Is Using AI to Assess Employee Performance Lawful?

⏱️ Reading time: 14 min · 📁 Category: KVKK & Digital Compliance

Is AI Use for Employee Performance and Personnel Data Lawful? (File Submission, Analysis, Retention, Profiling and KVKK Risks – 2026)

HR teams now commonly analyse employee performance reports with AI,
upload CVs, performance records and feedback files, ask whether an employee poses a risk, and
some tools retain the data in their own systems.
From a KVKK perspective, the real risk begins with these practices.

🔑 Basic principle: The KVKK risk comes from the data given to AI and where it goes rather than AI use itself.
The KVKK question is: Where did the data go, who accessed it, how long was it retained and for what purpose was it used? 1️⃣ What is a personnel file under KVKK?

A personnel file typically contains:

• Identity information, contact information
• CV and education/certification records
• Performance assessment forms
• Manager comments and feedback notes
• Disciplinary proceedings and reports
• Absences, targets and bonus information

All of these constitute personal data.
Performance, disciplinary and behavioural records are usually considered high-risk datasets
because they can directly affect a person’s working life and financial future.

2️⃣ Risk map: file submission → analysis → retention → profiling → decision

In AI use, the risk usually grows in this chain:

1. Submitting the file to AI (uploading PDF, Excel or Word files; copying text)
2. Analysis or interpretation (summary, commentary, risk detection, potential assessment)
3. Recording or retention (does the tool retain the data?)
4. Profiling or scoring (score, segment, risky or high-potential label)
5. Influence on decisions (use in promotion, bonus or dismissal processes)

📌 Audit red flag: When steps 3, 4 and 5—retention, profiling and influence on decisions—come into play,
the compliance burden and need for evidence grow sharply. 3️⃣ Scenario 1: uploading an employee performance file to an AI tool

Example: An HR specialist combined an employee’s performance form, manager comments and target tables into one PDF.
The specialist uploaded it to the AI tool and asked:
What is this employee’s performance level and promotion potential?

Criteria	Evaluation
Is there any personal data?	✅
Is there analysis/interpretation?	✅
Is there profiling or classification?	✅
Could the individual suffer adverse consequences?	✅

This is a high-risk data processing activity because AI is likely to use performance data to
generate interpretations that influence decisions.

Three factors that increase risk:

• Uploading the entire file without data minimisation
• Using the output in promotion, bonus or dismissal decisions
• The tool’s overseas infrastructure or unclear retention policy

4️⃣ Scenario 2: the AI tool retains data in its own systems

Example: The AI tool’s terms say that submitted data may be retained to improve the service.
HR uploads performance data and the tool may keep it in its own environment.

This goes beyond analysis and creates a risk of retention and possible reuse.
The critical KVKK question is whether retention periods, access rights and purposes of use can be controlled.

📌 Key point: Personnel data may have left the employer’s control.
Uncontrolled retention creates serious risks for purpose limitation and data security. 5️⃣ Scenario 3: AI generates a performance score that enters decision-making

Example output: This employee has low performance, poses a risk and lacks motivation.
This output is used to assess promotions or bonuses, or in dismissal proceedings.

In practice, this constitutes profiling and automated assessment.
Risk peaks if the output stops being a recommendation and becomes the decision.

The critical audit question is: How was this score generated, what data was used, how is an incorrect score corrected,
what mechanism applies when the employee objects, and is there human review? 6️⃣ Scenario 4: a file believed to be anonymised (indirect identification risk)

Example: HR removed names, but the file still contains position, department, seniority, performance notes and descriptions of specific events.
With this information in a small team, the person can be indirectly identified.

⚠️ Fact: If a person can be identified indirectly, the data is still personal data.
Especially in small teams, "anonymization" often fails. 7️⃣ Scenario 5: AI recommends; a human decides (a more defensible model)

Example: AI recommends training X for this employee.
The manager or HR committee makes the final assessment; the AI score is not used alone, and the employee is informed about the process.

This model is more defensible through a human-in-the-loop approach.
Data minimisation, security, retention and transfers still need to be managed.

8️⃣ When is explicit consent needed for personnel data?

Explicit consent may not always provide a sound basis because its freely given nature is disputed in the employee–employer relationship.
Nevertheless, the following situations may require explicit consent and, at a minimum, a very rigorous legal analysis is required:

• If performance data is systematically subjected to AI analysis
• If AI produces interpretations, profiles or risk inferences
• If the AI tool is storing data
• If a transfer abroad is possible

❌ False assumptions:

• It is in the employment contract → this alone is insufficient
• Employer authority does not permit unlimited data processing.

9️⃣ Data transfers abroad (the most dangerous point)

Many AI tools run cloud-based and their infrastructure can be located abroad.
Uploading a personnel file to an AI tool may create a risk of cross-border data transfer.

• To which countries does the data go?
• Is there a chain of subprocessors?
• What is the retention period?
• How are access rights and logs maintained?

Practical warning: Calling it internal company use does not remove transfer risks when data goes to cloud services. 🔟 The Board’s approach (2026 perspective)

Principles that stand out in the audit perspective:

• The employee–employer relationship is unequal; freely given consent is always open to question.
• Constant monitoring and scoring are approached with caution
• AI cannot be a black box; the process must be auditable
• The data controller—the employer—cannot delegate responsibility.

1️⃣1️⃣ Clear red lines for HR

• ❌ Uploading personnel files to uncontrolled AI tools
• ❌ Allowing retention or reuse without contracts and controls
• ❌ Using automated scores alone as the decision
• ❌ Not informing the employee (no transparency)
• ❌ Ignoring data transfers abroad

1️⃣2️⃣ Building a safer model: operational overview

• Minimisation: Only fields needed for the purpose, rather than the whole file.
• Masking: Remove direct and indirect identifiers.
• Retention controls: No tool-side retention, or strict contractual limits.
• Human approval: AI only recommends; a person decides.
• Transparency: Give employees privacy information and explain the process.
• Transfer controls: Technical and contractual controls for cloud and overseas risks.
• Logging: Who processed what data, for what purpose, when? (proof for audit)

🧠 Expert conclusion

AI can support employee performance, but the employee's fate cannot be left to AI.
Providing personnel files to AI may be possible in limited arrangements, but is high-risk in most practical cases
and poor implementation may directly breach KVKK.

Get an HR AI use policy and KVKK risk map