GDPR and AI in HR: what changed in 2026, and seven questions before an agent touches employee data

An employee file is some of the most sensitive data a business holds, and 2026 is the year employers started pointing AI at it. The law moved in the same year. This is a summary of what changed for UK employers and what to ask before any AI tool or agent reads your people data. It is not legal advice.

What changed in 2026

Automated decisions: the rules were rewritten

On 5 February 2026 the main data protection reforms in the Data (Use and Access) Act 2025 came into force. The old Article 22 of the UK GDPR was replaced. A decision made solely by automated means that has a significant effect on someone, which plainly includes whether they get a job, is now permitted more widely than before, but only with safeguards. The person must be told, must be able to make representations, must be able to get a human to look at it and must be able to contest it. Tighter restrictions remain where special category data is used. The ICO’s summary for organisations sets out the changes.

The safest reading for an employer is the simplest one: do not let software make the decision. If a person genuinely decides, with the reasoning in front of them, you are not relying on those provisions at all.

Subject access requests

The law now says in terms that you must carry out a reasonable and proportionate search. The clock can also be paused while you wait for the person to clarify their request or confirm who they are. The deadline is still one month.

A complaints procedure is now a duty

Since 19 June 2026 every controller must make it possible for people to complain about how their data is handled, acknowledge a complaint within 30 days and respond without undue delay. There is no exemption for small businesses. If an employee asked you today how to complain, could you point to a form?

The ICO looked at AI in hiring

In March 2026 the ICO published its findings on automated decisions in recruitment, with draft guidance on automated decision-making. Its expectations of employers are short: monitor for bias, be open with candidates about what the tool does, and give them a route to challenge an outcome and get a human review. Final guidance is still to come.

The EU AI Act deadline moved

If you recruit or employ people in the EU: the obligations for high-risk AI systems, which include AI used in employment and recruitment, were postponed from August 2026 to 2 December 2027.

Seven questions before an agent touches employee data

1. What can it see?

The whole database, or only what the person asking is allowed to open? An agent should inherit the permissions of its user.

2. Does it decide, or does it prepare?

Ask for the list of actions it can take without a person. For hiring, pay and dismissal that list should be empty.

3. Can it show its reasoning?

If a candidate asks why they were not shortlisted, you need an answer in a sentence. “The model scored them low” is not one.

4. Where is the data processed?

Which country, which provider, under what agreement.

5. Is our data used to train a model?

For employee data the answer you want is no, in writing.

6. Is there a log?

Every question, action and approval, with who and when. This is your evidence when someone complains or the ICO asks.

7. What happens to the data when someone leaves, or is not hired?

Retention applies to what the AI tool holds as well as to the file.

What you should tell your people

Update the privacy notice to say that AI tools help prepare HR and payroll work, what they do and that a person makes the decisions. Tell candidates the same in the advert or the application form. It takes a paragraph, and it is the thing the ICO asked for first.

How roothr.ai answers the seven

Agents read only what the person asking can see. Nothing is sent, paid, offered or deleted without a named person approving. Answers show the records they came from. Processing is in the UK and your data is not used to train third-party models. Every action is in the audit log. The GDPR agent applies your retention schedule, gathers the records for a subject access request and tracks the deadline, and the recruitment agent shows why it ranked each applicant where it did.