GDPR and IMY: employee data in AI projects
5 min readPublished 2026-11-11Last reviewed 2026-11-11
Short answer
Employee data in AI projects needs a clear legal basis, purpose limitation and data minimisation under GDPR, which IMY supervises in Sweden. Consent rarely works between employer and employee, so most projects rely on legitimate interest or legal obligation. High-risk processing such as profiling or monitoring usually requires a data protection impact assessment (DPIA) before you start.
- A legal basis for each purpose, rarely consent in employment
- Data minimisation: only the fields the model needs
- A DPIA for profiling, monitoring or new technology at scale
- Transparency: tell employees what is processed and why
- Special care with health data such as sick leave
Can you use employee data for AI under GDPR? Yes, with the right legal basis and safeguards.
Key requirements
Empley builds HR data foundations in the client's own environment, with the DPIA prepared alongside the design.
Evidence
- Our assessment
Requirements summarised from public legal sources; not legal advice.
Common questions
- Can employees consent to AI analysis?
- Consent is seldom valid in employment because of the power imbalance. Use another legal basis.
- Who supervises GDPR in Sweden?
- Integritetsskyddsmyndigheten (IMY).