# GDPR-Compliant AI in Business and HR | techport.ai > What defines GDPR-compliant AI: legal basis, DPA, third-country transfers, DPIA and Art. 22, plus a selection checklist. Read the guide now. URL: https://techport.ai/en/hr-software/dsgvo-konforme-ki --- 1. [HR Software](/en/hr-software)/ 2. GDPR-Compliant AI techport HR Suite # GDPR-Compliant AI in Business and HR AI has arrived in HR: job adverts, CV screening, assistants for internal questions. With every application, the question arises as to under what conditions it is permitted. This guide explains what defines GDPR-compliant AI, which obligations lie with the employer, and how you can evaluate a provider. As of: 23 October 2026. This text provides an overview and does not replace legal advice in individual cases. ## What “GDPR-compliant AI” really means The claim “GDPR-compliant” on a product page says very little. The General Data Protection Regulation addresses its obligations to the controller, meaning the company deploying the AI. Whether deployment is lawful is therefore decided within your own organisation: by the purpose, the legal basis, and the implementation. While the GDPR recognises certifications (Art. 42), they do not reduce the controller’s responsibility. A provider can establish the prerequisites, such as through roles, audit logs, retention schedules, and clear contracts. A solid working foundation is the guidance document “Artificial Intelligence and Data Protection” issued by the German Data Protection Conference (Datenschutzkonferenz – DSK) on 6 May 2024, intended as a checklist for selection, implementation, and use. ## Legal basis: When may AI process employee data? Any processing of personal data requires a legal basis under Art. 6 GDPR. In the employment relationship, § 26 BDSG (Federal Data Protection Act) was long the central provision. On 30 March 2023 (C-34/21), the Court of Justice of the European Union objected to an identical Hessian regulation because it did not meet the requirements for “more specific rules” under Art. 88 GDPR. Since then, § 26 para. 1 sentence 1 BDSG has been considered partially inapplicable. In practice, employers therefore base AI applications directly on Art. 6 para. 1 GDPR: * **Point (b):** The processing is necessary for the performance of an employment contract or taking steps prior to entering into it, such as processing a job application. * **Point (c):** A legal obligation requires the processing, for instance in social security law. * **Point (f):** A legitimate interest overrides the interests of the employees. This requires a documented balancing test. In addition, works agreements can serve as a collective agreement under Art. 88 GDPR, provided they include the safeguards specified therein. Consent, by contrast, rarely holds up in an employment relationship because it must be freely given and employees depend on the employer. For health data and other special categories, the stricter rules of Art. 9 GDPR additionally apply. A dedicated Employee Data Protection Act has not been passed as of October 2026. You should therefore document in writing for each AI feature what purpose it serves and which legal basis you rely on. ## Data processing agreement: the DPA under Art. 28 GDPR If an AI provider processes data on your behalf, they act as a processor. In this case, you require an agreement under Art. 28 GDPR. Among other things, it governs: * the subject matter, duration, nature, and purpose of processing, as well as the types of data * the binding nature of your instructions and confidentiality * the technical and organisational measures pursuant to Art. 32 GDPR * the engagement of further sub-processors only with your authorisation * assistance with data subject rights and the data protection impact assessment * erasure or return of the data after the end of the contract With AI, an additional point emerges: the DSK recommends checking whether inputs and outputs are used to train models, and ruling this out wherever possible. Furthermore, request a complete list of sub-processors including their locations, including the provider whose language model is being used. ## Third-country transfers: AI services from the US If personal data is transferred to a country outside the EU and the EEA, the rules for third-country transfers in Chapter V of the GDPR (Art. 44 et seq.) apply. This also covers remote access, such as support provided from a third country. For the US, the adequacy decision regarding the EU-US Data Privacy Framework of 10 July 2023 (Implementing Decision (EU) 2023/1795) applies. It allows transfers to US companies certified under the framework. The status as of 23 October 2026: * The General Court of the EU dismissed the action against the decision on 3 September 2025 (T-553/23, Latombe). * An appeal against this judgment is pending before the Court of Justice of the European Union (C-703/25 P). A ruling has not yet been delivered. * On 29 June 2026, the US Supreme Court ruled that members of the Federal Trade Commission can be removed by the President at any time (Trump v. Slaughter). Their independence was a foundational element of the framework. The adequacy decision remains in force, but specialist law firms advise taking precautionary measures. In practice, this means: verify whether a US recipient is certified, and additionally agree Standard Contractual Clauses as a fallback. If the AI operates without US services, this issue does not arise in this form. ## Data Protection Impact Assessment (DPIA) If processing is likely to result in a high risk to the rights and freedoms of individuals, Art. 35 GDPR requires a data protection impact assessment beforehand. The mandatory list issued by the German supervisory authorities explicitly mentions the use of artificial intelligence to assess personal aspects. For AI-supported applicant screening, a DPIA is therefore regularly necessary. The DSK also notes more generally that a DPIA will frequently be required when deploying AI. For the DPIA, you need details from the provider regarding the system’s operation, data categories, and limitations. Ensure already during the vendor selection stage that they can provide this documentation. A fundamental rights impact assessment under Art. 27 of the AI Act, by contrast, applies to public authorities and specific cases, not to the typical private-sector employer. ## Art. 22 GDPR: A human must truly decide Under Art. 22 GDPR, individuals must not be subject to a decision based solely on automated processing that produces legal effects concerning them or similarly significantly affects them. A rejection of a job application falls into this category. The CJEU interprets this prohibition broadly (SCHUFA judgment of 7 December 2023, C-634/21): even a score can constitute an automated decision if it is decisive for the subsequent decision. The DSK cites an example from recruiting: if an AI evaluates all applications and independently sends out interview invitations, this violates Art. 22 para. 1 GDPR. Merely token human involvement is insufficient. The human needs genuine discretion, and time pressure must not lead to outputs being adopted without verification. Furthermore, data subjects can demand an intelligible explanation of the procedure actually applied (CJEU, 27 February 2025, C-203/22). Comprehensible justifications are therefore a prerequisite for fulfilling access requests. ## AI Act and works council: what also applies Alongside the GDPR, the EU AI Act (Regulation (EU) 2024/1689) applies. Since 2 August 2026, AI systems interacting with humans must be identifiable as such (Art. 50). AI used for recruitment and selection is classified as a high-risk system (Annex III No. 4). The obligations for employers as deployers (Art. 26) apply under the AI Omnibus from 2 December 2027, including human oversight, logs kept for at least six months, and prior notification of worker representatives and employees. Read more in our guide [AI Act in HR](/en/hr-software/eu-ai-act-hr). The works council has codetermination rights regarding technical systems designed to monitor employee conduct or performance (§ 87 Abs. 1 Nr. 6 BetrVG \[Works Constitution Act\]). A works agreement on AI can simultaneously serve as a legal basis under Art. 88 GDPR. Details can be found in the guide [Works Council and AI](/en/hr-software/betriebsrat-ki). ## AI hosting in Germany: what the server location provides Operation in Germany or the EU simplifies many matters, as questions regarding third-country transfers are eliminated or reduced. However, server location replaces neither the legal basis nor the DPA, DPIA, or human decision-making. It is essential that the location covers the entire chain. Inquire in writing: * Where is the data stored, and where are backups kept? * Where does the language model compute, meaning where are your inputs processed? * From where do support and engineering access the systems? * Which sub-processors are involved, and to which corporate group do they belong? An on-premises installation provides the greatest level of control, but requires dedicated internal IT capacity for operations, updates, and backups. How to govern AI across your organisation as a whole is detailed in our consultancy on [AI strategy](/en/it-beratung/it-strategie-und-steuerung/ki-strategie). For specific advice regarding job applications, see our page on [Applicant Data and the GDPR](/en/hr-beratung/recruiting/bewerberdaten-dsgvo). ## Checklist: Criteria for vendor selection 1. Purpose and legal basis are documented in writing for each AI feature. 2. A DPA pursuant to Art. 28 GDPR is in place, including a list of all sub-processors and locations. 3. The provider warrants that your data will not be used to train third-party models. 4. The location applies to storage, the model, backups, and support. 5. Roles and permissions are verified server-side; login supports two-factor authentication. 6. Audit trails document who saw or modified what and when; for AI, this includes inputs, outputs, and human decisions. 7. Retention schedules are enforced automatically; data subject access and export are supported per individual (Art. 15 and 20 GDPR). 8. The AI only provides suggestions. Rejections and eliminations are never performed automatically. 9. The provider supplies documentation for the DPIA and works council, such as instructions for use and informational notices. 10. AI-generated outputs are clearly labelled as such. ## How the techport HR Suite supports you The techport HR Suite does not relieve you of your responsibility as an employer. It delivers concrete measures for your documentation and alignment with the works council. **Hosted on servers in Germany, optionally available as an on-premises installation in your own infrastructure.** The language model for AI applicant scoring runs on the installation’s own servers; CVs are never sent to external AI services. The AI in [Company Knowledge](/en/hr-software/wissensmanagement-software) operates in data centres in Germany or the EU, and your content is not used to train third-party models. **Data protection in daily operations:** * Roles and permissions per module, validated server-side, two-factor authentication * comprehensive audit log (who, what, when, before and after) and an access log per document in the [digital personnel file](/en/hr-software/digitale-personalakte) * retention and erasure schedules with automatic deletion, data access and export per person * encrypted, automated backups * data processing agreement under Art. 28 GDPR **Engineered for the requirements of the EU AI Act:** In AI applicant screening, identifying personal attributes such as name, date of birth, nationality, and photograph are stripped prior to evaluation. Criteria are vetted in accordance with the AGG (General Equal Treatment Act) and published as an immutable version. The AI suggests, a human decides. The system never dispatches rejections automatically. Every AI request and every human action is logged. This includes instructions for use and an “Information for Applicants” template. Responses in Company Knowledge are marked as AI-generated. In our assessment, AI applicant screening represents a high-risk AI system under Annex III No. 4 of the AI Act. We are preparing conformity assessment for 2 December 2027. For an overview of all modules, visit the [techport HR Suite](/en/hr-software) page. ## Let us evaluate your AI deployment together In the demo, we show how roles, audit logs, retention schedules, and AI features of the techport HR Suite work together. Pricing is provided upon request, depending on headcount and modules. [Request demo](/en/kontakt?thema=hr-suite)[Request pricing](/en/kontakt?thema=hr-suite) ## Frequently asked questions What is GDPR-compliant AI? GDPR-compliant AI is not a product feature, but a deployment that complies with the rules of the GDPR. This includes a defined purpose, a legal basis, a DPA with the provider, a data protection impact assessment where required, and genuine human decision-making. The provider establishes the technical prerequisites, but the company remains responsible. Are employees allowed to use publicly available AI chatbots for HR data? HR data does not belong in publicly available AI chatbots without an enterprise contract with the provider. These generally lack a DPA, clarity regarding training on inputs, and safeguards regarding third-country transfers. The DSK recommends corporate accounts, acceptable use policies, and closed systems where control over inputs and outputs remains with the company. Is a data protection impact assessment needed for AI in recruiting? Yes, a data protection impact assessment is regularly required for AI-supported candidate screening. The mandatory list of the German supervisory authorities explicitly mentions AI for assessing personal aspects. Plan for the DPIA before launch and request documentation from the provider regarding system functionality, data categories, and system limitations. Is a server in Germany sufficient for GDPR-compliant AI? No, a server in Germany alone is not sufficient. It simplifies questions regarding third-country transfers, but replaces neither the legal basis nor the DPA, data protection impact assessment, or human decision-making. Furthermore, check whether the location applies across the entire chain: storage, language model, backups, support, and sub-processors. Is the EU-US Data Privacy Framework still valid? Yes, the adequacy decision of 10 July 2023 remains valid (as of 23 October 2026). The General Court of the EU dismissed a challenge in September 2025, and an appeal before the CJEU is currently pending. Following a US Supreme Court ruling in June 2026, specialist law firms advise additionally concluding Standard Contractual Clauses as a fallback. What applies to data protection in the digital personnel file? The same principles apply to the digital personnel file as to paper records: only necessary data may be included, access must be restricted to authorised personnel, and employees have a right of inspection (§ 83 BetrVG). In digital form, roles, audit logs, and retention schedules are added, which can be technically enforced and demonstrated. ## Sources * Verordnung (EU) 2016/679 (DSGVO), Art. 6, 9, 22, 28, 32, 35, 42, 44 ff., 88: [https://eur-lex.europa.eu/eli/reg/2016/679/oj](https://eur-lex.europa.eu/eli/reg/2016/679/oj) (abgerufen 23.10.2026) * § 26 BDSG: [https://www.gesetze-im-internet.de/bdsg\_2018/\_\_26.html](https://www.gesetze-im-internet.de/bdsg_2018/__26.html) (abgerufen 23.10.2026) * EuGH, Urteil vom 30.3.2023, C-34/21: [https://curia.europa.eu/juris/liste.jsf?language=de&num=C-34/21](https://curia.europa.eu/juris/liste.jsf?language=de&num=C-34/21) * EuGH, Urteil vom 7.12.2023, C-634/21 (SCHUFA): [https://curia.europa.eu/juris/liste.jsf?language=de&num=C-634/21](https://curia.europa.eu/juris/liste.jsf?language=de&num=C-634/21) * EuGH, Urteil vom 27.2.2025, C-203/22, Pressemitteilung: [https://curia.europa.eu/jcms/upload/docs/application/pdf/2025-02/cp250022en.pdf](https://curia.europa.eu/jcms/upload/docs/application/pdf/2025-02/cp250022en.pdf) * Durchführungsbeschluss (EU) 2023/1795 (EU-US Data Privacy Framework): [https://eur-lex.europa.eu/eli/dec\_impl/2023/1795/oj](https://eur-lex.europa.eu/eli/dec_impl/2023/1795/oj) * Gericht der EU, Pressemitteilung 106/25 vom 3.9.2025 zu T-553/23: [https://curia.europa.eu/site/upload/docs/application/pdf/2025-09/cp250106de.pdf](https://curia.europa.eu/site/upload/docs/application/pdf/2025-09/cp250106de.pdf) * EuGH, Rechtssache C-703/25 P (Rechtsmittel Latombe): [https://curia.europa.eu/juris/liste.jsf?language=de&num=C-703/25](https://curia.europa.eu/juris/liste.jsf?language=de&num=C-703/25) (abgerufen 23.10.2026) * Faegre Drinker, „Trump v. Slaughter: Implications … for EU-US Data Transfers and the Data Privacy Framework“, 17.9.2026: [https://www.faegredrinker.com/en/insights/publications/2026/9/trump-v-slaughter-implications-of-the-us-supreme-court-ruling-for-eu-us-data-transfers-and-the-data-privacy-framework](https://www.faegredrinker.com/en/insights/publications/2026/9/trump-v-slaughter-implications-of-the-us-supreme-court-ruling-for-eu-us-data-transfers-and-the-data-privacy-framework) * DSK, Orientierungshilfe „Künstliche Intelligenz und Datenschutz“, 6.5.2024: [https://www.datenschutzkonferenz-online.de/media/oh/20240506\_DSK\_Orientierungshilfe\_KI\_und\_Datenschutz.pdf](https://www.datenschutzkonferenz-online.de/media/oh/20240506_DSK_Orientierungshilfe_KI_und_Datenschutz.pdf) * DSK, Orientierungshilfe zu technischen und organisatorischen Maßnahmen bei KI-Systemen, Juni 2025: [https://www.datenschutzkonferenz-online.de/media/oh/DSK-OH\_KI-Systeme.pdf](https://www.datenschutzkonferenz-online.de/media/oh/DSK-OH_KI-Systeme.pdf) * DSK, Liste der Verarbeitungstätigkeiten, für die eine DSFA durchzuführen ist (Muss-Liste), Version 1.1: [https://www.datenschutzkonferenz-online.de/media/ah/20181017\_ah\_DSK\_DSFA\_Muss-Liste\_Version\_1.1\_Deutsch.pdf](https://www.datenschutzkonferenz-online.de/media/ah/20181017_ah_DSK_DSFA_Muss-Liste_Version_1.1_Deutsch.pdf) * Verordnung (EU) 2024/1689 (KI-Verordnung): [https://eur-lex.europa.eu/eli/reg/2024/1689/oj](https://eur-lex.europa.eu/eli/reg/2024/1689/oj) * Verordnung (EU) 2026/1744 (KI-Omnibus): [https://eur-lex.europa.eu/eli/reg/2026/1744/oj](https://eur-lex.europa.eu/eli/reg/2026/1744/oj) * § 87 BetrVG: [https://www.gesetze-im-internet.de/betrvg/\_\_87.html](https://www.gesetze-im-internet.de/betrvg/__87.html) * § 83 BetrVG: [https://www.gesetze-im-internet.de/betrvg/\_\_83.html](https://www.gesetze-im-internet.de/betrvg/__83.html) ## Further reading [techport HR Suite HR Software HR software with personnel administration, recruiting, AI candidate evaluation and company knowledge on one platform. Hosted in Germany. Request a demo now. ](/en/hr-software)[techport HR Suite Digital Personnel File Digital personnel file with master data, contracts and documents, role-based permissions and access logging. Part of the techport HR Suite. Request a demo now. ](/en/hr-software/digitale-personalakte)[techport HR Suite Leave Management Leave management with requests, remaining leave, team calendar, and sickness notifications. Managers approve in the browser, HR keeps track. Request a demo. ](/en/hr-software/abwesenheitsverwaltung)[techport HR Suite Onboarding and Offboarding Onboarding software starting right from offer acceptance: personnel files and tasks for HR, IT, and managers are created automatically. Including offboarding. Request demo. ](/en/hr-software/onboarding) More from techport.ai [ Software Custom process software for mid-sized companies. ](/en/loesungen)[ IT consulting Strategy, architecture, operations and security. ](/en/it-beratung)[ IT maturity check Ten minutes to a clear position. ](/en/it-beratung/reifegrad-check)[ HR maturity check 24 statements, a result per field. ](/en/hr-beratung/reifegrad-check)[ Funding BAFA grant plus more than 50 programmes for delivery. ](/en/foerderung)[ Process in practice How workflows become reliable software. ](/en/sop-praxis)[ Data and AI Analysis, forecasts and assistance systems. ](/en/daten-ki)[ About us The people behind techport.ai. ](/en/ueber-uns)