Generative AI and Employee Data Privacy: GDPR and CCPA

HR can use generative AI with employee data under GDPR and CCPA if it limits what goes into prompts, has a lawful basis and clear notice, signs processor terms that bar vendors from training on the data, assesses high-risk uses before launch, and can honor access, deletion and correction requests for data held in AI tools and logs.

Key takeaways

  • Employee prompts, uploaded files and AI outputs about identifiable people are personal data under both GDPR and CCPA.
  • Under GDPR, consent is a weak basis for employee processing; most HR uses rely on contract, legal obligation or legitimate interests.
  • The CCPA's temporary exemptions for employee data expired on December 31, 2022, so California workers have the same privacy rights as consumers.
  • California's newer regulations require risk assessments for several HR AI uses and ADMT compliance by January 1, 2027.
  • Data minimization in prompts is the single most effective control.

Is employee data in AI prompts personal data?

Yes, whenever a person can be identified from it. That includes the obvious (a name and a disciplinary history pasted into a chatbot) and the less obvious: a "summarize this investigation" request with initials and a job title, a spreadsheet of salaries by employee ID, or a performance review draft. The AI's output can also be personal data, because a generated summary or recommendation about an employee is information relating to that person.

This matters because many generative AI tools keep prompts and outputs in logs, may use them to improve models, and may process them in other countries. Each of those is a processing activity that privacy law expects you to understand, document and control. Our earlier overview of GDPR and employee data in HRMS platforms covers the system-of-record basics; this article focuses on what changes when generative AI is added.

What does GDPR require when HR uses generative AI?

The General Data Protection Regulation (Regulation (EU) 2016/679) applies to employee data of people in the EU, and the UK applies a similar regime. The UK Information Commissioner's Office publishes detailed guidance on AI and data protection that is useful even outside the UK. For HR teams, the key requirements map to concrete tasks.

GDPR provisionWhat it means for generative AI in HR
Article 5 principlesUse data only for the stated purpose, keep prompts minimal, and set retention limits for logs
Article 6 lawful basisIdentify a basis for each use; legitimate interests requires a documented balancing test
Article 9 special categoriesHealth, union membership, biometric and similar data need an additional condition; keep them out of general tools
Article 22 automated decisionsAvoid decisions based solely on automated processing with legal or similarly significant effects without safeguards and human intervention
Article 28 processorsSign a processing agreement limiting the vendor to your instructions
Article 35 DPIAAssess likely high-risk processing, such as new technology used to evaluate employees, before starting
Chapter V transfersConfirm where prompts and outputs are processed and the transfer mechanism used

Why consent rarely works for employees

GDPR consent must be freely given, and European regulators have long cautioned that the power imbalance between employer and employee makes that hard to show. Asking staff to "consent" to an AI tool they are required to use for their job is a weak foundation. Document a different lawful basis and explain it in your employee privacy notice.

Where Article 22 bites

Generative AI used to draft text for a human to edit is usually not a solely automated decision. The risk appears when outputs feed directly into outcomes: auto-rejecting applicants, assigning performance ratings or flagging employees for discipline without meaningful human review. Meaningful means the reviewer has authority and information to change the outcome, not a rubber stamp.

How does the CCPA apply to employee data and AI?

The California Consumer Privacy Act covers for-profit businesses that do business in California and meet its revenue or data volume thresholds. According to the California Attorney General, the law's exemptions for employment-related personal information expired on December 31, 2022. Employees, applicants and contractors who are California residents can therefore request to know, delete and correct their personal information and limit use of sensitive personal information, subject to the law's exceptions.

The California Privacy Protection Agency's regulations on risk assessments and automated decisionmaking technology took effect January 1, 2026. Several provisions affect HR directly:

  • Risk assessments are required before processing that presents significant risk, including using ADMT for a significant decision, using automated processing to infer an applicant's or employee's performance at work, health, reliability or behavior based on systematic observation, and processing personal data intended to train ADMT for significant decisions.
  • Payroll and benefits carve-out: processing employees' sensitive data solely to administer pay, benefits, work authorization, required accommodation or wage reporting does not by itself trigger a risk assessment.
  • ADMT duties apply when ADMT is used for significant decisions, which include hiring, allocation of work, compensation, promotion, demotion, suspension and termination. Businesses already using ADMT must comply by January 1, 2027.
  • Submission timing: information about risk assessments conducted in 2026 and 2027 is due to the Agency by April 1, 2028.

Which controls protect employee data in generative AI tools?

Most privacy failures with generative AI in HR come from ordinary behavior: someone pastes too much into the wrong tool. Controls should make the safe path easy.

  1. Approved tools only. Provide an enterprise tool covered by a processing agreement, and block or discourage personal accounts for HR work.
  2. Prompt minimization. Teach staff to remove names and identifiers when the task does not need them, for example asking for a template rather than a letter about a specific employee.
  3. No training on your data. Confirm in the contract, not just a settings page, that prompts and outputs are not used to train models.
  4. Retention limits. Set log retention to the shortest workable period and confirm deletion covers backups and derived data.
  5. Access control. Restrict who can see conversation histories, especially in shared HR workspaces.
  6. Rights handling. Add AI tools and logs to your data map so access and deletion requests reach them.
  7. Security review. Treat AI tools as part of your HR security perimeter; our piece on HR and risk management working together on cybersecurity outlines the shared responsibilities.

Pair the controls with clear rules for staff. Our article on giving employees guidance on AI tools at work covers how to communicate them.

What are the most common privacy mistakes HR makes with AI?

  • Updating the employee privacy notice months after the AI tool goes live, or never.
  • Running a DPIA or risk assessment on the vendor's product generally rather than on your specific HR use.
  • Forgetting that applicants are data subjects too, including those never hired.
  • Letting a pilot with real employee data start before the processing agreement is signed.
  • Assuming a US vendor's privacy policy satisfies EU transfer requirements.

Frequently Asked Questions

Can HR paste employee data into ChatGPT or similar tools?

Only into an approved enterprise version covered by a processing agreement that controls retention and prohibits training on your data, and only the minimum data needed. Consumer accounts give you little control over storage, location or reuse, which makes it hard to meet GDPR processor rules or honor CCPA deletion requests. Keep health, investigation and pay data out entirely.

Do we need a DPIA before using generative AI in HR?

Under GDPR, a DPIA is required when processing is likely to result in high risk, and new technology used to evaluate or monitor employees often qualifies. In California, a separate risk assessment is required for uses such as ADMT in significant decisions or inferring work performance. Running one assessment that satisfies both saves time.

Do California employees have privacy rights over HR data?

Yes. The CCPA's temporary exemptions for employment-related information expired on December 31, 2022, so California resident employees, applicants and contractors of covered businesses can exercise rights to know, delete and correct their personal information, and limit use of sensitive information, subject to exceptions such as legal retention duties.

Is AI-generated content about an employee personal data?

Generally yes. A summary, rating or recommendation generated about an identifiable employee is information relating to that person, so it falls within access requests and retention rules. Store AI outputs that inform decisions in your system of record, and delete working drafts and logs on a defined schedule.

Practical next steps

  1. Map every generative AI tool HR uses and the employee data each receives.
  2. Confirm processing agreements, training restrictions and data locations for each.
  3. Run a combined DPIA and CCPA risk assessment for the highest-risk uses.
  4. Update employee and applicant privacy notices to describe AI processing.
  5. Train HR staff on prompt minimization. Find related governance guides in our AI in HR guides hub.

This article is general information, not legal advice.

Last reviewed: October 2026.

Sources

Comments

Post a Comment

Popular Posts

Why Workday Onboarding Breaks Down for Frontline Employees

Image
The Onboarding Gap Nobody Talks About Workday's onboarding module is well-designed for its intended audience: office-based, desk workers with reliable computer access, personal email addresses, and the digital literacy to navigate a web-based portal. For this population, Workday onboarding works well, it automates tasks, routes approvals, collects documents, and creates a reasonably smooth first-week experience. But most organizations using Workday have a substantial population of frontline workers: warehouse employees, retail staff, manufacturing workers, healthcare aides, food service workers, drivers. For this population, the standard Workday onboarding experience frequently fails in ways that are predictable, documented, and, crucially, fixable. Understanding why it breaks down and what actually works is increasingly urgent as labor market competition for frontline talent intensifies. How Standard Workday Onboarding Is Designed Workday's new hire onboarding (delivered throu...
Read more

How to Improve the Customer Experience (CX)

Customer experience is the sum of every interaction a customer has with your company, from the first ad they see to the way a return gets handled years after the purchase. Companies that take this seriously outperform those that treat CX as a support function. The ones that struggle tend to confuse customer satisfaction scores with actual improvements, or fix the wrong things. Here's a practical look at what actually moves CX forward. Start with where customers actually struggle Most CX improvement programs begin with surveys. Surveys are useful but limited, they capture what customers are willing to articulate after the fact, which tends to under-report friction in the middle of an experience and over-index on the most recent interaction. The richer data comes from observing behavior directly: where do customers drop off in a purchase flow? Where do support tickets spike? What search queries are people entering on your site that suggest they can't find what they're loo...
Read more

Infor HCM Software Engineer Jobs: Salary Factors and Skills

An Infor HCM software engineer's salary depends mostly on the type of employer, the depth of Infor platform knowledge, and location. Engineers who combine general software skills with hands-on experience in Infor CloudSuite HCM, Lawson, Infor ION integrations and payroll logic tend to command more than generalist developers, because that combination is scarce in the job market. What does an Infor HCM software engineer actually do? The title covers several different jobs, and pay follows the job more than the title. Broadly, these engineers build, configure, integrate and support the Infor human capital management stack, which includes core HR, payroll, benefits, talent management and workforce management. Many organizations still run the older on-premises Infor Lawson system alongside or instead of the cloud suite, so experience with both is common. Typical responsibilities include: Building and maintaining integrations between Infor HCM and payroll providers, benefits carrie...
Read more

UKG Union Contract and Overtime Rules for Multi-Site Food Plants

Multi-site food manufacturers running UKG often struggle with one thing: each plant has its own union contract, shift pattern and overtime rules, while the timekeeping system is configured centrally. The fix: document every contract rule precisely, map it to UKG pay rules and work rules, test against real timecards, and handle true exceptions with add-ons rather than core customization. Disclosure: The author works at CloudApper, which makes the UKG add-ons discussed in this article. Why are union contracts so hard to configure in UKG? Federal law sets a floor. Under the Fair Labor Standards Act, non-exempt employees must receive at least one and a half times their regular rate for hours worked over 40 in a workweek. Collective bargaining agreements frequently go further, and food plants often have several agreements across locations. Common contract provisions include: Daily overtime after 8 hours, or after 10 on a four-day schedule. Double time on the seventh consecutive day o...
Read more

How Do I Log In and Sign In to Workday HCM

Workday HCM is the system your organization uses to manage everything from your pay stubs and benefits to time off requests and performance reviews. Getting in is usually simple once you know where to go, but first-time login, password resets, and single sign-on setups can trip people up if no one has walked them through it. Here's what you need to know. How to find your Workday login URL Workday doesn't have one universal login page. Each organization has its own tenant, a dedicated instance with a unique URL. Your company's HR department or IT team should have provided the URL when you were onboarded. It usually looks something like your-company.workday.com or wd3.myworkday.com/yourcompany . If you weren't given the URL, check your onboarding email, your company's intranet, or ask HR directly. Some organizations also link to Workday from their internal HR portal. Don't try to guess the URL, there's no central directory, and guessing wrong just takes...
Read more

How to Search in Workday: Find Reqs, Reports, People and Tasks

To search in Workday, type into the global search bar at the top of any page, press Enter, then use the category filters on the left of the results to narrow to people, organizations, tasks and reports or other object types. Workday only returns items your security roles allow you to see, so missing results often mean an access issue rather than a typo. How does Workday search work? Workday uses a single global search box rather than separate menus for each module. Everything in the tenant, from a worker's profile to a job requisition to a custom report, is an object that search can find if you have permission to view it. Three points explain most search behavior: Security trimming. Results are filtered by your security groups. A recruiter and a payroll partner typing the same term will see different results. Categories. After you press Enter, results are grouped into categories that appear as filters. Clicking one hides everything else. Related actions. Once you open an...
Read more

New Apple Watch Health Features Will Be Available This Year, but Blood Pressure and Blood Sugar Sensors Will Not Be Available Until Next Year

Image
What Apple confirmed for its upcoming watch lineup Apple's annual health feature announcements for its Watch lineup continue to generate significant attention, both from health enthusiasts who track every new sensor addition and from the clinical research community that increasingly uses consumer wearables in studies. The pattern that has emerged over the past several product cycles is consistent: Apple confirms a set of features that will ship with the current year's model and acknowledges separately that other, more complex sensors are still in development and will not arrive on schedule. This year's announcement followed that pattern closely. Several new health monitoring capabilities are confirmed for the current Apple Watch generation, representing meaningful additions to what the device can track passively. At the same time, the two most anticipated sensor additions, continuous blood pressure monitoring and non-invasive blood glucose measurement, will not be availa...
Read more

The Future of Employee Healthcare Key Concerns and Strategies for 2024

In a rapidly evolving professional landscape, employers are grappling with an array of challenges as they plan employee-sponsored healthcare strategies for 2024. A recent survey conducted in the US in August 2023 sheds light on the primary concerns and emerging trends in the realm of employee healthcare. Mental health, healthcare costs, pharmacy expenditures, and transformative technologies are at the forefront of employer considerations, signaling a need for comprehensive and innovative approaches to employee well-being. Rising Mental Health Concerns A staggering seven in 10 employers reported a surge in mental health concerns, marking a significant uptick from the previous year. With 77% of employers experiencing an increase and an additional 16% anticipating future challenges, the mental health landscape is a top priority. The implications of the ongoing pandemic, remote work dynamics, and societal shifts are evident as employers grapple with addressing and supporting the mental ...
Read more

How Digital Marketing Helps Your Business Grow: A Practical Plan

Digital marketing helps a business grow by putting it in front of buyers at the moment they search, compare and decide, then measuring which efforts produce revenue. Search, content, email, paid ads and social channels let even small teams reach targeted audiences, test messages cheaply and shift budget toward what works, something print and broadcast advertising rarely allow. How does digital marketing actually drive business growth? Growth comes from three levers: reaching more of the right people, converting more of them into customers and keeping those customers longer. Digital channels touch all three. Reach. Search engines, professional networks and industry newsletters connect you with people already looking for what you sell. Conversion. Clear landing pages, case examples and easy contact options turn interest into conversations. Retention. Email, customer education content and community channels keep existing customers engaged and open to expansion. The underlying ...
Read more

ERP Solution Guide: How to Choose the Best ERP for You

What Is an ERP System and Why Does It Matter? An enterprise resource planning (ERP) system is software that integrates the core functions of a business — finance, inventory, procurement, human resources, manufacturing, and customer management — into a single, connected platform. Instead of data living in separate spreadsheets or standalone applications that don't talk to each other, an ERP creates one source of truth for the entire organization. For growing companies, the question is usually not whether they need an ERP but when and which one. Getting this decision right has long-term consequences. A poorly chosen ERP creates more problems than it solves — forcing teams to work around the system, creating data integrity issues, and consuming IT resources in an endless cycle of customization and maintenance. A well-chosen ERP, on the other hand, becomes the operational backbone that lets a company scale without proportionally growing its administrative overhead. Understandin...
Read more