AI for HR and consultancies: searching personnel files without giving them away

How do HR and consultancies use PrivaSearch?

An HR department or consultancy uses PrivaSearch to search personnel files, policy documents and client reports with an AI assistant, without giving names, BSNs (Dutch citizen service numbers) and addresses to the provider of that assistant. A colleague checks every document before it becomes searchable, and every answer comes with its source.

Below you see how that works, with made-up situations from the practice of an HR department, an HR service provider and an organisational consultancy. First, why files of this kind call for special care.

Why are HR files so sensitive?

A personnel file contains more than a name and an address. It holds appraisals, salary arrangements, warnings and sometimes reports of conversations about personal circumstances. An absence file contains information that touches on health. Health data is special category data: Article 9 GDPR prohibits its use, except in a limited number of exceptions. Which data falls under it is set out in our article on special category data.

On top of that comes the relationship between employer and employee. An employee finds it hard to say no, and expects that their file goes no further than necessary. Anyone who pastes such a file into a chatbot sends it in its entirety to the provider. The Autoriteit Persoonsgegevens (AP), the Dutch data protection authority, warns that this can lead to a data breach.

Something similar applies to consultancies. Interviews with a client's employees, the results of an employee survey or a report on a reorganisation are confidential, and the people in them are often easy to recognise.

How does it work?

PrivaSearch is software that lets your team search its own client files with Claude, ChatGPT or Mistral Vibe, after names, BSNs (Dutch citizen service numbers) and addresses have been replaced by pseudonyms and a colleague has checked that.

1. You create a project, for example per department, per file or per assignment, and upload the documents or connect a SharePoint library read-only.
2. A language model within PrivaSearch and Dutch patterns find names, addresses, BSNs, IBANs, number plates and dates of birth and replace them with consistent pseudonyms.
3. A colleague sees the original and the pseudonymised text side by side, corrects what the model missed and explicitly approves each document.
4. You then search the released passages in PrivaSearch or in your own assistant via a secured MCP connection.

Where a conversation report stated that an employee was given a follow-up appointment after a conversation with their manager, the assistant reads "[PERSOON_B4A1] had a conversation with [PERSOON_C7D2]". Because the pseudonyms are consistent, it does see that five reports concern the same two people.

Four situations from practice

An employment law question about an ongoing file

An HR adviser is preparing a conversation about an employee who has not been performing well for some time. She wants to know which arrangements have been made over the past two years and whether an improvement plan has been recorded. In PrivaSearch she asks: "What arrangements about points for improvement are in the conversation reports?" The answer comes with the passages and the reports they are in. She rereads them herself before doing anything with them.

An absence file and reintegration

In the case of long-term absence, the arrangements about reintegration must be properly recorded. An HR service provider that does this for several employers wants to find quickly which steps have been taken in a file and when. Absence reports sometimes contain descriptions of complaints. Detection is never complete: that is why the colleague in the review looks extra carefully at precisely such passages. Moreover, medical data does not belong in an HR file if the company doctor does not need to share it. Only put documents in a project that belong there according to your own arrangements.

Questions about your own policy

Employees keep asking HR the same questions: how does leave work when moving house, what is the scheme for working from home, which notice period applies. The staff handbook, the collective labour agreement and the schemes contain hardly any personal data, but they are long. In a project with those documents, an HR employee finds the answer with the provision attached, instead of leafing through a hundred pages.

A consultancy with interviews at a client

An organisational consultancy conducts forty interviews at a client and wants to know which themes keep coming back. The reports mention names, positions and departments. After pseudonymisation and review, a consultant can ask the assistant which bottlenecks are mentioned in several interviews, with the source per passage. Note: a unique position in a small department can make someone recognisable, even without a name. The colleague assesses that in the review, and that determines what goes into the report.

What PrivaSearch does and does not do

That fourth row is important. AI that selects applicants or assesses employees' performance is high-risk under Annex III of the AI Act. PrivaSearch is not intended for that: it makes documents searchable and does not make decisions. So do not use the assistant to rank or reject people. The GDPR also gives people the right to human intervention in decisions with significant consequences.

What should you watch for when introducing it?

Work with projects and permissions. Permissions apply per project, and administrators do not get automatic access. That way a manager only sees the files of which he is a member, and a consultant in one client team sees nothing of another client.

Connect only a business account. What PrivaSearch returns to the assistant reaches the provider of that assistant, with pseudonyms instead of names. So connect a business account with a data processing agreement; more on this in Which subscription for business use?.

Do not type names into your assistant. What you type into the assistant yourself goes directly to the provider, bypassing the pseudonymisation. Ask about "this employee", not about a name.

Give every project an end date. After that, access is closed and copies, fragments and pseudonyms are cleared away, unless a legal hold applies. That helps you not to keep files longer than necessary.

Document it. With personnel data, a DPIA is quickly required. How to approach one is explained in The DPIA for AI tools. Pseudonymised data remains personal data for your organisation; why is set out in Pseudonymise or anonymise?.

The way of working step by step is on the page How PrivaSearch works. If you want to see it with your own documents, book a demo.

How do you get started?

Start with the documents that carry the least risk and take the most time: the staff handbook, the collective labour agreement and the schemes. They contain hardly any personal data, and the questions about them come back every week. That way the team learns to work with searching by source, without sensitive files being in a project straight away.

Then expand to files, one kind at a time. Agree who does the review: for personnel files, that is someone who knows the context and sees when a description makes someone recognisable. Record which documents never go into a project, such as medical information that the company doctor does not need to share.

Involve the works council (ondernemingsraad) in good time. A new way of working with personnel data is something the council will want to discuss, even if the system makes no decisions.

Make sure that everyone who searches has completed the short AI literacy training. Without a valid training, the workspace does not open and the connection with the assistant is refused as well. Why that training exists is explained in our article on AI literacy.