GDPR in the workplace: employee data and AI

Short answer: Every HR AI system processes employee data, so the GDPR applies in full — alongside the AI Act. The hardest point is the lawful basis: consent is rarely valid in an employment relationship, because an employee cannot freely refuse. You then fall back on legitimate interest, performance of the employment contract or a legal obligation — each with its own limits.

Why consent usually doesn't work

The GDPR requires consent to be freely given. The authority relationship between employer and worker almost never allows that: anyone saying "no" to monitoring or an appraisal tool feels the pressure. Regulators therefore generally reject consent in the employment context. Legitimate interest can work, but requires a balancing test in which the worker's interest weighs heavily.

Special-category data: extra strict

AI that processes faces, voices or health touches special-category personal data (Art. 9 GDPR) with a strict prohibition regime. This overlaps with the emotion-recognition ban in the AI Act: what the AI Act prohibits is often already not allowed under the GDPR anyway.

The other core principles

• Data minimisation: collect only what is needed; "because we can" is not a purpose.
• Transparency: tell workers clearly which AI processes their data and why.
• Automated decisions: for decisions with significant effects Article 22 applies, with a right to human intervention.
• DPIA: for large-scale or intrusive processing a data protection impact assessment is mandatory — combine it with the works-council process.

National room (Art. 88)

The GDPR leaves Member States and collective-agreement parties room for their own rules in the employment context. In the Netherlands this works through the role of the works council and supervision by the data protection authority. So don't rely only on the general GDPR text, but also on the national elaboration.

What to do

• Determine the basis per system — and be honest: is consent here really free?
• Run a DPIA for monitoring, profiling or large-scale processing.
• Minimise and inform — less data, more explanation.
• Align with the works council and, where the AI Act requires it, with worker representatives.

AI Act compliance and GDPR compliance are not interchangeable. A system can be neatly set up as high-risk and still founder on a missing lawful basis. The data is the foundation — start there.