5.4GDPR, AI Act & legal framework
The essentials in 30 seconds
- Personal data = vigilance: minimisation, approved tool, human in the loop for any decision with an effect.
- AI Act by risks: practices to avoid, highly framed sensitive uses (including hiring), transparency.
- Your role: spot sensitive situations and ask the DPO/lawyer — do not decide alone.
Running case — Amine and the CV sorting he must not improvise
Amine wants AI to sort CVs for his project in Algiers: candidates' personal data + a decision touching people. Instead of improvising, he takes out his radar: minimisation, human in the loop, sensitive use with heavy compliance. He prepares 3 questions for the DPO instead of pasting the CVs. Sequel to cases 5.1-5.3 — Amine recognises the regulated scope.
Sequel to cases 5.1-5.3 — Amine spots, does not decide: the DPO decides.
1. Personal data & decisions
As soon as personal data comes into play (clients, employees, candidates), the general principles apply: legitimate basis, minimisation, people's rights. And for any decision with a significant effect on a person, the human stays in the loop: no fully automated decision imposed without human control. Amine gives up any automatic CV sorting.
2. The AI Act by risks, and your role
The European AI Act takes a risk-based approach: some practices are to be avoided, sensitive uses touching people (including hiring and appraisal) are tightly framed, with transparency obligations on AI content and systems. Practical goal: the markers, not the law lecture.
Your role: spot, do not decide. Regulatory questions go to the DPO/lawyer — map your uses (which touch personal data? which touch people?) and bring them 3 precise questions. Following the internal charter keeps you on the right side.
🔎 Concrete example — The regulatory radar
Spot, do not decide: Amine's radar.
Personal data? -> minimisation, no auto decision, approved tool.
CV sorting, appraisal? -> sensitive use (demanding compliance), do not improvise.
-> 3 questions to ask your DPO/contact, no self-interpretation.
Amine notes: who approves compliance in the organisation?Outcome: three precise questions beat a risky interpretation.
Lesson: the DPO/lawyer is the right door.
Section vocabulary
- Personal data
- Any information about a person: minimisation and approved tool.
Simple example: Amine's candidates' CVs are personal data.
What it is not: “quickly anonymised, so out of scope” without checking.
Reflex: does this use touch identifiable people?
- Human in the loop
- No decision with an effect on a person without human control.
Simple example: Amine refuses automatic rejection of applications.
What it is not: letting AI sort alone “to go faster”.
Reflex: who humanly signs this decision?
- AI Act (principles)
- European risk-based approach + transparency.
Simple example: Amine flags synthetic content released to the public.
What it is not: believing the AI Act only concerns vendors.
Reflex: is my use sensitive or subject to transparency?
- Sensitive use
- Hiring, appraisal: a zone of demanding compliance.
Simple example: Amine escalates CV sorting instead of improvising.
What it is not: tinkering a candidate scoring in a spreadsheet + AI.
Reflex: who approves this use's compliance?
- DPO / contact
- The contact for regulatory questions.
Simple example: Amine brings 3 precise questions to the DPO.
What it is not: self-interpreting the texts among colleagues.
Reflex: are my 3 questions ready and written?
In practice — The regulatory radar applied to your uses
- Take your uses listed in 4.5 and flag those touching personal data: minimisation, approved tool, human in the loop.
- Spot potential sensitive uses around you (CV sorting, appraisal): who in the organisation approves their compliance?
- Test the transparency reflex: which of your generated content pieces should be flagged as such (public-facing chatbots, synthetic content)?
- Note the 3 questions to ask your DPO/contact: it is the right door — not self-interpreting the texts.
Ready-to-say script — escalating to the DPO
“I am preparing an AI use that touches [personal data / people: describe]. I applied minimisation and the approved tool, and I keep a human decider. Do you approve this use? Is specific transparency or reinforced compliance needed before starting?”
To address to the DPO/contact or lawyer with the precise description of the use — before any start.
Copy-paste template — regulatory radar
MY REGULATORY RADAR
USES WITH PERSONAL DATA: _______________ -> minimisation + approved tool: OK / TO REVIEW
SENSITIVE USES (people: hiring, appraisal): _______________ -> approved by: _______________
TRANSPARENCY (content to flag as AI): _______________
MY 3 QUESTIONS TO THE DPO: 1) ___ 2) ___ 3) ___Solo / no DPO
Amine with no internal DPO: contact person + external lawyer or management — the question always arises, even without a DPO title.
Small business / simple uses
Short mapping: 1 page, flagged uses, 3 questions — simplicity does not exempt from the radar.
SME in Algeria
Amine in Algiers: candidate and employee data handled with law 18-07 caution; sensitive European uses known as a general principle.
HR team
No people-touching HR use without compliance approval: the HR grid goes before the DPO before starting.
✓ Best practices
- As soon as there is personal data, think minimisation.
- Keep a human in the loop for any decision with an effect.
- Ask regulatory questions to the DPO/lawyer, do not decide alone.
✗ Common pitfalls
- Setting up an automated decision with an effect and no human.
- Improvising a sensitive use (CV sorting) without compliance.
- Self-interpreting the texts instead of consulting the DPO.
Key takeaways
- Personal data = vigilance, whatever the tool: minimisation, approved tool.
- No decision with an effect on a person without a human in the loop.
- Uses touching people (hiring, appraisal): sensitive zone, not to be improvised.
- Regulatory questions go to the DPO/lawyer: spot, do not decide.
48h challenge — apply tomorrow
Map your uses (personal data? people touched?) and write your 3 questions to the DPO: contact planned?
- I can cite the radar in one sentence (data, uses, DPO).
- My uses are mapped (flagging done).
- My 3 questions to the DPO are written.
Frequently asked questions
Do the frameworks apply to me, a mere company user?
They weigh first on organisations — but concretely touch you: training, framed uses (transparency, human oversight), practices to avoid. Following the internal charter keeps you on the right side. You need not master the texts, but recognise when a use is sensitive.
What do we risk in case of breach?
Without going into any amount or detail: the texts provide serious consequences for organisations, and at individual level the risk is disciplinary — all the more reason for clear team rules (5.5) approved with the DPO or a lawyer.
Amine wants AI to sort CVs. First reflex?