Generative AI in HR Without a DPIA

The deployment raises several linked risks. First, there is no data protection impact assessment despite systematic profiling of candidates and use of a new technology, which is likely required where processing may result in high risk. Second, the lawful basis and transparency are weak: candidates are told only that automated tools “may” be used, without meaningful information about logic, retention, or transfers. Third, the vendor may use candidate data to train its models because HR did not opt out, which creates purpose limitation and confidentiality concerns.

Fourth, hosting in the United States creates an international transfer issue requiring a transfer mechanism and transfer risk assessment. Fifth, 24-month retention may exceed necessity and is not explained to candidates. Sixth, the tool may make or support automated decisions with legal or significant effects, requiring safeguards and human review. Seventh, diversity-monitoring data is sensitive and requires a clear lawful basis and strict access controls. Eighth, the works council was informed late, creating employee-relations and local-law risk in France and Germany. The absence of complaints does not prove compliance; candidates may not know how their data is used.

Obtain the data flow: what candidate data enters the tool, where it is stored, which vendor and subprocessors are involved, and whether data is used for model training. Review the contract, data processing agreement, transfer mechanism, retention schedule, and security annex. Test whether the vendor’s model-training clause was opted out or, if not, whether a lawful basis and safeguards exist. Inspect the candidate notice and application workflow to confirm that transparency is meaningful and that human review is available on request.

Review whether a DPIA was performed and, if not, assess whether one is required and what risks it should cover. Sample 20 applications, including rejected and diversity-monitoring records, and trace access, retention, and deletion. Interview the DPO, HR system owner, works council representative, and vendor contact. Test the tool’s outputs for bias or unexplained scoring where possible, and review whether candidates can contest automated outcomes. Finally, assess governance: who approved the deployment, whether procurement and legal reviewed it, and whether the works council was consulted before processing began. Document gaps against GDPR and local requirements.

Recommend suspension of new candidate screening until the high-risk gaps are closed, or at minimum a pause on automated ranking while human-only review is used. The absence of a DPIA, unclear lawful basis, possible model training on candidate data, and late works council consultation are not minor documentation issues. Continuing at scale would compound the exposure and make remediation harder.

Remediation should include: complete a DPIA with DPO sign-off; opt out of vendor model training or document a lawful basis and safeguards; update candidate notices with meaningful information about automated processing, retention, and transfers; implement a valid transfer mechanism and transfer risk assessment; reduce retention to a justified period; add human review and contestability; restrict diversity-monitoring data to authorized users; and consult the works council properly. Re-test before resuming.

Suspension should be proportionate: if the tool only ranks candidates and a human makes the final decision, a pause on automated ranking plus immediate remediation may be sufficient. If it rejects candidates automatically, suspend entirely. Report the decision and residual risk to the audit committee and DPO, with a defined restart gate.