At Komünite’s AI Summit for HR Professionals (11 March 2025), Vircon Legal Managing Partner Erdem Mümtaz Hacıpaşaoğlu addressed how data privacy and legal responsibility take shape in AI-powered HR processes: covering the processing of employee data and the legal framework to watch when using AI.
Why HR is where AI regulation lands first
HR processes personal data about people in a dependent relationship and makes decisions with direct material consequences — which puts it at the front of the queue for scrutiny. Under the KVKK, consent is the weakest basis in an employment context, where the power imbalance makes freely given consent hard to establish. Anything touching health data or biometric categorisation sits in the special-category tier with stricter conditions again.
The provision that catches most deployments is not about AI at all: the rule on automated decision-making requires meaningful information about the logic and a route to human review that is real rather than nominal. A recruiter who rubber-stamps a ranked list is not meaningful involvement. The EU AI Act adds to this, treating employment systems as high risk and imposing human oversight duties on deployers — see AI in Hiring and our KVKK compliance guide.
Author
If this is on your desk
Templates and checklists are free in the Founder Academy; for a specific situation, book a 30-minute intro call.
Founder AcademyBook an intro call