Guides · HR

HR and AI: CVs, performance reviews and data protection

Gonzalo Sabater, lawyer · 28 October 2026 · 6 minutes

Summarizing CVs, drafting a job ad, preparing a performance review or answering a grievance: AI saves HR a lot of time. But every one of those documents is about an identifiable person, sometimes about very sensitive parts of their life.

This article is general information, not legal advice for a specific case.

What to keep in mind

GDPR

CVs, payroll, sick leave, disciplinary records and appraisals are personal data. Some may be special category data (health, trade union membership; Article 9). Article 22 also restricts decisions based solely on automated processing that produce legal or similarly significant effects.

The EU AI Act

Regulation (EU) 2024/1689 treats AI systems intended for recruitment and selection, such as filtering applications or evaluating candidates, as high-risk (Annex III). Using a general-purpose AI to draft an email is not the same as using it to rank candidates: if the AI influences who moves forward, look at it carefully.

A sensible way to work

1. Use AI for the writing, not the deciding: let it help draft or summarize, and let a person decide about a person.
2. Remove identities before sending: name, ID number, phone, email, address, date of birth, photo.
3. Watch indirect identifiers and anything that could lead to discrimination: age, nationality, health.
4. Leave out health or union data unless strictly necessary and justified.
5. Review the result before using it.

Where Maskwise helps

Maskwise detects names, ID numbers, phone numbers, emails, addresses and dates of birth in CVs and files, scanned ones too, and removes photos with faces from Office documents. The AI works with [PERSON_1]; the link to the real person stays on your Mac.