Data Protection and UK GDPR Foundations

Covering Assessment Criterion 2.2 from FREE08 – People Professionals and Artificial Intelligence (AI), this video addresses the data protection framework that governs AI use in HR contexts. It centres on the UK GDPR and the Data Protection Act 2018, examining how these apply whenever AI tools process personal data belonging to employees or job candidates. The video identifies what qualifies as personal data in HR settings — including performance metrics, attendance records and communication patterns — and explains why the breadth of that definition matters when deploying AI systems that analyse workforce information at scale.

A substantial portion of the video is devoted to the six lawful bases for processing personal data, with particular attention to the three most relevant in HR: legitimate interests, contract performance and consent. The video covers the legitimate interests assessment as a documentary requirement, not merely a conceptual one, and addresses the added legal conditions that apply when AI processes special category data such as health information, ethnicity or trade union membership. Alongside lawful basis, the principles of data minimisation and purpose limitation receive detailed treatment, with the video examining how each principle constrains what data can be fed into AI systems and how it can be used once collected.

The video also examines transparency as a substantive legal obligation under the UK GDPR, including what privacy notices must communicate about AI-assisted decision-making and what individuals are entitled to understand about how their data is processed. For people professionals, the video connects these requirements to practical responsibilities: documenting lawful bases, auditing data collection against the minimisation principle and ensuring that privacy notices reflect actual AI use in plain, accessible language. These topics sit directly within the organisational responsibilities and human oversight themes identified in AC 2.2's indicative content.