HR TRANSFORMATION · 2 HOURS
Employee Data, Privacy and AI
Employee Data, Privacy and AI teaches HR and people operations staff to recognise personal data about workers and decide what may go into an AI tool. You finish with a signed team rule, including a red-list and a clear answer for managers, so staff information stays protected.
About this course
HR teams are asked every week whether information about staff can go into an AI tool, and the manager asking has usually taken out the name and assumes that settles it. Under UK data protection law, information about a worker can still be personal data without a name, because a role, a location, or a detail such as being the only payroll specialist can identify someone to anyone in the team.
This course teaches you to recognise personal data about workers, to keep a red-list of people data out of AI tools, to anonymise a prompt properly, to answer a manager helpfully, and to act the same day when something goes in by mistake. You finish with a signed team rule that managers can follow without calling HR.
What you will take away
- You will be able to tell whether information about a worker is personal data when no name is given, using the test of whether the person could reasonably be identified.
- You will be able to separate red-list data, such as health, grievance, and disciplinary information, from data that can go into the approved tool.
- You will be able to anonymise a prompt so that no colleague could say who it is about while keeping what the question needs.
- You will be able to reply to a manager in three parts, acknowledging their aim, stating the limit with a reason, and offering another route.
- You will leave with a signed team rule covering approved tools, the red-list, the answer to managers, and what to report the same day after a mistake.
Who this course is for
- HR professionals who are asked by managers whether information about staff can be pasted into an AI tool and want a clear, consistent answer.
- People operations staff who handle sickness records, grievance letters, and disciplinary material and need to know what must stay out of AI tools.
- Data protection leads who support HR and want a practical rule that sits under the organisation's policy in words busy managers will read.
- HR advisers without legal training who know which tools are approved and, in outline, what their data protection policy says.
What you will do
Each lesson teaches one part of the method, works through a realistic example, and ends with a check on a case you have not seen. The course closes with an assessment and then the piece of work you sign.
- 5lessons with a worked example and a check
- 7scenario questions in the course assessment
- Signedthe team rule for people data and AI, with a record anyone can verify
- 2 hoursat your own pace, with progress saved
- 01
Lesson
What counts
This lesson explains the UK GDPR definition of personal data and why information can identify a worker without a name, while policies and job descriptions usually do not. You read a manager's message with the name removed and mark five items from a law firm as personal data or not.
- Personal data is about a person, with or without a name
- What personal data is not
- Why this matters when a manager asks
- The mistake people usually make
You mark 5 statements from a realistic case and receive an explanation for each one.
- 02
Lesson
The red-list
This lesson sets out the red-list of people data that never goes into an AI tool without a specific approved route, starting with special category data, and explains why an approved tool does not settle the question. You draft red-list lines and mark requests from a care provider.
- What the red-list is
- The three groups on the list
- Your organisation's list comes first
- The mistake people usually make
You mark 5 statements from a realistic case and receive an explanation for each one.
- 03
Lesson
Anonymised is harder than it looks
This lesson explains what anonymising a prompt properly means, introduces the colleague test, and shows that anonymised does not have to mean vague. You work through a prompt about the only payroll specialist in an office and mark each phrase in a new prompt to remove, generalise, or keep.
- What anonymising a prompt means
- The colleague test
- Anonymised is not the same as vague
- The mistake people usually make
You mark 8 statements from a realistic case and receive an explanation for each one.
- 04
Lesson
The answer
This lesson teaches a reply to a manager in three parts, acknowledging the aim, stating the limit and reason, and offering a route, and explains why the order matters. You rewrite a reply about a grievance letter and choose the better answer to a request about sickness records.
- Three parts, in this order
- What the answer is not
- Why the order matters
- The mistake people usually make
You compare two versions of the same piece of work, choose the stronger one, and see the reasoning behind the answer.
- 05
Lesson
When something goes in by mistake
This lesson explains why personal data that goes into the wrong tool should be reported to the data protection lead the same day, what the report needs, and why quiet deletion does not help. You edit a stores supervisor's message so the lead has what they need.
- Tell the data protection lead the same day
- What the lead needs to know
- Do not try to fix it quietly
- The mistake people usually make
You repair a flawed draft so it meets the standard the lesson sets, and your revision is checked against it.
- 06
Course assessment
Course assessment
This lesson recaps what counts as personal data, the red-list, anonymising, answering, and reporting, then takes one shift manager's request through every move in order. You answer seven new situations with feedback on each choice and need six correct to pass.
- What counts, and what goes on the red-list
- Anonymising, answering, and reporting
- Working through a request in order
You judge 7 new workplace situations, with feedback on every option, and need 6 correct to pass.
- 07
Final work and signed record
Write the team rule
In this final lesson you write the team rule for the managers and staff you support, covering approved tools and purposes, the red-list with reasons, the three-part answer, and what to do after a mistake. Each part is checked before you sign the rule for your record.
- What the team rule is
- What the team rule is not
- How the rule is checked
You write the team rule for people data and AI for your own work, part by part, and sign it as your record.
GOOD WORK.THE TEAM RULE FOR PEOPLE DATA AND AI, SIGNED.
WHAT CHANGES
What the course changes for you and your organisation.
- 01
Staff information stays protected
The course shows why removing a name rarely makes information anonymous in a small team, and teaches a colleague test to apply before any prompt is sent. Fewer identifiable details about workers enter AI tools, which protects the people concerned and the organisation.
- 02
Answers managers accept and follow
You learn to acknowledge what the manager is trying to do before giving the limit, and always to offer a route that still meets their deadline. Managers receive help rather than a refusal, so they are more likely to ask again next time instead of pasting the material anyway.
- 03
Mistakes reported while it matters
The course explains why a mistake should be reported to the data protection lead the same day and why the conversation should not be quietly deleted. Your data protection lead receives the tool, what went in, and when, in time to judge what needs to happen next.
- 04
Employers are drawing data lines
Cisco's 2024 Data Privacy Benchmark Study found 63% of organisations limit what data can be entered into generative AI tools, while 45% of respondents had entered employee information. A clear team rule on people data turns that limit into something staff and managers can follow every day.
QUESTIONS
Questions about Employee Data, Privacy and AI
- What is Employee Data, Privacy and AI about?
- HR teams are asked every week whether information about staff can go into an AI tool, and the manager asking has usually taken out the name and assumes that settles it. Under UK data protection law, information about a worker can still be personal data without a name, because a role, a location, or a detail such as being the only payroll specialist can identify someone to anyone in the team. This course teaches you to recognise personal data about workers, to keep a red-list of people data out of AI tools, to anonymise a prompt properly, to answer a manager helpfully, and to act the same day when something goes in by mistake. You finish with a signed team rule that managers can follow without calling HR.
- Who is Employee Data, Privacy and AI for?
- HR professionals who are asked by managers whether information about staff can be pasted into an AI tool and want a clear, consistent answer. People operations staff who handle sickness records, grievance letters, and disciplinary material and need to know what must stay out of AI tools. Data protection leads who support HR and want a practical rule that sits under the organisation's policy in words busy managers will read. HR advisers without legal training who know which tools are approved and, in outline, what their data protection policy says. No specialist background is assumed, and every term is explained before it is used.
- What will I be able to do after Employee Data, Privacy and AI?
- You will be able to tell whether information about a worker is personal data when no name is given, using the test of whether the person could reasonably be identified. You will be able to separate red-list data, such as health, grievance, and disciplinary information, from data that can go into the approved tool. You will be able to anonymise a prompt so that no colleague could say who it is about while keeping what the question needs. You will be able to reply to a manager in three parts, acknowledging their aim, stating the limit with a reason, and offering another route. You will leave with a signed team rule covering approved tools, the red-list, the answer to managers, and what to report the same day after a mistake.
- How long does the course take, and how is it taught?
- The course takes about 2 hours and is studied online at your own pace. It has 5 lessons, each with a worked example, a practice exercise, and a check on a new case, followed by a course assessment of 7 scenario questions in which you need 6 correct to pass. Your progress is saved to your account.
- Do I get a certificate?
- Yes. When you pass, you sign a record that names you, the course, and the team rule for people data and AI. Anyone you share it with can verify it online and download it as a PDF. The record confirms what you completed and does not claim compliance with any regulation.
- How much does it cost, and when can I start?
- The course costs £129, paid once by card through Stripe. Access begins as soon as payment is confirmed, and you can save a sign-in to return to the course from any device.
- Can my organisation train a whole team?
- Yes. Individuals can buy any self-paced course online, and organisations can book trainer-led courses for teams, in person or online, through the Experrt Academy.
More hr transformation courses are listed on the self-paced ai courses for hr and people teams page.
THERE IS A NEXT CHAPTER.
Start today, and finish with
the team rule for people data and AI your organisation can use.
Checkout takes an email address and a card, and access begins as soon as payment is confirmed. When you finish, you sign a record that names you and the team rule for people data and AI, which anyone you choose can verify online. The record confirms what you completed and does not claim compliance with any regulation.