, record what goes in, what inferences come out, and whether any of it is special category or biometric.
3. Pick and document a lawful basis. Don't default to consent. Record the basis, and for special category data, the Article 9 condition. If you rely on legitimate interests, write the balancing test down.
4. Run a DPIA for anything that scores, ranks, monitors or uses sensitive data. Involve your data protection officer, if you have one, and a worker representative where law or culture calls for it.
5. Rewrite your notices. Say in plain language what the tool does, what data it uses and what decisions it informs, before first use.
6. Check decision rights. For every tool that influences hiring, pay, promotion, discipline or dismissal, name the person who makes the final call and confirm they can disagree with the output.
7. Tighten the vendor contract. Cover Article 28 terms, a ban on using your data to train shared models unless you agree, sub-processor approval, breach notification, deletion on exit and audit rights.
8. Set retention and deletion. Decide how long inputs, outputs, logs and backups live, and test that deletion works in practice.
9. Confirm the transfer route. Know where the vendor stores and accesses data and which mechanism covers each flow.
10. Train managers and review on a schedule. Most leaks come from well-meaning people pasting a performance review into a public chatbot. Re-run the inventory and DPIAs when the tool, the data or the law changes.

For regulation tied specifically to the EU's AI rules, the EU AI Act overview explains the risk tiers. The European Commission states that high-risk rules for systems used in areas such as employment apply from 2 December 2027, following the AI omnibus that entered into force on 27 July 2026 (European Commission). That sits on top of the GDPR, it doesn't replace it.

Common Pitfalls

• Treating consent as the fix. An employee can't meaningfully say no to their employer, so a consent form is a weak foundation and can be challenged.
• Assuming "not sensitive" because the field isn't labelled. Absence patterns, chat content and behavioural scores can reveal health, beliefs or union activity.
• Skipping the DPIA because the vendor "is compliant". A vendor's certification doesn't assess your use, your data or your workforce.
• Human in name only. If the reviewer approves 99% of outputs in seconds, regulators will treat the process as automated.
• Forgetting the logs. Prompts, outputs and audit trails are personal data too.
• Assuming one region's answer fits everywhere. UK, EU and US rules differ and keep changing, and the UK has just loosened its automated-decision rules while the EU hasn't.
• No exit plan. If the vendor is acquired or loses its transfer mechanism, you need to know how to get the data back and have it deleted.