This article answers frequently asked questions about how Personio handles data privacy and security across its AI features. For technical detail on security certifications, subprocessors, and compliance documentation, visit the Personio Trust Center.

Data storage and processing

Is my data used to train AI models?

No. Personio and any third party don't use input data or output data for training purposes. Input and output data isn't shared with any third party except AWS Bedrock for processing purposes.

Where is AI data processed?

All AI processing takes place on Personio's own AWS servers in the EU, using AWS Bedrock. Data is stored in Frankfurt and doesn't leave the EU.

What AI models does Personio use?

Personio uses large language models (LLM) from Anthropic, hosted on AWS Bedrock. It also uses AWS models to power AI capabilities in the platform.

Does AWS Bedrock or the LLM store any personal data?

No. Personal data isn't stored by either AWS Bedrock or the LLM models. A zero storage policy is in force with AWS Bedrock.

Does Personio store data related to my use of AI features?

Yes. Personio stores input and output data for quality assurance and service improvement purposes. This data is never used to train AI models.

For Personio Assistant specifically, Personio uses this data to monitor the quality of answers and identify and fix issues with the Assistant's performance. Without it, Personio cannot detect when something has gone wrong or improve the experience for users. This data is used solely for quality assurance — never for training AI models.

If you don't want your data stored for quality assurance purposes, you can deactivate Personio Assistant in Settings > Account & support > AI features. Opting out of the Assistant is the only way to opt out of this data collection.

If you have previously used Personio Assistant and want your existing data removed, Personio can do this as a one-time deletion. Going forward, continued use of the Assistant requires data collection for quality assurance purposes.

What is input and output data?

Input data is any question or information you submit to a Personio AI feature for processing, for example, a question you ask Personio Assistant. Output data is the response the AI feature generates based on your input. Both may contain personal or business data depending on what you ask and what data Personio has access to.

Are AI features isolated between customers?

Yes. Each customer is fully isolated. Personio AI never accesses data from other customers or mixes information between tenants.

Who owns the output data generated by Personio AI features?

The customer owns all output data generated by Personio AI features. Any output an AI feature generates based on customer input is considered customer data, regardless of whether the input contains personal data.

Access and permissions

Do AI features respect the access permissions set up in Personio?

Yes. All AI features enforce authorization as configured in Personio. For example, an Administrator asking Personio Assistant about headcount sees full company data, a manager sees only their team's data, and an employee without analytics permissions receives no answer. AI-generated content is only visible to people who already have the relevant access rights in Personio.

Is AI-generated content visible to people who shouldn't see it?

No. The same permission rules that apply to the underlying data gate AI outputs. The AI cannot surface information to a user that they cannot already access directly in Personio.

Support AI

What data does Support AI access?

Support AI answers questions about how to use Personio features and helps connect eligible users with the Personio support team. It doesn't access your organization's HR data — employee records, payslips, absence balances, and similar data aren't visible to Support AI. For questions about your personal HR data, use Personio Assistant instead.

Are my Support AI conversations private?

Yes. Your Support AI conversations are only visible to you. They aren't visible to other users in your organization, including Account Owners.

GDPR and compliance

Does Personio AI comply with GDPR?

Yes. The Data Processing Agreement (DPA) between the customer and Personio remains fully applicable to all AI features. The customer acts as controller and Personio acts as processor. For full details, including subprocessor information and Standard Contractual Clauses, visit the Personio Trust Center.

Does Personio have a DPA concluded with AWS for Bedrock?

Yes. The existing Standard Contractual Clauses concluded between Personio and AWS Sarl cover the use of AWS Bedrock. AWS is an existing subprocessor — no new subprocessor notification was required when Bedrock was introduced.

Are Personio AI features compliant with the EU AI Act?

Personio Assistant is considered a Limited Risk AI system under the EU AI Act — the same category as chatbots and content generation tools. It doesn't qualify as a high-risk system. Personio doesn't build its own LLM. It uses and fine-tunes existing models hosted on AWS Bedrock. This means Personio needs to comply with the transparency requirements of the EU AI Act for this category. It isn't subject to the obligations that apply to GPAI model providers.

The Talent Screening Agent is compliant with GDPR Art. 22 and EU AI Act Art. 14. Under the EU AI Act, Personio provides this AI system and your organization acts as the deployer. This means your organization is responsible for using it in a compliant way. This includes choosing appropriate criteria, keeping a human involved in every decision, and following the employment and anti-discrimination laws that apply to your organization.

Responsible AI and bias

How does Personio ensure AI outputs are fair and unbiased?

Personio builds its AI features on its Responsible AI principles, which are designed to produce fair, objective, and inclusive outputs. For AI Performance Summaries specifically, the LLM is instructed to:

• Avoid bias, speculation, and unfounded conclusions.
• Never make assumptions about protected characteristics such as age, gender, or race.
• Flag and down-weight potentially biased language.
• Avoid personality judgments.

Are Personio AI features making decisions on my behalf?

No. Personio AI features don't make decisions autonomously. All outputs are assistive — humans make all final decisions. Always review AI outputs before acting on them.

Customer responsibilities

What are my organization's responsibilities when using Personio AI features?

Customers are solely responsible for:

• Developing internal policies for the appropriate use of Personio AI features and training users on those policies.
• Providing transparency and explainability notices and obtaining all necessary consents required by applicable laws and internal policies.
• Implementing sufficient human oversight for the use of AI features.
• Ensuring the accuracy of data uploaded to Personio that AI features use to produce outputs.

Who is responsible for the accuracy of AI outputs?

Personio AI features only access data that customers provide and upload to Personio. Customers are therefore solely responsible for ensuring that the data the AI uses to produce outputs is accurate. Users should review all outputs before acting on them.