GDPR and AI Interviews: What HR Teams Need to Know Before Getting Started

Employee data is among the most sensitive data a company processes. When employees share their experiences in a conversation — about leadership, team dynamics, personal pressures — the data generated goes far beyond what a classic survey collects.

The potential for AI to help conduct and analyze these conversations is significant. But so are the data protection requirements. This article explains what HR teams and data protection officers need to concretely check before deploying an AI tool for employee conversations.

Which Legal Basis Applies?

Under the GDPR, every processing of personal data requires a legal basis. For employee surveys, two are relevant:

Art. 6(1)(b) — Performance of a contract Where the survey takes place in the context of the employment relationship and data collection is necessary for the performance of the contract. This applies, for example, to structured feedback conversations that are part of the employment relationship.

Art. 6(1)(a) — Consent Where participation is voluntary. Particular care is required here: in an employment relationship, genuine voluntariness is difficult to demonstrate, because the power imbalance between employer and employee is structurally present. Consent must be informed, unambiguous, and refusable without disadvantage.

What this means in practice: For anonymized or confidentially handled surveys — where participants cannot be identified — consent is generally the right basis. Important: consent must be obtained before data collection, not after.

The Problem with US Cloud Providers

Many AI tools for interviews and surveys originate in the United States. That's not a trivial matter under data protection law.

The CLOUD Act (Clarifying Lawful Overseas Use of Data Act) requires US companies to hand over data to US authorities on request — even if that data is stored on servers in Europe. This applies to all companies subject to US jurisdiction: including European subsidiaries of American corporations.

Similarly, FISA 702 (Foreign Intelligence Surveillance Act) allows US intelligence services access to communication data held by US providers.

The Schrems II ruling by the Court of Justice of the EU established in 2020 that these access rights are incompatible with European data protection law. The consequence: data transfers to the United States have since only been possible under strict conditions — and remain legally not fully secured.

What this means concretely for HR teams: Deploying a US-based AI tool for employee conversations isn't a formality. It's a conscious risk decision. For many companies — and for works councils — this is not an acceptable basis.

What a DPA Covers — and What It Doesn't

Many SaaS providers offer a Data Processing Agreement (DPA). That's necessary but not sufficient.

A DPA covers:

• How the provider handles the data
• Which sub-processors are used
• How data is deleted
• Which technical and organizational measures are in place

A DPA does not cover:

• Whether the provider must hand over data on order from authorities — especially US authorities
• Whether an EU server location means US jurisdiction doesn't apply

With US providers hosting in the EU: the DPA exists, but the CLOUD Act remains effective. That's not a technicality — it's the legal reality under the current state of affairs.

What EU Hosting Actually Means

"EU hosting" is not a standardized term. It's worth looking closely.

Questions to ask:

• Where is the primary database server? (Region, provider)
• Which sub-processors are used — and where are they incorporated?
• Is data transferred to APIs outside the EU for AI processing?
• Which data leaves the EU — and on what legal basis?

Using Qerie as an example: the database infrastructure runs on Supabase with EU region (Frankfurt). The VPS runs on Netcup in Germany. For AI processing, the Anthropic Claude API is used — Anthropic is a US company, and the transfer is based on EU Standard Contractual Clauses (SCCs). This is transparent and documented.

No system that uses AI APIs is entirely free of US touchpoints — as long as the most capable AI models are operated by US companies. The decisive question isn't whether there's a US touchpoint, but whether it's documented, controllable, and based on a contractual foundation under the GDPR.

What the Works Council Will Examine

When an AI tool is to be deployed for employee conversations, the works council has co-determination rights under § 87(1)(6) BetrVG — technical systems for monitoring the behavior or performance of employees.

This applies not only to classic surveillance software. It applies to all systems that collect data about the behavior or attitudes of employees — including AI-assisted survey tools.

What works councils typically examine:

• Who has access to which data?
• Can participants be identified?
• How long is data stored?
• Where does the data reside?
• Who analyzes it — and according to what criteria?

Good preparation for these questions is not a bureaucratic obstacle. It's proof that the tool has been seriously designed for deployment in a German company.

The Checklist Before Deployment

Before an AI-powered interview tool is used for HR purposes, these points should be clarified:

Legal basis:

• [ ] Legal basis established (Art. 6(1)(b) or (a) GDPR)
• [ ] For consent: consent text formulated, obtained before data collection
• [ ] Processing purpose documented (Records of Processing Activities)

Data protection:

• [ ] DPA concluded with provider
• [ ] Sub-processor list reviewed
• [ ] Server location documented
• [ ] US jurisdiction assessed
• [ ] Data deletion periods established

Organizational:

• [ ] Data protection officer informed / involved
• [ ] Works council informed (§ 87(1)(6) BetrVG)
• [ ] Participant information formulated (what is collected, who has access, how it is deleted)

Why Data Protection Is Not a Disadvantage

It sounds like a bureaucratic hurdle. But for the success of an employee survey, data protection is a prerequisite — not an obstacle.

Employees who don't know what happens with their answers respond differently. They're more cautious, more superficial, less honest. Especially on sensitive topics — leadership behavior, internal conflicts, personal stress — trust is the foundation for qualitatively high-value insights.

A tool that communicates transparently what it does, where the data resides, and how long it is stored generates more trust — and therefore better results. That's not a side effect of data protection. It's its core purpose.

---

Qerie is designed GDPR-natively: EU hosting, transparent sub-processors, automatic data deletion after 30 days, DPA on request. Request early access →