What data do AI systems hold on you at work? How to ask

Workplace software now records a great deal about the people who use it: logins, keystrokes, calls, locations, task times, ratings, and the scores and flags that AI tools produce from all of that. If a system helps decide your shifts, your pay, your review or whether you keep your job, it is reasonable to want to know what it holds on you and how it reached its view. In several places, the law gives you a way to ask. This page explains those rights and how to use them.

The short answer: in the EU and UK, data protection law lets you ask your employer for a copy of your personal data, including information about any solely automated decisions, and the employer normally has one month to reply and cannot usually charge. People working through digital labour platforms in the EU get extra rights to information about monitoring and decision systems once the Platform Work Directive is in national law (deadline 2 December 2026). In California, employees have been covered by the state privacy law since 2023.

The right of access under the GDPR

Article 15 of the GDPR gives a person the right to confirmation of whether their personal data is being processed and, if so, access to that data (GDPR, Article 15). Along with a copy of the data, the employer must tell you:

• the purposes of the processing and the categories of data concerned;
• who the data has been or will be disclosed to;
• how long it will be kept, or the criteria for deciding that;
• your rights to rectification, erasure, restriction and objection, and to complain to a supervisory authority;
• where the data came from, if not from you;
• whether there is automated decision-making, including profiling, of the kind covered by Article 22, and in those cases meaningful information about the logic involved and the significance and envisaged consequences for you.

The first copy is free. The employer must act without undue delay and within one month, extendable by two further months for complex or numerous requests, telling you about any extension within the first month (GDPR, Article 12(3) and (5)). A fee or refusal is only allowed for requests that are manifestly unfounded or excessive, and the employer has to show that. The right to a copy must not adversely affect the rights and freedoms of others, so information about colleagues may be withheld or redacted (GDPR, Article 15(4)).

Article 22 separately gives people the right not to be subject to a decision based solely on automated processing which produces legal effects concerning them or similarly significantly affects them, with exceptions and safeguards (GDPR, Article 22). EU countries can also set more specific rules for employee data by law or collective agreement (GDPR, Article 88).

In the UK

The UK GDPR has the same right. The Information Commissioner's Office tells employers that in most circumstances they cannot charge a fee, must respond without undue delay and within one month, can extend by up to two further months for complex or numerous requests, and must make a reasonable and proportionate search for the information (ICO, A guide to subject access). A request can be made verbally or in writing, including via social media, according to the same guidance. A reference given in confidence for employment purposes is exempt from the right of access; see AI and job references in the UK.

Platform workers in the EU

The Platform Work Directive goes further for people working through apps and platforms (Directive (EU) 2024/2831). Under Article 9, platforms must tell workers about automated monitoring and decision-making systems, including the categories of data and actions monitored, the categories of decision taken or supported, the main parameters those systems take into account and their relative importance, and the grounds for decisions to restrict, suspend or terminate an account or to refuse payment. Workers get this in concise form by their first working day, before changes, and at any time on request, and a comprehensive and detailed version on request.

Article 11 adds a right to an oral or written explanation for any decision taken or supported by an automated decision-making system, access to a contact person to discuss it, and a written statement of reasons for decisions such as suspending or terminating an account or refusing payment. Member States must apply the directive by 2 December 2026. See the EU Platform Work Directive explained.

California

The California Privacy Protection Agency says the CCPA gives privacy rights to California residents, including employees and job applicants, and that the former exemption for employment-related personal information expired on 31 December 2022 (California Privacy Protection Agency, FAQ). Covered businesses must confirm a request to know within 10 business days and respond substantively within 45 calendar days, extendable to 90 days with notice. Where a business uses automated decisionmaking technology to make significant decisions about someone, including employment decisions, the agency says people have rights to notice, to opt out where applicable, and to request meaningful information about how the technology worked and affected them, with businesses required to comply with the ADMT-specific requirements by 1 January 2027. The CCPA only applies to businesses that meet its thresholds.

Some US laws give narrower rights to specific data. Warehouse workers in California and Oregon, for example, can request their quota and recent work speed data; see warehouse quotas and algorithmic management.

How to make a request

• Send it to HR or the data protection contact named in your employer's privacy notice, and keep a dated copy.
• Name the systems you are asking about, for example the scheduling tool, the call monitoring system or the performance dashboard, and the time period.
• Ask specifically for any scores, ratings, flags or risk labels generated about you, and for information about any automated decisions and the logic involved.
• If the reply is late or incomplete, follow up in writing; in the EU and UK you can complain to the data protection authority.

For employers

Before rolling out a tool that monitors or scores staff, check that you can find and export what it holds on a named person, explain in plain words how its outputs are used, and answer within the deadlines that apply to you. Those are also the questions to put to vendors. For the wider GDPR duties, such as legal basis and impact assessments, see GDPR duties for employers using AI; for the UK rules on automated decisions since February 2026, see automated decisions about workers under UK data law. See also AI monitoring at work, AI in performance reviews and AI at work and workers' rights. This page is general information, not legal advice.