AI in HR Meets Strict Employee Data Protection Law
Recruitment algorithms, AI-supported performance assessments, chatbots for interviews, analysis tools for employee communication: all these systems process personal data of employees – and therefore fall under § 26 BDSG. Pursuant to § 26 Abs. 8 BDSG, the provision expressly applies not only to current employees but also to applicants and to persons whose employment relationship has already ended. Anyone using AI systems in applicant management or personnel development therefore remains within the scope of this provision from the first application right through to long after departure.
Necessity as the Standard – Not Usefulness
§ 26 Abs. 1 BDSG permits processing only where it is necessary for deciding whether to establish, for performing, or for terminating the employment relationship. ‘Necessary’ is a narrow standard here – not every feature bundled with an AI provider’s tool automatically satisfies it.
A typical gap in practice: companies deploy AI recruiting tools that go far beyond the actual suitability assessment – for example, video or voice analysis intended to infer personality traits or emotional states. Such additional evaluations are rarely necessary within the meaning of § 26 Abs. 1 BDSG, even where they appear professionally interesting. Anyone procuring an AI tool should therefore match the functionality actually used against the statutory necessity standard – not against what the tool is technically capable of.
Consent and Special Categories: High Hurdles
Where necessity does not apply, organisations often fall back on consent. § 26 Abs. 2 BDSG makes the hurdles for this clear in an employment context: the dependency inherent in an employment relationship must expressly be taken into account when assessing voluntariness. Valid consent also requires information in text form about the purpose and the right of withdrawal under Art. 7 Abs. 3 GDPR.
The position becomes even stricter for special categories of personal data under Art. 9 Abs. 1 GDPR. § 26 Abs. 3 BDSG permits their processing only where it is necessary to exercise rights or fulfil legal obligations under employment or social security law. AI systems that indirectly infer health status, ethnic origin or similar characteristics from video interviews or behavioural data quickly enter a grey area here – often without provider or user recognising this as processing of special categories at all.
Collective Agreements as Scope for Action – and Obligation
§ 26 Abs. 4 BDSG opens up a distinct route: processing of employee data – including special categories – is also permissible on the basis of collective agreements, with the negotiating parties required to observe Art. 88 Abs. 2 GDPR. In practice, this is often the most robust route for introducing AI systems in HR: a works or service agreement can concretely regulate the purpose, scope and limits of AI use, thereby creating a solid legal basis.
Importantly, § 26 Abs. 6 BDSG makes clear that the participation rights of employee representative bodies remain unaffected. Introducing AI without involving the works council is therefore not only a co-determination risk but can also prevent the data protection safeguard under Abs. 4 from applying. And regardless of the route chosen, § 26 Abs. 5 BDSG obliges the controller to comply with the principles set out in Art. 5 GDPR – such as purpose limitation and data minimisation – for every AI-supported processing operation.
Interface with the EU AI Act: Transparency from 2 August 2026
In parallel with the BDSG, many HR AI systems are subject to the transparency obligations under Art. 50 AI Act. These apply from 2 August 2026, with a grace period until 2 December 2026 for systems already in use beforehand. Affected systems include AI chatbots in application processes or systems with emotion recognition – here the AI Act requires that employees and applicants can recognise that they are interacting with an AI system.
This should be distinguished from the high-risk classification under Annex III AI Act for employment contexts: these obligations have been postponed to 2 December 2027. This, however, changes nothing regarding § 26 BDSG – the data protection requirements on necessity, consent and special categories continue to apply unchanged and independently of the AI Act’s timeline.
If you would like to assess where your organisation stands on AI systems in HR between § 26 BDSG and the forthcoming AI Act obligations, our free risk check at /einstufung offers a first point of orientation.