Rome wasn’t built in a day.
Neither was the vast set of capabilities that we now adore data analytics and automation tools for. Their functioning requires plenty of data parsing, analysis and then evaluation. Data that most companies do feel open to providing, should the results be good.
However, not all data is the same, especially when it involves people. People data analytics tools make use of information pertaining to employees, providing valuable insights. But what data should and shouldn’t be used? Can one justify using all they know about their employees as simple metrics?
Where does one draw the line between insight and intrusion?
What, Why, and Who
While utilising data to predict future trends and outcomes is indeed useful, one must pay attention to what data they are using and for what purpose. Abhinav Tewari, Manager – People and Culture Analytics for Aristocrat, points towards the three Ws to assess and resolve this dilemma.
“People analytics becomes intrusive the moment we start asking “what” data we can collect before we’ve understood “why ”we need it. That’s really where the trouble begins. When the purpose isn’t clear, even well-designed analytics can start to feel like monitoring rather than support. For me, the “why” is the anchor because it keeps the entire practice grounded in intent and value,” Tewari explained.
When it comes to ethics in people analytics, just because you could, doesn’t mean you should. An employer, owing to what they do know about the employee, can indeed learn much more. But this power comes with a sense of morality and responsibility. And above all, it comes with a sense of trust that employees place in their employers, trusting that their sensitive data will remain confidential and secure.
“Once the purpose is clear, only then should we decide what data is necessary. Collecting everything simply because it’s possible is where organisations often cross the line. Ethical analytics is intentional and selective, and it’s not a data-gathering exercise,” emphasised Tewari.
Given the sensitive nature of people’s data, it is also imperative that companies maintain a strict level of hierarchy in who can access what data. Not all leaders need to have access to people-related data. Keeping this sensitive circle of data holders small and honest is crucial in preventing data leaks and holding people accountable should something go wrong.
“After the why and the what, the next question is “who” will have access to the information. Not all data carries the same level of sensitivity, and access shouldn’t be universal. Even within people analytics teams, visibility needs to be thoughtful and limited,” Tewari elaborated. “Some datasets are far more personal than they appear, and mishandling them can break trust instantly.”
The Ethical Grey Areas in HR Data
So, what can and can’t a company use for people analytics? What purpose is “right” or “wrong?” The answers to these questions lie in observing a fine boundary that can often be hard to interpret. After all, the very purpose of people analytics is to observe people’s behaviour, but what behaviour should a company have access to?
“Any data that cannot be justified with a clear business purpose and a genuine employee benefit should never be collected in the first place. Just because we can collect or measure something doesn’t automatically mean we should,” pointed out Tewari.
“Technology makes it incredibly easy to capture almost anything, but ethics require us to pause and ask whether the data truly serves people or simply intrudes on their personal space. The moment data collection drifts away from purpose, we’ve already crossed a line.”
Consider an example: You are an employer wondering what your employees feel about the company’s culture and atmosphere. For this purpose, you can conduct an anonymous survey, asking the questions that matter and evaluating the data gathered from the same. What you shouldn’t do is surveil private conversations that employees might be having through accessible channels.
In the first case, you provide employees with a safe space to learn about the company’s culture. The data you collect has been given with content and thorough consideration. It also showcases that the company does indeed care about its employees.
In the second case, you are violating the privacy of employees and are using underhanded methods, no matter what your intentions are. The insights you do gather from this will likely be highly biased depending upon the context of the conversation, making it both imperfect and immoral.
“This is why transparency matters so much,” said Tewari. “When employees understand why data is collected, what is being captured, and who will see it, the entire process feels supportive rather than intrusive.”
A popular use of people analytics is often to predict attrition. But observing a pattern becomes vastly different when you label someone a “flight risk” and might start treating them differently, based only on passive analysis. Another example is collecting wellness data versus violating health privacy. In essence, when transparency and consent are missing, it becomes nigh impossible to justify the usage of an analytics tool on people’s data.
The Role of Leadership and Policy
Leadership and policymakers play an essential role in maintaining the balance between insight and intrusion. This can be done via:
- Embedding ethics into HR analytics strategy.
- Creating cross-functional oversight committees, including departments like HR, legal, and tech.
- Establishing data ethics frameworks and training from the very start.
- Encouraging employees to question or report unethical data use.
One key aspect to keep in mind is that often, morality can be subjective, rather than objective. As such, having clear guidelines in place, along with having multiple decision makers, can help in finding a truly moral solution.
“Geography also plays a significant role,” mused Tewari. “What is acceptable in one region may be completely inappropriate or even illegal in another. Respecting local norms and regulations is not just about compliance; it is about acknowledging that employees are individuals with their own boundaries, expectations, and cultural contexts.”
In India specifically, laws like the Digital Personal Data Protection (DPDP) Act, 2023, provide a much-needed framework for how organisations should collect, process, and protect employee data.
The DPDP Act dictates that employers can only use your personal data if:
- You’ve clearly said yes, that is, you’ve given your consent.
- Or it falls under certain “legitimate uses”. For example, if you’ve shared your data on your own and haven’t specifically said no.
Moreover, the act bars acceptance of vague or forced approvals. Consent is only considered valid when it is:
- Given freely without any pressure.
- Clear and specific, you should know exactly what you’re agreeing to.
- Based on real understanding, not hidden in fine print.
- Shown through a clear action like ticking a box or clicking “I agree.”
Building Ethical Guardrails
The dilemma of using people analytics can be easily addressed with simple yet effective guardrails. Keeping these pointers in mind helps you and the company not only be compliant but also avoid unnecessary data collection and expenditure.
“A truly ethical people analytics strategy, for me, is one that never forgets that we are working with people, not data points. It begins with clarity of purpose: we use data only when it genuinely helps someone make better decisions or creates a better experience at work,” said Tewari.
“From there, ethics becomes a way of operating, not a checklist. We stay transparent, we respect boundaries, and we design our systems so that privacy and fairness are built in from the start. We question our assumptions, we test for bias, and we make sure access to data is always thoughtful and limited. At the heart of it, an ethical strategy is one that earns trust through its actions, not its promises.”
Transparency
When collecting any data from employees, be open about what you are collecting and why. Explain the purpose behind the process and be ready to answer any questions that may arise.
Consent
Always be thorough in obtaining the consent of the employees when collecting or using data pertaining to them. Even if you may already have the data, it is imperative that you ask them before using it to gather insights. The employee may have consented to give you their data initially for one type of study, but that does not necessarily mean they will be open to participating in all.
Data Minimisation
Do not go overboard when collecting data from employees. Even if an employee is willing to share their details, it does not mean you should collect more than what is needed. Similarly, discourage employees from being open about sensitive details, especially in the workplace.
Ownership
Once the data is obtained, companies need to be thorough about labelling their ownership as well as access. An employee’s data, even though stored in your database, still belongs to them. Any insights you gather using that data do indeed belong to you, but not the original data itself.
Access
Make sure that the list of people who can access sensitive data is small and useful. Simply because someone is high up in the hierarchy does not mean they require access to all the people’s data that a company has.
Bias Checks
Auditing algorithms for fairness and representation is crucial when using employee data. Any biases from predictive tools might result in the misuse of employee data to generate insights that are not truthful.
Human Oversight
Analytics tools are indeed highly beneficial in gathering analytics, especially when incorporating AI. However, it remains imperative that data doesn’t replace judgment. A human presence should ultimately approve any decisions.
The Hard Limits
While some of the data and its usage can fall into grey areas, there is still information that should perhaps never be used for data analytics and information. Even their collection might not be ethically and/or legally defensible.
“Certain types of information should remain off-limits regardless of how advanced our tools become,” explained Tewari.
“Medical or genetic details that go beyond what is required for workplace accommodations, personal communications that were never intended for organisational review, and deeply personal attributes such as political beliefs, religious views, or union affiliations have no place in analytics.”
Tewari added that “the same applies to biometric or physiological signals like heart rate, stress levels, or facial expressions, unless the role is genuinely safety-critical. And anything collected through covert means, whether it is webcam monitoring or location tracking outside of work, undermines trust instantly.”
In other words, anything that does not truly pertain to the company’s work should never be considered as a dataset for analytics. Even if one’s health may have impacted one’s work, that is a matter of personal analysis and feedback.
“At its core, people analytics should never intrude into areas that belong to an individual’s private life. Respecting personal space is not only an ethical responsibility but also what allows analytics to remain a tool for empowerment rather than control,” shared Tewari.
In the End…
Balancing insight without being intrusive is essential for good and effective data analytics practice. It also adds to the company’s image as a brand as well as an employer. Maintaining transparency showcases your stance on accountability as well as how much you respect your employees.
Indeed, ethics is not a limitation. Rather, it is the foundation on which one must build trust and sustainable insight. The ultimate true goal of data analytics is to obtain data to make humane and fair decisions, something that goes hand in hand with transparency, consent, and accountability.
