How Should HR Teams Use AI? Protecting Employee Data

Human resources is one of the functions that can benefit fastest from generative AI. Writing job ads, preparing interview questions, building onboarding content, simplifying policy documents, drafting announcements: all text-heavy, repetitive work.

But HR also holds an organisation's most sensitive personal data: medical notes, salaries, disciplinary records, performance reviews, candidate CVs. Under Türkiye's data protection law (KVKK), as under the GDPR, health data is a special category subject to much stricter conditions. Put the wrong data into the wrong tool and the cost is not only a data breach but also a loss of employee trust.

This article offers a framework for HR teams to use AI both productively and safely.

Uses that need no personal data

A large share of HR work requires no employee or candidate data at all. These are the safest places to start:

• Job ad drafts: Turning a role profile into an ad, simplifying language, spotting non-inclusive wording.
• Competency-based interview questions: Building behavioural question sets and scoring guides for a role.
• Onboarding and training content: First-week plans, FAQs, short quizzes.
• Policies and procedures: Turning long documents into readable summaries (legal and HR must check the final text).
• Employee communications: Announcements, newsletters and email drafts.
• Survey design: Drafting questions for engagement or training needs surveys.

Uses that need care

The following involve personal data and can directly affect people. They require an approved enterprise tool, a legal review and human oversight:

• CV screening and candidate ranking: Carries both personal data and bias risk.
• Performance review summaries: Summarising a manager's notes shapes a document that affects someone's career.
• Analysis of employee survey comments: Open-ended comments can contain identifying details even when the survey is anonymous.
• Chat assistants for leave, payroll and benefits: A wrong answer directly affects an employee's entitlements.

Red lines

Some practices should be avoided altogether:

1. Emotion recognition at work. Article 5 of the EU AI Act prohibits AI systems that infer people's emotions in the workplace, except for medical or safety reasons. The ban has applied since 2 February 2025. Video interview tools that "measure a candidate's enthusiasm" may fall within it.
2. Adverse decisions left entirely to a machine. Article 11 of KVKK gives individuals the right to object to an adverse outcome resulting solely from automated analysis of their data. Leaving hiring, promotion or dismissal decisions entirely to a system is both a legal and an ethical risk.
3. Entering health data into general-purpose tools. Medical reports, diagnoses or disability information should never go into unapproved tools.

What the regulations say

In Türkiye, the data protection authority has published two key documents: the "Guide on Generative AI and the Protection of Personal Data" on 24 November 2025, and an announcement titled "Use of Generative AI Tools in Workplaces" on 5 March 2026. The latter focuses on publicly available third-party generative AI tools used at work, and stresses corporate policies, informing employees and human review of outputs.

Under the EU AI Act, HR is one of the most affected areas. Annex III classes the following as high-risk:

The Omnibus amendment that entered into force in July 2026 postponed obligations for Annex III high-risk systems to 2 December 2027. Companies with employees or candidates in the EU, and systems whose outputs are used in the EU, may be in scope. Our EU AI Act Scope Checker helps you see where you stand.

Bias: the invisible risk

AI models learn patterns from their training data. If past hiring decisions were biased, a model can reproduce and even amplify that bias. NIST's AI Risk Management Framework lists managing harmful bias as a core characteristic of trustworthy AI.

Simple checks an HR team can run:

• Try the same ad or evaluation text with different name, gender and age cues and see whether the output changes.
• Periodically compare an AI-suggested shortlist with one prepared independently by a person.
• Ask vendors in writing how their tool has been tested for bias.

6 rules for HR

1. Anonymise data. Use "Candidate A" or "Employee B" instead of names, ID numbers or contact details.
2. Use approved tools only. Tools used through personal accounts create shadow AI risk.
3. Keep decisions with people. AI can summarise and suggest; a person makes the decision and owns it.
4. Inform candidates and employees. If a process is AI-assisted, update your privacy notices accordingly.
5. Record usage. Keep an inventory of which tool is used in which process. Our AI inventory template is built for this.
6. Verify outputs. On legal references, leave entitlements or severance calculations, AI can give fluent but wrong answers.

HR's dual role

HR is not only a user of AI. It also plans organisation-wide AI training, builds competency frameworks and communicates policies to employees. When the HR team builds a solid foundation first, setting up the right programme for everyone else becomes much easier.

To decide where to start across the organisation, the Training Finder suggests suitable courses in a few questions, and our AI training needs analysis survey helps you measure where your employees are today. For HR teams, we tailor our Generative AI at Work course with HR-specific examples, together with safe use and data protection.

Sources

• AI Act – Annex III, high-risk AI systems
• AI Act – Article 5, prohibited practices
• Future of Privacy Forum – AI Act timeline and Omnibus changes
• KVKK – Use of Generative AI Tools in Workplaces (5 March 2026, Turkish)
• Erdem & Erdem – Commentary on the KVKK workplace announcement (Turkish)
• Anadolu Agency – KVKK guide on generative AI and personal data (Turkish)
• NIST – AI Risk Management Framework