HR teams hold information that employees reasonably expect to be handled carefully: identification records, pay details, performance notes and sometimes medical information. Introducing an AI tool creates a new processing step, and possibly a new provider receiving that information. That change needs a review before staff begin uploading files.
Begin with the intended task. Drafting a general training outline may require no employee information at all. Summarising a specific employee case could involve sensitive context and a significant decision. Treating both tasks as a single permission to “use AI” leaves important questions unanswered.
Map what information would move
List the fields collected, where they are stored, which staff can access them and which provider would receive them. Include attachments, free-text notes, prompts, outputs and saved conversation histories. A workflow may expose more information through a document attachment than through its main form.
Kenya's Data Protection Act provides principles for assessing purpose, necessity, security and retention. Use the applicable requirements to review the actual data flow rather than relying on a provider's general statement that its product is secure.
Reduce the data before testing
Use synthetic records when evaluating a tool. If an analysis needs real operational data, first establish whether aggregate or appropriately anonymised information can answer the question. Removing a name alone may not anonymise a record: a rare job title, location and incident description can still identify the person.
- Remove identity and account details that the task does not need.
- Restrict free-text fields that may contain unnecessary personal information.
- Use the smallest suitable sample for a controlled test.
- Keep any re-identification key separately with limited access.
- Review outputs for information that should not be shared further.
Ask specific questions of the provider
Establish where processing and storage take place, which subcontractors are involved and how retention works. Ask whether submitted content is used to improve models, how access is controlled and what deletion options exist. Review the applicable transfer and processing requirements with the organisation's responsible advisers where needed.
Obtain answers for the exact product and account arrangement being considered. A provider's business service and public consumer tool may operate under different terms. Save the agreed terms and record who reviewed them.
Give staff a usable policy
| Task | Suggested starting control |
|---|---|
| General policy drafting | Use no employee-specific information; review the draft |
| Aggregate workforce analysis | Check whether the data can identify small groups |
| Individual case summaries | Require an approved workflow and restricted access |
| Employment decisions | Review legal requirements and keep accountable decision makers |
Specify permitted tools, prohibited uploads, required approvals and the process for reporting a mistake. Give examples that match staff's day-to-day work. A short policy people can apply is more useful than a broad prohibition that drives the same activity into unapproved personal accounts.
Review the risk before a high-impact use
Assess the effect of an incorrect output, unauthorised disclosure or unexplained recommendation. Determine whether the proposed processing requires a data protection impact assessment and complete the necessary review before launch. Record safeguards, residual concerns and the person authorised to decide whether the use can proceed.
Keep an incident route that includes the provider and the organisation's privacy or security lead. Staff should know how to report an accidental upload promptly, without attempting to conceal it or continuing the affected workflow.
Maintain controls after launch
Review access when staff change roles, check retained exports and revisit provider changes. Test whether deletion and audit functions work as expected. An initial approval should have an owner and a review date; it should not become permanent permission for every future AI feature.
Trinity's HR Advisory and Governance service and AI Workforce Hub can support a discussion about practical HR workflows, accountable review and the controls needed around new technology.
