Knowledge base · AI in HR

What do we have to tell applicants if we use AI to process their data?

Under the GDPR you tell applicants, among other things, what you use their data for and on what legal basis, and whether automated decision-making takes place, with meaningful information about the logic involved and the envisaged consequences. If you obtain data elsewhere, you also state the source, at the latest within a month or at the first contact.

In force now (since 25 May 2018)Trusq editorial · checked against the official textLast verified: 2 October 2026

Next step: Record your HR AI tools in Trusq

Data the applicant provides themselves

When collecting, you state, among other things, the purposes and the legal basis ^[1]. In addition, you provide further information at the time the data is obtained ^[2], including the existence of automated decision-making as referred to in Article 22, with meaningful information about the logic involved, the significance and the envisaged consequences ^[3].

Data from elsewhere

If you obtain data from, for example, a recruitment platform or a public profile, you also state the source ^[4]. You provide the information within a reasonable period and at the latest within a month, or at the latest at the first contact if you use the data to approach the person ^[5].

Since when

These duties have applied since the GDPR became applicable, on 25 May 2018 ^[6]. From 2 December 2027, for a high-risk system the information duty of the AI Act is added ^[7] ^[8].

What Trusq bases this on

These released rules are in Trusq and are read again with every publication; if a rule changes, this page changes with it.

Informing the people the system is used on AI Act 26

Sources

[1] GDPR Art. 13(1)(c) (General Data Protection Regulation (GDPR), Regulation (EU) 2016/679). When collecting from the data subject, the employer states, among other things, the purposes of the processing and the legal basis.
the purposes of the processing for which the personal data are intended as well as the legal basis for the processing;
Source, retrieved on 2 October 2026.
[2] GDPR Art. 13(2), introductory wording (General Data Protection Regulation (GDPR), Regulation (EU) 2016/679). That further information is provided at the time the data is obtained.
In addition to the information referred to in paragraph 1, the controller shall, at the time when personal data are obtained, provide the data subject with the following further information necessary to ensure fair and transparent processing:
Source, retrieved on 2 October 2026.
[3] GDPR Art. 13(2)(f) (General Data Protection Regulation (GDPR), Regulation (EU) 2016/679). When collecting data from the data subject, the controller states the existence of automated decision-making referred to in Article 22, with meaningful information about the logic involved, the significance and the envisaged consequences.
the existence of automated decision-making, including profiling, referred to in Article 22(1) and (4) and, at least in those cases, meaningful information about the logic involved, as well as the significance and the envisaged consequences of such processing for the data subject.
Source, retrieved on 2 October 2026.
[4] GDPR Art. 14(2)(f) (General Data Protection Regulation (GDPR), Regulation (EU) 2016/679). If the data is not obtained from the data subject, for example from a recruitment platform, the controller also states the source.
from which source the personal data originate, and if applicable, whether it came from publicly accessible sources;
Source, retrieved on 2 October 2026.
[5] GDPR Art. 14(3)(a) and (b) (General Data Protection Regulation (GDPR), Regulation (EU) 2016/679). For data that does not come from the data subject, the information is provided within a reasonable period and at the latest within a month, or at the latest at the first contact if the data is used to communicate with the data subject.
within a reasonable period after obtaining the personal data, but at the latest within one month, having regard to the specific circumstances in which the personal data are processed; (b) if the personal data are to be used for communication with the data subject, at the latest at the time of the first communication to that data subject; or
Source, retrieved on 2 October 2026.
[6] GDPR Art. 99(2) (General Data Protection Regulation (GDPR), Regulation (EU) 2016/679). The GDPR has applied since 25 May 2018.
It shall apply from 25 May 2018.
Source, retrieved on 2 October 2026.
[7] AI Act Art. 26(11) (AI Act, Regulation (EU) 2024/1689). Deployers of an Annex III system that takes or helps to take decisions about natural persons inform those persons that the system is used on them; this is in addition to Article 50.
Without prejudice to Article 50 of this Regulation, deployers of high-risk AI systems referred to in Annex III that make decisions or assist in making decisions related to natural persons shall inform the natural persons that they are subject to the use of the high-risk AI system.
Source, retrieved on 2 October 2026.
[8] Regulation (EU) 2026/1744 Art. 1(40)(b) (replaces AI Act Art. 113, third paragraph, point (c)) (Regulation (EU) 2026/1744 (Digital Omnibus on AI)). The high-risk rules (Chapter III, Sections 1 to 3) apply to Annex III systems from 2 December 2027.
Chapter III, Sections 1, 2, and 3, with the exception of Article 6(5), shall apply from: (i) 2 December 2027 as regards AI systems classified as high-risk pursuant to Article 6(2) and Annex III; and
Source, retrieved on 2 October 2026.

Next step

Register the AI tools you use in HR. Trusq shows per tool which duties may apply and sets them up as actions, with the evidence that is expected and the source.

Record your HR AI tools in Trusq

Looking for a specialist? We will look with you for a suitable specialist; mediation is not guaranteed.

This page gives general information based on the text of the law. It is not legal advice for your situation.