What if AI rejects your best job applicant before you even see their CV?
Cyprus employers can use AI for recruitment and certain workplace monitoring activities, but GDPR rules apply when these tools process personal data. Some employment-related AI systems also face additional requirements under the EU AI Act.
Imagine receiving 150 applications for one vacancy. Your software shortlists 12 people in minutes. Sounds great, until you discover it overlooked a qualified candidate because their experience didn’t match the right keywords.
AI can save time. But it shouldn’t make important decisions impossible to explain. So, what can your business actually do with AI, and where should you be careful?
Not every workplace AI tool creates the same legal concerns. Interview-scheduling software differs from systems that rank candidates or monitor employees throughout their shifts.
AI can help organize applications, identify relevant qualifications, and support recruitment decisions. But GDPR requires employers to use candidate information lawfully, collect only what is necessary, and explain how personal data is processed.
For example, an AI tool might rank applicants by previous job titles. Someone with the right experience but an unusual title could receive an unfairly low score. That’s why employers should review their recruitment software’s criteria and check whether its recommendations make sense.
For companies building their teams, NAKLAW’s employee hiring services in Cyprus can help with employment arrangements and related requirements.
Article 22 GDPR restricts certain decisions made solely by automated systems when they have legal or similarly significant effects on a person. An automatic rejection that determines someone’s employment opportunity may fall within these rules, subject to limited exceptions and safeguards.
Imagine AI rejects an applicant because it misunderstands their qualifications. A recruiter who genuinely reviews the application can catch the mistake. But a recruiter who approves every AI recommendation without checking may not be providing meaningful human oversight.
The goal is simple: use AI to help recruiters make better decisions, not to remove judgment where it matters.
AI-assisted monitoring may be lawful, but employers cannot monitor everything employees do simply because the software allows it. Tracking company vehicles during deliveries may serve a legitimate purpose. Tracking employees after their shifts is a very different privacy question.
Cyprus’s Data Protection Commissioner emphasizes that workplace surveillance must be necessary, proportionate, and appropriately explained to employees.
Since February 2, 2025, certain AI systems that infer employees’ emotions have been prohibited under the EU AI Act, except for specified medical or safety purposes.
Just because a company owns the equipment doesn’t mean employees lose their privacy rights.
Employers need a valid GDPR legal basis for processing personal information, but consent is often unsuitable in employment relationships, because employees may feel they cannot freely refuse their employer’s request.
Asking staff to sign a consent form for continuous screen monitoring doesn’t automatically make that monitoring lawful. Employers must identify an appropriate legal basis, assess necessity and proportionality, and provide clear information about the processing.
When high-risk workplace AI obligations apply, the AI Act also requires employers deploying those systems to inform affected workers and their representatives before use. Employees should understand what the AI system does, what information it uses, and how its results might affect them.
Before buying AI recruitment or monitoring software, make sure someone in your business understands how it works. You don’t need to start with a complicated legal manual. These five checks can help:
What exactly will the AI tool do?
What information will it collect, store, or share?
Could it unfairly affect hiring or employee decisions?
Is a Data Protection Impact Assessment (DPIA) required because the processing is likely to create high risks?
Who reviews the system and handles problems?
Some recruitment and employee management systems are classified as high-risk under Annex III of the EU AI Act, subject to the applicable conditions and exceptions.
Clear corporate governance arrangements can help businesses establish who is responsible for important decisions, alongside their separate AI and data protection obligations.
Don’t approve an AI tool until someone on your team can explain what it does and who is accountable for its use.
GDPR already applies to the personal data employers collect about applicants and employees, so businesses should not wait until 2027 to address existing privacy obligations. The EU AI Act adds separate requirements, including rules for certain high-risk recruitment and employee management systems.
GDPR became applicable.
Initial AI Act prohibitions, including relevant workplace emotion-recognition restrictions, began applying.
Most remaining AI Act provisions became applicable, subject to exceptions.
Relevant Annex III high-risk AI requirements become applicable.
Yes, provided the use complies with GDPR and other applicable rules. Some candidate-ranking systems also fall under the AI Act’s high-risk category.
Monitoring may be lawful when justified, necessary, proportionate, and transparent. Remote employees still have privacy rights.
Not automatically. Consent often doesn’t work in employment relationships because employees may not be able to refuse freely.
AI can speed up recruitment and streamline workplace operations. But employers still need to protect personal information and ensure important decisions receive appropriate human oversight. Start by checking the tools your business already uses, what data they collect, and whether their recommendations could affect someone’s employment.
If your company needs guidance with employment arrangements or corporate responsibilities, NAKLAW can help you discuss the relevant legal support available.
Before your team introduces another AI tool, ask one simple question: would we feel comfortable explaining how it works to the person it affects?