Employee Data and AI Training: Rules by Jurisdiction

Whether a company may put its employees' emails, chats or HR records into an AI training set depends on where the staff work: EU law layers national employee rules on the GDPR, Switzerland limits staff data to the job, California treats a paid license as a sale, and Canada, China and Türkiye start from consent.

This page compares 19 jurisdictions as of 2026-11-09 for staff data inside AI training data licensing, for licensing to an outside buyer and for training an in-house model.

DataPacts Editorial Team checked every rule here on November 9, 2026; the page on how we source, date and check every figure sets out the rules.

What Decides Whether Staff Data Can Enter an AI Training Set

Four rules decide it in every jurisdiction: the general privacy basis for the new use, any employee-specific statute on top, the say of a works council or union, and whether communications secrecy binds the employer.

• Privacy basis: the GDPR compatibility test for a new purpose (Art. 6(4)).
• Employee-specific statute: Switzerland's Code of Obligations (OR Art. 328b).
• Collective step: German co-determination over monitoring devices (BetrVG § 87(1) Nr. 6).
• Communications secrecy: the German telecom secrecy rule (TDDDG § 3).

The rules stack, so a basis under one does not lift another: the Federal Labour Court (BAG) checked both the works agreement and the GDPR on 2025-05-08.

Employee Data Rules for AI Training in 19 Jurisdictions

The table sets the 19 jurisdictions side by side with the general law, the employee-specific rule, the collective step and their status as of 2026-11-09. "None recorded" means that no employee-specific instrument is held for this page, not that no rule exists.

Three Ways Jurisdictions Regulate Staff Data in Training Sets

The jurisdictions fall into three groups: GDPR plus national employee rules, general law with an employment purpose limit, and consent-led laws.

EU Member States: The GDPR Layer and National Rules Allowed by Article 88

In the EU every disclosure of staff data to an AI buyer needs a GDPR basis and a compatibility test, and Article 88 lets each member state or collective agreement add employee rules with safeguards on transparency, group transfers and monitoring.

The GDPR applies from 2018-05-25. It requires an Art. 6 basis, the Art. 6(4) test for a new purpose, Art. 9 handling of special categories, notices under Arts. 13(3) and 14, usually a DPIA (Art. 35) and a Chapter V transfer tool. The Article 29 Working Party (WP248 rev.01) lists employees as vulnerable data subjects.

The Court of Justice held on 2023-03-30 (C-34/21) that national rules not meeting Art. 88(2) are not "more specific rules" and are disregarded unless they are an Art. 6(3) basis that complies with the GDPR. On 2024-12-19 (C-65/23) it added that Art. 88 rules must also comply with Arts. 5, 6(1) and 9(1)-(2). The BAG then left § 26(1) BDSG unapplied on 2025-05-08, and the full GDPR rules for training data are on the GDPR page.

National rules differ in kind. Italy's Statuto dei lavoratori art. 4(3) allows monitoring data for employment purposes with adequate information, though licensing is not covered on our reading. Portugal (Lei 58/2019 art. 28(6)), Spain (LOPDGDD art. 89) and Poland (Kodeks pracy art. 22³) limit biometrics, sound recording and mailbox disclosure.

Switzerland and the United Kingdom: Purpose Limits Without an Article 88 Layer

Switzerland binds staff data to the job itself, while the UK applies its own GDPR without a recorded employee-specific statute.

Swiss OR Art. 328b, in force since 1993-07-01 and amended in its second sentence on 2023-09-01, allows employer processing only for job suitability or contract performance. Licensing for AI training falls outside that purpose and needs a justification under the DSG.

The UK GDPR as amended by the Data (Use and Access) Act 2025 recognises legitimate interests under Art. 6(1)(ea) only where an Annex 1 condition is met, with ss.67, 70 and 71 in force from 2026-02-05. Section 170 of the Data Protection Act 2018 makes it an offence to obtain or disclose personal data knowingly or recklessly without the controller's consent.

United States: No General Staff-Data Statute, With California as the Exception

US federal law has no general employee-privacy statute for training data, so California's CCPA, which has covered staff data since January 1, 2023, is the main rule.

The employee exemption in Cal. Civ. Code 1798.145(m)(4) is inoperative from that date. Licensing personal information for money is a sale with an opt-out right (1798.120), and de-identified data under 1798.140(m) sit outside it. A risk assessment before selling applies under Cal. Code Regs. tit. 11, 7150 to 7157, from 2026-01-01.

On the federal side, 18 U.S.C. 2702 stops public communication providers from divulging stored content, and internal company systems are generally not such services; see the federal stored-communications rules.

Recordings follow the one-party consent rule in 18 U.S.C. 2511(2)(d), and 2511(1)(c) and (d) make disclosing unlawfully intercepted content a violation.

Canada, China, Japan and Türkiye: Consent-Led General Laws

These four apply general privacy laws to staff data, and each starts from consent or a narrow exception rather than an employee rule.

Canada's PIPEDA (S.C. 2000, c. 5) treats a business transaction as including the licensing of assets in s.2(1), but the s.7.2(4) exception does not apply where the primary purpose or result is the sale or lease of personal information. Québec's Law 25 requires consent per specific purpose and an assessment before communicating information outside Québec, with penalties up to CAD 10,000,000 or 2 % of worldwide turnover under P-39.1 s.90.12 (checked 2026-11-09).

China's PIPL, in force since 2021-11-01, requires notice plus separate consent to provide personal information to another handler, with Art. 66 fines up to CNY 50 million or 5 % of prior-year turnover (checked 2026-11-09). Türkiye's KVKK (Law No. 6698, in force 2016-04-07) makes explicit consent the default, and Japan's APPI amendment, promulgated 2026-07-17, is not in force.

How Strong the Collective Say Is, From Consent to Negotiation

Where a works council or union exists, the law gives it anything from a consent right to a right to negotiate, and most jurisdictions recorded here provide a route out of deadlock.

Austria requires consent under ArbVG § 96(1) Z 3 and § 96a; the conciliation board can replace § 96a consent (§ 96a(2)), which leaves § 96 consent rights untouched (§ 96a(3)). Dutch WOR art. 27(1)(k) and (l) give the works council consent rights, the kantonrechter can decide (art. 27(4)), and application to licensing is untested. German BetrVG § 87(1) Nr. 6 gives co-determination over devices that can monitor staff, and BAG 1 ABR 7/15 (2016-12-13) holds that objective suitability decides, not employer intent. The Einigungsstelle decides without agreement (§ 87(2)). See how a seller runs the notice and works council step.

France gives the CSE information and consultation before the decision (L2312-8 II 4°, L2312-38), never consent. Spanish ET art. 64(4)(d) requires information on algorithms, and Swedish MBL 11 § and 12 § give negotiation, on our analysis.

Does Communications Secrecy Bind an Employer That Licenses Its Archive?

In the jurisdictions recorded here it normally does not, because communications secrecy binds providers of public services, not an employer running internal email or chat.

Germany's TDDDG § 3 (renamed 2024-05-14) binds providers of publicly available or commercially offered telecom services. The Bundesnetzagentur's guidance (July 2025) says employer-employee offers are generally not covered, and the North Rhine-Westphalia authority's 2024 report no longer applies it to employers that allow private use. The GDPR still applies.

Austria's TKG 2021 § 161(2) and 18 U.S.C. 2702 likewise bind only public providers. Read more on private use of work email in Germany.

Training an In-House Model on Staff Data Versus Licensing It Out

Training a company's own model and licensing staff data to an outside buyer are different uses with different tests: in-house use stays with the employer, while a license discloses the data to a new controller.

The BAG ruling 8 AZR 209/21 shows the in-house test. On 2025-05-08 the court held testing Workday with real data justified under Art. 6(1)(f) only where dummy data do not suffice; the works agreement allowed nine data fields, more were uploaded, and it awarded EUR 200 in non-material damages.

Swiss OR Art. 328b limits both uses. The CCPA treats a paid license as a sale, which an in-house model is not, and ET art. 64(4)(d) and BetrVG § 90(1) Nr. 3 cover the use of AI itself.

For the EU, legitimate-interest balancing decides the training question; see the balancing test for training.

Former Staff, Closures and Insolvency: Where the Rules Still Reach

Employee data rules keep applying after people leave and after a company closes, because the data stay personal data of identifiable people.

Under § 26(8) BDSG, applicants and former employees count as employees. On 2026-04-17 the Italian Garante fined a company in liquidation EUR 5,000 for keeping a former employee's mailboxes active from 2023-06-30 to 2023-12-21, finding violations of GDPR Arts. 5(1)(a), (c), (e), 6, 12, 13, 17 and 29.

The German data protection conference's resolution of 2024-09-11 says disclosing employee data to a bidder before signing an asset deal is in principle not permitted without consent, though a legitimate interest is possible for key persons in advanced negotiations. UK DPA 2018 s.170 also applies; for closed companies, see the shutdown route.

In the US, 11 U.S.C. 101(41A) covers consumer data only, so the ombudsman process does not reach staff data.

In the Spirit Aviation Holdings case (Bankr. S.D.N.Y. 25-11897 (SHL)), the schedule lists 175,658 employee records (Dkt. 1463, Exh. A-2). The ombudsman's report (Dkt. 1684, fn. 3) did not investigate risks to employees, and unions are among the objectors. Dkt. 1779 (2026-11-04) records the debtors working with the objectors on employee information; the sale is not approved as of 2026-11-09, with a hearing on 2026-11-17.

Licensing Staff Data: Benefits, Risks, Downsides and Alternatives, Including Not Licensing

Staff data can be licensed lawfully in every jurisdiction here when the basis and collective step are in place, but the duties differ by country and not licensing remains a valid choice.

Benefits

• A lawful route exists everywhere in the matrix.
• A collective agreement can supply an Art. 88 basis, within the limits of C-65/23.

Risks

• Damages per person, as in the BAG's EUR 200 award of 2025-05-08.
• Penalties such as the Québec and China caps stated above.
• A works council dispute or an Einigungsstelle procedure.

Downsides

• A multi-country workforce needs one check per country.
• Consent-led laws shrink the set that can be licensed.

Alternatives

• License only non-personal systems or de-identified data.
• Train in-house under its own test.
• Do not license staff data at all.

Pending Changes as of November 2026

Four pending items can change these rules; each row gives the next dated step and its source.

Beyond This Comparison: Seller Steps, Recordings and Jurisdiction Pages

Each step, data type and country has its own page.

• Copyright, privacy and contract rules beside staff data
• The other EU instruments
• Recorded calls and meetings in staff archives
• The email data type
• The full seller process
• The decision to license or not
• BetrVG § 87 in data sales
• Staff data in US bankruptcy sales
• How staff see a data sale
• Privacy law for all personal data
• Voice and face data of staff

What This Page Does Not Cover

This page covers staff data put into AI training sets, not how employers monitor staff, use AI in hiring decisions or train staff in AI tools. Whether AI-training contributors are employees or contractors sits on its own page on contributor classification.

How This Page Is Sourced and Dated

Every rule cites the statute, official text or court record, with the date it was checked. The rules for sources and dates are set out in how we source, date and check every figure, and this page is general information about employment and privacy law, not legal advice for any specific deal.

Frequently Asked Questions

Is employee data subject to GDPR?

Yes, employees are data subjects, and the GDPR applies to their data from 2018-05-25. Article 88 lets member states and collective agreements add national employee rules on top, within the limits of C-34/21 and C-65/23.

Which countries have a specific employee data law?

Germany (§ 26 BDSG, partly unapplied), Switzerland (OR Art. 328b), Italy (Statuto art. 4), Portugal (art. 28(6)), Spain (LOPDGDD art. 89) and Poland (art. 22³). None is recorded here for the UK, US federal law, Canada, China, Japan or Türkiye.

Can a works council block the licensing of staff data?

In most jurisdictions recorded here, not on its own. Austrian § 96a and Dutch consent can be replaced, a German Einigungsstelle can decide, and a French CSE is consulted only; Austrian § 96 consent is outside the § 96a(2) route.

Does the CCPA cover employee data used for AI training?

Yes, since 2023-01-01. A paid license of staff data is a sale with an opt-out right under Cal. Civ. Code 1798.120.