AI in HR (France): What the CNIL Says About Employee Data

The answer fits in one line. AI can help you structure and rewrite, but do not hand it the raw data of your employees and candidates. A CV. A payslip. An annual review. Pasted into a consumer AI, these documents leave your HR system. Yet France's CNIL regulates HR data closely. And screening candidates with an automated tool touches a specific right: the automated decision. Good news: AI is not banned in HR. It requires a legal basis, informing people, keeping a human in the loop, and anonymising before any prompt.

The problem: HR pastes employee data into the AI

The gesture is ordinary. To sort a stack of applications, you paste CVs into an AI. To summarise a round of interviews, you give it the notes. To draft a letter, you add a payslip. HR saves time. But every document sent contains personal data of employees or candidates. A consumer AI is a third-party service. What you paste there can be retained, reviewed or reused to train the model.

An HR file concentrates exactly the data the CNIL watches. Here is what a poorly prepared prompt can expose.

• The name and contact details of a candidate or an employee.
• Pay elements: salary, bonuses, payslip.
• Reviews, interview reports, appraisals.
• Health data (a special category under the GDPR), for example in a sick note or a file.

This data is not trivial. The CNIL, France's data protection authority, has published a dedicated framework for human resources and recruitment. It sets clear principles: a legal basis for each processing, proportionality, informing people, and data minimisation. Minimisation means one simple thing: collect and process only what is necessary.

The stake: the CNIL regulates HR data closely

The CNIL also sets retention benchmarks. They are concrete. The data of a candidate who was not hired should not be kept beyond two years after the last contact, unless a deletion is requested. After an employee leaves, some data is archived to meet legal obligations, such as payslips. These benchmarks come from the CNIL's HR framework. They show one thing: HR data has a bounded lifespan, not an unlimited existence in a chat.

The stake rises with automated screening. The GDPR, in Article 22, grants a specific right. Everyone can refuse to be subject to a decision based solely on automated processing, including profiling. This right applies where the decision produces a legal effect or significantly affects them. Rejecting an application targets exactly this case. Profiling is defined by the GDPR in Article 4: automated processing that evaluates aspects of a person, such as their performance at work or their behaviour. Using an AI to rank candidates falls squarely within that definition.

One point reassures, provided you respect it. Even when an exception to Article 22 applies (contract, law, or explicit consent), the person keeps rights. They can obtain human intervention, express their view and contest the decision. In other words, a human must remain the decision-maker. Decision support screened by a real human eye falls, in principle, outside the strict scope of the ban. An AI deciding on its own does not.

Who is responsible? HR, not the AI

Responsibility cannot be delegated to the tool. The employer, HR team or recruitment agency, acts as the data controller. It defines the purposes and the means. It answers for compliance, including when the processing runs through a third-party AI. The AI provider remains a third party. Hence the value of reducing what leaves your machine before you even send.

Health data deserves separate care. A sick note, a medical mention in a file: these are sensitive data. The GDPR, in Article 9, bans their processing in principle, save strict exceptions. Exposing them to an external AI is therefore to be avoided.

The fix: anonymise before the prompt, keep the human

Good news: AI is still useful to the HR team. It helps structure a grid, rewrite a job ad, summarise an interview outline. For that, it needs no real name. Work on anonymised data. Keep identities, pay figures and sensitive elements out of the prompt. And let a human decide every choice that concerns a person.

When you must describe a concrete case, anonymise it first. Replace each identifying element with a token. The AI reasons about the shape of a CV or a file, without ever seeing the real values. You then restore the real data, locally. Identities never leave your machine. Anonymising supports minimisation, a principle stressed by the CNIL. One caution, though: this care reduces the risk. It does not on its own make your processing GDPR-compliant. And it removes neither the legal basis, nor the duty to inform people, nor the human in the decision.

1. 1Spot the identifying elements: names, contact details, pay, health mentions.
2. 2Replace them with reversible tokens, in the browser.
3. 3Send only the anonymised text to the AI.
4. 4Restore the real values locally, then have a human validate every decision.

That's what ONYRI Sanitize is for. The engine detects sensitive data — names, contact details, salaries, health mentions — and replaces it with reversible tokens before sending. Detection and the mapping stay in your browser. Only anonymised text reaches the model. The AI finds only tokens, never your candidates' identity nor your employees' pay. You get AI's help, supporting the minimisation the CNIL expects, while keeping the human at the heart of the decision.