GDPR and workplace training: what HR Directors need to know

What data does training generate?

A training platform (an LMS or other tool) processes several categories of data:

• identification: name, work email address, department, job, manager;
• learning activity: logins, time spent, progress, attempts, answers to questions where they are stored;
• results: scores, levels reached, certificates, history of courses taken;
• AI-generated data, where relevant: estimated gaps, learning path recommendations, inferred mastery level.

The CNIL (the French data protection authority) framework explicitly lists training among the purposes of personnel management: handling training requests and completed training periods, organising sessions, and assessing knowledge and training.

What is the reference framework?

The GDPR (Regulation (EU) 2016/679) applies to any processing of employee data. For personnel management, the CNIL adopted a reference framework on the processing of personal data for personnel management purposes (deliberation No. 2019-160 of 21 November 2019, amended on 23 May 2022). The framework is not mandatory, but an organisation that departs from it must be able to justify its choices. It excludes algorithmic processing for profiling purposes from its scope.

Which legal basis should you use?

The framework suggests, as a guide:

Training-related processing	Legal basis indicated by the CNIL
Handling training requests and completed training periods	Performance of the employment contract
Organising sessions and assessing knowledge and training	Employer's legitimate interest
Forward planning of jobs and skills, skills management	Legitimate interest

Consent is rarely a suitable basis in an employment relationship, because employees are only free to refuse if refusing has no consequences for them.

What are the employer's obligations?

Keep the record of processing. The record exemption for organisations with fewer than 250 employees does not apply when processing is not occasional (Article 30(5) GDPR). Ongoing training tracking must therefore be recorded, whatever the size of the company.

Inform employees. Before first access to the platform: purposes, legal basis, recipients, retention period, rights and how to exercise them. The CNIL recommends written information.

Limit access. Under the framework, only people authorised by their role access the data, strictly within their remit: HR or training team, line managers. Under the data minimisation principle (Article 5 GDPR), a manager needs to know whether the training was completed and what level was reached; access to individual answers must be justified by a specific need.

Set a retention period. It depends on the purpose: in principle the length of the employment relationship, followed by restricted-access intermediate archiving where limitation periods or legal obligations justify it. The framework gives examples with figures for payroll or registers, but no specific period for training: the employer must set and document it.

Bind the vendor. The platform vendor is usually a processor: a contract compliant with Article 28 GDPR sets out instructions, security, what happens to the data at the end of the contract, and audits. Any transfer outside the European Union must rely on an adequacy decision or appropriate safeguards (Articles 44 et seq.).

When is a data protection impact assessment (DPIA) mandatory?

The CNIL framework lists training management, for organisations with fewer than 250 people and without profiling, among processing that does not require a DPIA. Conversely, processing intended to offer personalised training through an algorithm is among its examples of processing for which a DPIA is required. In other cases, a DPIA is mandatory as soon as two of the European Data Protection Board's nine criteria are met, including evaluation or scoring, automated decision-making and vulnerable data subjects; the CNIL notes that employees can be considered vulnerable because of the imbalance of power with the employer.

What rights do employees have?

• Access and rectification of their data, at any time.
• Objection on grounds relating to their particular situation, where processing is based on legitimate interest (Article 21); the employer can continue if it demonstrates compelling legitimate grounds.
• Portability, limited to data provided by the employee and processed on the basis of contract or consent, by automated means (Article 20).
• Erasure, limited during the employment relationship, applicable once retention periods have expired.
• Not to be subject to a decision based solely on automated processing with significant effects, for example automatic exclusion from a learning path (Article 22).

What the EU AI Act changes

Regulation (EU) 2024/1689 (the AI Act) applies on top of the GDPR when the platform uses AI.

• Prohibited practice. Since 2 February 2025, using AI systems to infer the emotions of a person in the workplace and in education institutions has been prohibited, except for medical or safety reasons (Article 5(1)(f)). A tool that analysed learners' emotions via webcam would be covered.
• High-risk systems. Annex III covers, among others, systems intended to evaluate learning outcomes in education and vocational training institutions (point 3) and systems intended to monitor and evaluate the performance and behaviour of people in work relationships or to allocate tasks (point 4). Using AI to assess employees in training can therefore fall into this category, depending on its purpose.
• Timeline. Regulation (EU) 2026/1744, the "Digital Omnibus on AI", postponed the application of the obligations for these Annex III systems to 2 December 2027.
• Informing representatives. Before using a high-risk system in the workplace, the employer informs workers' representatives and the employees concerned (Article 26(7)).

For the AI training obligation itself, see AI Act Article 4: what your company needs to put in place.