By Andrew Mitchell, Senior Correspondent, Compliance & Employment Law
It’s been roughly a year since the most recent wave of major HR data privacy regulations took effect across the United States and Europe. What began as the landmark General Data Protection Regulation (GDPR) in 2018 has evolved into a much more complex and nuanced privacy landscape for HR professionals. In 2026, the question is no longer whether HR departments should worry about data privacy — it’s how they manage the expanding web of requirements that touch nearly every aspect of employee data handling.
This article examines the key developments in HR data privacy during 2025-2026, from AI training data considerations to employee surveillance tool regulation, and what the latest Federal Trade Commission guidance means for HR technology.
One Year After the Updates
The regulatory landscape has shifted significantly since 2025. While the GDPR remains the foundational framework, several important developments have reshaped how HR departments think about data privacy:
The US Privacy Patchwork Deepens. As of late 2026, nearly 20 US states have enacted some form of comprehensive privacy legislation, with several more actively considering bills. Unlike the GDPR’s single-framework approach, the US system creates a complex compliance matrix that HR departments must navigate, especially multistate employers. The most impactful state laws for HR — California (CPRA), Virginia (CDPA), Colorado (CPA), Connecticut (CDPA), Utah (UCPA), Texas (TDPSA), and Indiana (INCDPA) — have diverged in ways that create genuine operational challenges.
EU’s AI Act Impacts HR. The EU’s AI Act, which entered its phased implementation in 2025, designates several HR technologies as “high-risk” AI systems. This means HR departments using AI for hiring, performance evaluation, promotion decisions, and workforce monitoring must comply with additional transparency, data quality, and human oversight requirements. The compliance burden is significant: organizations report spending an average of €120,000-$180,000 annually on AI Act compliance for HR applications.
UK GDPR Post-Brexit Realignments. The UK’s post-Brexit data protection framework has realigned with the EU’s evolving standards in some areas (keeping adequacy with the EU) while diverging in others (creating unique UK-specific requirements). The result is a dual-track compliance requirement for most multinational employers operating in both jurisdictions.
AI Training Data: The New Frontier
Perhaps the most significant and least understood development in HR data privacy is the question of AI training data. When HR departments feed employee data into AI systems — for resume screening, performance analysis, skills assessment, or predictive analytics — they’re not just processing data; they may be contributing to models that will learn from and potentially replicate patterns in that data.
Key issues HR departments are grappling with in 2026:
Employee consent for AI training. The GDPR framework requires explicit consent for data processing, but it was designed for traditional data processing, not AI model training. Many organizations have added AI-specific consent clauses to their employee privacy notices, but legal scholars and privacy advocates argue these clauses are too broad and lack meaningful specificity. The trend in 2026 is toward granular, AI-specific consent that separates general data processing from AI training data usage.
Data provenance in HR AI. When an AI model trained on data from Company A’s employees later influences hiring decisions at Company B (using a shared AI vendor), who is responsible if biased outcomes emerge? The question of data provenance — knowing where the training data came from and how it was used — has become a central compliance concern. The EU AI Act’s data governance requirements address this directly, while US regulations are still catching up.
Aggregation vs. individual rights. AI training benefits from large datasets, but employee privacy rights are individual. The tension between these needs is creating new organizational practices: HR departments are increasingly creating separate “training data sets” from employee data, applying additional anonymization and aggregation before the data is used for AI model training. This adds complexity and cost but is becoming the default approach for well-regarded organizations.
Employee Surveillance: Regulation Catches Up
The proliferation of employee monitoring tools — from keystroke tracking and productivity analytics to video monitoring and location tracking — has finally attracted regulatory attention. In 2026, several jurisdictions have established clearer rules for what employers can monitor, how they must inform employees, and what limits exist on monitoring scope.
Connecticut and Maryland lead the way. These states, which have long been ahead on workplace privacy, have updated their employee surveillance laws in 2025-2026 to specifically address digital monitoring tools. The key requirements: written notice of monitoring practices, limitation on monitoring outside work hours, prohibition on monitoring medical or religious activities, and employee access to their own monitoring data.
The EU’s workplace surveillance guidance. The European Data Protection Board’s updated guidance on workplace monitoring, published in late 2025, provides detailed criteria for evaluating whether workplace monitoring is “necessary and proportionate.” The guidance specifically addresses video monitoring, screen capture, and keystroke logging, and establishes that blanket monitoring (all employees, all time) is increasingly hard to justify.
FTC’s 2026 surveillance enforcement. The Federal Trade Commission issued its first major HR surveillance enforcement action in early 2026, penalizing a major employer for failing to disclose its extensive employee location tracking. The action signaled that the FTC would treat undisclosed employee surveillance as an unfair practice under Section 5 of the FTC Act, even in states without specific surveillance laws. This has created a national standard for employee surveillance disclosure.
FTC Guidance: What It Means for HR Tech
The most impactful regulatory development for HR technology in 2026 has been the FTC’s comprehensive guidance on data practices in HR technology platforms. Published in April 2026, the guidance addresses 12 specific areas where HR tech companies handle employee data, and provides clear expectations for HR departments as data purchasers.
Key takeaways for HR leaders:
- Data minimization is now a compliance expectation, not a best practice. HR tech platforms are expected to collect only the data they need, and HR departments should verify that their vendors are following this principle.
- Third-party data sharing must be disclosed. The FTC’s guidance makes clear that HR tech platforms must disclose all data sharing — including sharing with subsidiary companies, data processors, and AI training partners — in plain language that employees can understand.
- Employee data must be deletable on demand. The right to deletion, which existed in some state laws, is now expected as a standard capability across HR tech platforms. HR departments should verify this capability before signing vendor contracts.
- Algorithmic transparency is required for hiring and performance tools. The FTC expects that AI-powered HR tools will provide some level of explanation for their recommendations — particularly when those recommendations affect employment outcomes like hiring, promotion, and compensation.
The Compliance Investment Reality
The cumulative effect of these privacy developments is significant investment from HR departments. Survey data from 2026 shows that HR privacy-related spending has increased 45% year-over-year, with the following allocations:
- Privacy compliance software and services: 38% of total privacy spend
- Employee privacy training and awareness: 18%
- Privacy impact assessments for new HR tools: 15%
- Legal counsel and regulatory monitoring: 22%
- Data mapping and inventory tools: 7%
The average HR department in a mid-to-large organization now spends between $85,000 and $150,000 annually on privacy compliance — up from approximately $50,000 in 2024. For HR leaders, the question is no longer whether privacy compliance is expensive but how to justify that investment to CFOs and boards.
The strongest argument: the cost of non-compliance. In the first half of 2026, the total value of HR-related privacy enforcement actions and settlements worldwide exceeded $400 million, with individual penalties ranging from $500,000 to $12 million. Next week: Remote work policy shifts — the fall 2026 return-to-office wave, adoption rates, productivity impacts, and employee sentiment.