Field note
AI HR Data Boundaries for Chatbots
Split general policy help from case-level employee data and keep sensitive decisions out of an unreviewed chat path.
Split general policy help from case-level employee data and keep sensitive decisions out of an unreviewed chat path.
What the risk is
An HR chatbot usually starts as a way to stop the same twenty questions reaching the HR inbox: holiday entitlement, the expenses process, how to book parental leave. That is a good use. The risk appears when the same bot is connected to the HR system so it can answer "how many sick days have I had?" or, worse, so a manager can ask "who on my team has been off most this year?"
At that point the bot is handling health data, which UK GDPR treats as special category data. It may also be handling pay, performance ratings, grievance records and recruitment notes. Each has a narrower lawful purpose than "helping staff", each is visible to a smaller set of people, and each has its own retention period. A chat interface flattens all of that into one text box.
A realistic example
A 60-person logistics firm in the Midlands rolls out an HR assistant inside Microsoft Teams. It answers policy questions from the handbook and it is connected to the HR platform so employees can check their own leave balance. Six months later, a team leader asks it to "summarise absence patterns for the depot" and gets a table naming individuals and the reasons recorded, including a mental health referral.
Nobody intended that. The bot had the HR platform's service account, which could read everything. The purpose limit, role access and retention rules that existed in the HR platform were bypassed by a connector nobody had scoped.
Controls that work
Separate the two jobs. Run general policy help against the handbook and published policies only. Run anything that touches an individual's record as a separate, authenticated path with its own access rules. Do not let one prompt bridge the two.
Scope the connector to the person asking. If employees can query their own data, the bot must act with that employee's identity, not a service account. A manager sees only what the HR platform would show them on screen, and nothing more because the bot is "helpful".
Keep special category data out of free-form answers. Health, disability, trade union membership, ethnicity and similar fields should not be summarised, compared or inferred by the bot. If a question requires that data, route it to HR.
No decisions in chat. Whether someone is entitled to sick pay, whether a flexible-working request is approved, or whether a probation period is extended are decisions. The bot can explain the process and prepare the form. A person decides, and the decision is recorded in the HR system, not in a chat log.
Set retention for the chat itself. Conversations about pay or health are HR records once they exist. Decide where transcripts are stored, who can read them, and when they are deleted. Vendor defaults are rarely right for HR data. Check the admin settings for the product you use and, at the time of writing, confirm whether prompts are used for model training and whether that can be disabled for your workspace.
Log and review access. Weekly for the first quarter, review what employee-level data the bot returned and to whom. This is the check that would have caught the depot example within days.
Recruitment is a separate case
Screening CVs, ranking candidates and generating interview questions bring in fairness and automated-decision rules on top of data protection. Do not bolt recruitment onto the HR helpdesk bot. The AI recruitment safeguards for UK employers note covers that ground on its own.
What to write into policy
Add a short section to the data protection policy or the AI acceptable-use policy:
- The HR assistant answers policy questions from named approved sources.
- Employee-record access is on the employee's own identity, and managers see only what they can already see in the HR system.
- Health and other special category data are not processed by the assistant except to route the query to HR.
- Employment decisions are not made or communicated by the assistant.
- Transcripts are HR records with a defined retention period and access list.
- A named HR owner and a named IT owner review access logs monthly.
Complete a data protection impact assessment before connecting any employee records. The ICO's employment guidance sets out the expectations and the HR AI workflow page shows how we scope a first HR assistant so the boundaries are set before the first question is asked.