Whether or not your organisation has an AI policy, someone in your team has probably pasted something into a chatbot this week. Usually it's harmless: a rewrite of an email, a draft agenda. Occasionally it's a performance note with a name in it, or a spreadsheet with salaries. HR is well placed to set the guardrails, because HR holds the most sensitive data most companies have.
Why this lands on HR
Employee records include exactly the kinds of personal data that need the most care: pay, health, performance, family circumstances, identity documents. In India, the Digital Personal Data Protection Act, 2023 (DPDP) sets out obligations for organisations that process personal data, including using it for a clear purpose and protecting it with reasonable safeguards. Sending employee data to an outside AI service without thinking about those obligations creates risk for the organisation and for the people whose data it is.
That doesn't mean AI and HR don't mix. It means HR needs a simple, workable set of rules that people will actually follow.
Why a ban rarely works
Banning AI tools outright tends to push use underground, onto personal phones and personal accounts, where you have even less visibility. A better approach is to make the safe way the easy way: an approved tool, clear examples of what's fine and what isn't, and a little training.
Five steps to start with
1. Find out what's already happening
Ask, without blame, which tools people use and for what. You'll learn where the value is and where the risks are.
2. Agree an approved tool
Work with IT to choose a tool and plan with appropriate data protections, and make it available to the people who need it. Business plans often offer stronger controls than personal accounts; check the specific terms with your IT and legal teams.
3. Publish a one-page "green, amber, red" guide
| Green: go ahead | Amber: anonymise first | Red: never |
|---|---|---|
| Templates, policy explainers, JD drafts, training ideas, rewriting your own text | Survey comments, case patterns, review language, data with names and IDs removed | Identifiable pay, health, disciplinary or ID data; anything confidential about a named person |
4. Keep people decisions with people
AI can help structure a hiring or performance decision, check it for bias and draft the communication. The decision itself, and the accountability for it, should stay with a named person.
5. Train, then review
A short session on what good use looks like does more than a long policy document. Revisit the guide every few months; the tools change quickly.
Name one person people can ask "is this okay to paste?" A quick answer prevents most mistakes.
This article is general information, not legal advice. For your organisation's specific obligations under the DPDP Act and other laws, speak to your legal or data protection team.
Build your team's AI policy
Module 10 of AI for HR Professionals covers AI governance, DPDP in practice and bias auditing, and ends with a policy your team can adopt.