Review Your Company’s AI Policy
The first and most crucial step is to understand your employer's official stance. Companies are increasingly creating AI usage policies that outline the rules for using AI tools. These documents should provide clear guidelines on what is and isn't acceptable.
Look for sections that define which AI tools are approved for work and how they should be used. A good policy will also detail the company's principles on data privacy, fairness, and ethical considerations. If your company doesn't have a specific AI policy, check the general employee handbook, IT guidelines, or code of conduct for clauses on technology use, data handling, and confidentiality. These documents are your baseline for understanding the established rules.
Identify What Data Is Being Collected
Workplace AI can monitor a wide range of activities, including keystrokes, login times, screen recordings, emails, and even webcam feeds for engagement analysis. In India, the Digital Personal Data Protection (DPDP) Act, 2023, gives employees rights regarding their personal data. Your employer, as a “data fiduciary,” should be transparent about what information is being collected and for what specific purpose. You have the right to ask what data is gathered about you. Pay close attention to whether the company is collecting only what is strictly necessary for a legitimate business reason, a principle known as data minimization. Excessive data collection that isn't directly relevant to your job function is a major red flag.
Question the 'Why' Behind the Monitoring
Legitimate monitoring typically has a clear purpose, such as ensuring cybersecurity, preventing fraud, maintaining service quality, or complying with regulations. However, the line is crossed when monitoring becomes continuous surveillance without a narrow, justifiable goal. Don't hesitate to ask your HR department or manager about the business reason for implementing a particular AI tool. Understanding the 'why' helps clarify whether the tool is a reasonable measure for a specific risk—like CCTV in a high-security area—or an intrusive form of general surveillance. The justification for monitoring should always be proportionate to the risk it aims to mitigate.
Clarify Data Security and Access
Knowing what data is collected is only half the battle; you also need to know who has access to it and how it's protected. Ask about the security measures in place, such as encryption and access controls, to safeguard your information. This is especially critical because many employees use unapproved AI tools—a practice known as 'shadow AI'—which can expose sensitive company and personal data. Your employer should have clear rules preventing employees from uploading confidential or proprietary information into public AI models like ChatGPT. Find out how long your data is stored and what the procedures are for its deletion once it's no longer needed for its stated purpose.
Understand the Role of Human Oversight
A critical guardrail against AI-driven errors and bias is human involvement. AI systems can make mistakes or generate flawed assessments. A key question to ask is whether AI is used to assist decisions or to make them autonomously. Best practices dictate that AI tools should not be used to make final employment decisions—such as for performance reviews or disciplinary action—without independent human judgment and review. This human-in-the-loop approach ensures that context, nuance, and fairness are part of the process, protecting employees from potentially biased or inaccurate algorithmic conclusions.
Know Your Rights and How to Act
Under India's DPDP Act, you have several rights, including the right to receive notice about data collection, give informed consent, access your data, correct inaccuracies, and request erasure of data that is no longer needed. If you believe your privacy is being violated, the first step is typically to file an internal complaint with your Data Protection Officer (DPO) or HR department. This creates a formal record. If the issue isn't resolved, you have the right to escalate the complaint to India's Data Protection Board, which can impose significant penalties on non-compliant companies.
