Skip to main content

Bob AI - GDPR, privacy and use of data

  • March 25, 2025
  • 3 replies
  • 138 views

Hi,

We are very interested in testing Bob's AI features but have some concerns regarding data security, specifically about where data is stored, who has access, and exactly what information is shared.

Although we've reviewed the provided documentation, some questions remain:

  1. AI for Reports:

    • Managers will have access to create reports. The documentation mentions that personally identifiable information (PII) from standard fields will be anonymized. However, how will Bob handle PII in custom fields that managers may unknowingly include in their reports? Managers typically do not distinguish between standard and custom fields.

  2. AI for Goals:

    • What type of goal-related information is extracted from Bob? Goals can contain sensitive business strategies (e.g., launching new products or expanding into new markets). Could you clarify what specific goal data is shared, and who will have access to it?

Given our operations in Europe, strict compliance with GDPR is essential, and transparency with employees is critical. As new AI capabilities are introduced, clear documentation specifying precisely what data is shared would be highly beneficial.

Additionally, a dedicated agreement (similar to the Data Processing Agreement but specifically covering AI-related data handling) would be very useful.

Best regards,
Øyvind

    3 replies

    Karen Stewart Longest

    Hi ​@Øyvind Loftheim,

    I’ve got similar questions as well but haven’t been able to find the information. I did turn it on because it made me feel better knowing that the current LLM Processing in the EU. 

    You can read more about data processing for OpenAI in the EU: OpenAI launches data residency in Europe | TechCrunch

    I’m not sure when they started processing it here but if it is being processed in the EU, it SHOULD be compliant. I can’t promise but I’m hoping that it is. I have found it to be helpful for coming up with Key Results for Objectives. 

    I would be interested to know how Bob is ensuring that the information isn’t being leaked. You can review the DPA here: Data Processing Addendum | HiBob 

    If you find out more, please let us know! 

     

     

    Like a pro, I asked ChatGPT haha and here is their recommendation: 

    📌 Recommendation: Bob AI Usage & Data Privacy

    As HiBob users, it's essential to balance innovation with data protection — especially when features like Bob AI rely on third-party processors such as OpenAI. Based on our review of HiBob’s Data Processing Agreement (DPA) and public documentation, here’s what we recommend:

    ✅ Use Bob AI Only If You:

    • Have confirmed what data will be processed via Bob AI and how it will be used.

    • Have reviewed your signed DPA to ensure adequate safeguards are in place (e.g., OpenAI is listed only as a sub-processor if Bob AI is enabled).

    • Have internal guidance or controls on what kinds of data should (or should not) be entered into AI-powered features.

    • Understand that OpenAI is not training its models on your data — but it may still process it to generate outputs.

    • Have conducted a Data Protection Impact Assessment (DPIA) if you're in a highly regulated industry or processing sensitive categories of data.

    ⚠️ Avoid Enabling Bob AI If You:

    • Cannot confirm how or where employee data is being processed.

    • Have not reviewed your DPA or sub-processor list for updates.

    • Handle highly sensitive employee information and lack strong internal controls.

    • Prefer to keep full control over data without sharing it with third-party AI models.

    💡 Our Suggested Next Steps:

    1. Audit your current HiBob setup — Is Bob AI enabled?

    2. Request written confirmation from HiBob about:

      • Whether Bob AI is active in your account.

      • Whether data is shared with OpenAI.

      • If there's an opt-out mechanism.

    3. Circulate internal guidance to HR and managers on appropriate use of AI features.

    4. Engage your legal or privacy team to evaluate any risks specific to your jurisdiction or sector.

     

      Hey all.

      Struggling with the same issue. Any update here ?

      Harshil Boparai
      Bobber

      Hi all - Thanks for your patience here, we’ve tried to answer all of your questions in this article here: 

       

      Terms & ConditionsAccessibility statement