Almost every AI tool used to manage people runs on personal data: CVs, performance figures, schedules, messages, location or system logs. In the EU, that means the General Data Protection Regulation applies before any AI-specific rule does. This page is for employers and HR teams: it sets out the GDPR duties that most often apply when AI processes worker or candidate data, and three Court of Justice rulings that shape them. For the worker's side, see how to request the data AI systems hold on you.
The short answer: employers need a valid legal basis, and consent is rarely one at work. AI that evaluates or monitors staff will often need a data protection impact assessment before it starts. Decisions with significant effects cannot be left solely to automated processing except in limited cases, and then with a right to human intervention. Workers must be told about such automated decisions, with meaningful information about the logic involved, which the Court of Justice has said means the procedure and principles actually applied.
Legal basis: why consent rarely works at work
Every processing operation needs one of the legal bases in Article 6 (Regulation (EU) 2016/679). Recital 43 says consent should not be a valid legal ground where there is a clear imbalance between the person and the controller. Between employer and employee that imbalance is usual, so employers generally rely on other bases, such as performance of the contract, a legal obligation or legitimate interests, and must show the AI processing is necessary for that purpose. Data must also be adequate, relevant and limited to what is necessary (Article 5(1)(c)).
National employment rules must meet the GDPR's conditions
Article 88 lets Member States, by law or collective agreement, set more specific rules for processing employees' data, including for recruitment, management and organisation of work, and must include suitable and specific measures to safeguard dignity, legitimate interests and fundamental rights, with particular regard to transparency and monitoring systems at the workplace. In Hauptpersonalrat der Lehrerinnen und Lehrer (C-34/21, 30 March 2023), the Court of Justice ruled that a national provision which does not meet those conditions cannot count as a more specific rule and must be disregarded unless it is a valid legal basis under Article 6(3) (Case C-34/21). In practice, check whether a works agreement or national law on workplace AI or monitoring applies, and whether it meets Article 88(2).
Impact assessment before you start
Where processing, in particular using new technologies, is likely to result in a high risk to people's rights and freedoms, the controller must carry out a data protection impact assessment before the processing (Article 35(1)). One is required in particular for a systematic and extensive evaluation of personal aspects based on automated processing, including profiling, on which decisions with legal or similarly significant effects are based (Article 35(3)(a)). AI that scores, ranks or monitors workers will often meet that description. Seek the advice of the data protection officer where one is designated (Article 35(2)).
Automated decisions: Article 22
People have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects or similarly significantly affects them (Article 22(1)). Exceptions apply where the decision is necessary for entering into or performing a contract, is authorised by law with suitable safeguards, or is based on explicit consent. In the contract and consent cases the controller must provide at least the right to obtain human intervention, to express a point of view and to contest the decision (Article 22(3)).
What counts as a "decision" can be wider than it looks. In SCHUFA (C-634/21, 7 December 2023), the Court ruled that an automatically produced probability score is itself an automated decision where a third party draws strongly on it to establish, implement or terminate a contractual relationship (Case C-634/21). The case concerned credit scoring, but the reasoning is relevant to vendor scores that an employer relies on heavily when hiring or dismissing.
Telling people and explaining the logic
When collecting data, employers must tell people about the existence of automated decision-making under Article 22 and, at least in those cases, give meaningful information about the logic involved and the significance and envisaged consequences (Article 13(2)(f)); the right of access repeats this (Article 15(1)(h)). In Dun & Bradstreet Austria (C-203/22, 27 February 2025), a case on the right of access in Article 15(1)(h), the Court ruled that this means explaining, in a concise, transparent, intelligible and easily accessible form, the procedure and principles actually applied to the person's data to reach the result. Where the employer claims trade secrets or third parties' data are involved, it must give that information to the supervisory authority or court, which balances the interests (Case C-203/22). The ruling did not decide Article 13(2)(f); because that provision uses the same words, our reading is that employers should plan to meet the same standard when they inform people at collection, but that is an inference, not a ruling.
Practical steps for employers
- Map which AI tools use worker or candidate data, for what purpose and on which legal basis. Do not rely on employee consent by default.
- Run a data protection impact assessment before deploying AI that evaluates, ranks or monitors people, and involve the data protection officer.
- Keep a person with real authority in decisions on hiring, pay, discipline and dismissal, and give a way to contest them.
- Be ready to explain, in plain words, which inputs and principles a system applied to a given worker. Ask vendors for this before you buy.
- Check national employment data rules and works agreements, and consult representatives where required; see consulting employees before an AI rollout.
How it fits with the AI Act
The AI Act adds to the GDPR rather than replacing it. Some workplace uses are banned outright, such as emotion recognition of staff (see AI practices banned at work), and high-risk duties for employment AI apply from 2 December 2027. In November 2025 the Commission proposed amendments to the GDPR, including to Article 22, as part of its Digital Omnibus package (COM(2025) 837); a proposal is not law, and this page reflects the GDPR as in force. The UK has already changed its own version of these rules, see automated decisions about workers under UK data law. See also AI monitoring at work. This page is general information, not legal advice.
Questions and answers
Can employers rely on employee consent to use AI on their data?
Rarely. Recital 43 of the GDPR says consent is not a valid ground where there is a clear imbalance between the person and the controller, which is usual at work. Employers generally need another legal basis and must show the processing is necessary.
Do we need a DPIA for AI that evaluates staff?
Often yes. Article 35 requires one before processing likely to result in a high risk, in particular systematic and extensive evaluation based on automated processing on which significant decisions are based.
Can an AI system make hiring or firing decisions on its own?
Article 22 gives people the right not to be subject to decisions based solely on automated processing with legal or similarly significant effects, subject to narrow exceptions with safeguards, including the right to human intervention and to contest the decision.
How much must an employer explain about an AI decision?
Under Articles 13(2)(f) and 15(1)(h), meaningful information about the logic involved. The Court of Justice (C-203/22), ruling on the right of access, said this means the procedure and principles actually applied, in a concise and intelligible form.