Employee Self-Service Agent - GDPR Art. 12-17 SAR, ADA Title III, WCAG 2.1 AA | Gosign
Employee self-service portal plus GDPR Art. 12-17 Subject Access Request plus UK GDPR plus CCPA/CPRA Right to Know plus ADA Title III plus WCAG 2.1 AA plus EU AI Act Article 4 in one platform - cross-jurisdictional self-service across UK + EU + US for HR Operations, Data Protection Officer, Accessibility Officer, Compliance Officer.
Self-service HR portal: GDPR Art. 12-17 Subject Access Request, UK GDPR/DPA 2018, CCPA/CPRA, ADA Title III + WCAG 2.1 AA accessibility - leave/sickness/payslip with eIDAS e-signature.
Analyse your processAuswahl aus über 5.000 Projekten in 25 Jahren Softwareentwicklung
Cross-jurisdictional self-service portal GDPR Art. 12-17 plus UK GDPR plus CCPA/CPRA plus ADA Title III plus WCAG 2.1 AA plus EU AI Act Article 4 in one platform
Cross-jurisdictional employee self-service portal with EU GDPR Art. 12 transparent information + Art. 13-14 information + Art. 15 right of access + Art. 16 right to rectification + Art. 17 right to erasure + Art. 18 right to restriction + Art. 20 right to data portability + Art. 22 prohibition fully automated decision-making + Art. 88 specific employee data + Art. 30 Records of Processing Activities plus UK GDPR + DPA 2018 Section 45 SAR + ICO Subject Access Request guidance + ICO Employment Practices Code plus US California CCPA Civil Code 1798.100-1798.199 + CPRA Right to Know + Right to Delete + Right to Correct + Right to Data Portability + Virginia VCDPA + Colorado CPA + Connecticut CTDPA + 12+ state privacy laws plus US ADA Title III website accessibility + DOJ Final Rule 28 CFR Part 36 effective 2026 + Section 508 Revised + WCAG 2.1 AA + UK Equality Act 2010 Section 20 reasonable adjustments + EU Web Accessibility Directive 2016/2102 + EAA Directive 2019/882 effective 28 June 2025 plus EU AI Act 2024/1689 Article 4 AI literacy + Article 50 transparency chatbot + Article 26 deployer obligations plus eIDAS Regulation 910/2014 qualified electronic signature QSig in self-service applications plus US FLSA + DOL Notification + 29 CFR 825 FMLA Notice + US ERISA + ACA + COBRA Notice plus ISO 27001 + ISO 27701
Outcome: 60 to 80 percent of standard HR inquiries answered without ticket at 12 to 18 minutes relief per case + USD 16-28 cost per inquiry savings + 70 percent automation rate yielding USD 135,000-190,000 per year per 2,000 employees + DSAR 30-day response automation + accessibility WCAG 2.1 AA conformance preventing ADA Title III litigation exposure (DOJ Final Rule 28 CFR Part 36 effective 2026 + class action exposure) + EU AI Act Article 50 transparency chatbot preventing regulatory penalties + eIDAS qualified signature legal certainty + GDPR fines up to 4 percent group revenue or EUR 20 Mio + UK ICO penalties up to GBP 17.5M or 4 percent global turnover + CCPA/CPRA up to USD 7,500 per intentional violation + USD 2,500 per unintentional violation + state AG enforcement + private right of action data breach. EEOC backlog 73,485 charges FY2023 + ICO SAR 30-day response with extension 2 months complex + CCPA/CPRA Right to Know 45-day response with extension 45 days + DSAR fragmented response in legacy systems triggers complaint to ICO + AEPD + CNIL + state AG - centralised self-service portal automates DSAR consolidation + Right to Erasure cascade + accessibility conformance
The agent decomposes employee self-service portal management into 12 deterministic procedural decisions plus 2 ML-augmented intent indicators plus 0 human escalations - each with statute citation plus audit trail plus appeal path.
EEOC backlog 73,485 charges FY2023 plus ICO SAR 30-day response plus CCPA/CPRA Right to Know 45-day response plus ADA Title III website accessibility plus DOJ Final Rule 2026
Cross-jurisdictional employee self-service portal management faces four parallel statutory regimes with substantially different consequences: EU GDPR Art. 12-17 Subject Access Request + Right to Erasure + Right to Data Portability + Art. 22 prohibition fully automated decision-making + Art. 88 employee data with fines up to 4 percent group revenue or EUR 20 Mio. UK GDPR + DPA 2018 Section 45 SAR + ICO Subject Access Request 30-day response + ICO Employment Practices Code Section 4 medical information with UK ICO penalties up to GBP 17.5M or 4 percent global turnover. US California CCPA + CPRA Right to Know + Right to Delete + Right to Correct + Right to Data Portability + Virginia VCDPA + Colorado CPA + Connecticut CTDPA + 12+ state privacy laws with up to USD 7,500 per intentional violation + state AG enforcement + private right of action. US ADA Title III + DOJ Final Rule 28 CFR Part 36 effective 2026 + Section 508 Revised + WCAG 2.1 AA + UK Equality Act Section 20 + EU Web Accessibility Directive 2016/2102 + EAA Directive 2019/882 effective 28 June 2025. EU AI Act 2024/1689 Article 4 AI literacy + Article 50 transparency chatbot + Article 26 deployer obligations + eIDAS Regulation 910/2014 qualified electronic signature QSig. This four-regime constellation means every self-service interaction in an S&P 500 + FTSE 350 + DAX + MDAX corporation or upper mid-market 500-5,000 employees can simultaneously trigger up to four different statutory obligations with cumulative penalty exposure exceeding USD 10M plus class action risk plus regulatory cascade.
Litigation risks GDPR fines plus CCPA/CPRA private right of action plus ADA Title III class action plus EU AI Act Article 50
Cumulative regulatory exposure relevant: GDPR fines up to 4 percent group revenue or EUR 20 Mio + UK ICO penalties up to GBP 17.5M or 4 percent global turnover + 30-day SAR response missed triggers complaint to ICO + AEPD + CNIL + UODO + national DPAs. CCPA/CPRA up to USD 7,500 per intentional violation + USD 2,500 per unintentional violation + state AG enforcement California CPPA + private right of action data breach USD 100-750 per consumer per incident + class action exposure exceeding USD 10M; Virginia VCDPA + Colorado CPA + Connecticut CTDPA + Utah UCPA + 12+ state privacy laws with similar but not identical penalty structures. ADA Title III civil penalties up to USD 75,000 first violation + USD 150,000 subsequent violation + state AG coordination + private right of action + class action exposure (Robles v. Domino’s Pizza 2019 + Gil v. Winn-Dixie 2017 + Andrews v. Blick Art Materials 2017) + reasonable accommodation interactive process documentation; UK Public Sector Bodies Accessibility Regulations 2018 Cabinet Office GDS enforcement; EAA Directive 2019/882 effective 28 June 2025 national authority enforcement. EU AI Act Article 99 administrative fines up to EUR 35 Mio or 7 percent global turnover for prohibited AI practices + EUR 15 Mio or 3 percent for high-risk obligations + EUR 7.5 Mio or 1 percent for transparency obligations Article 50 chatbot. eIDAS qualified signature legal certainty + admissibility evidence + retention + legal disputes over signature validity. Cumulative exposure across four regimes plus class action exposure plus reputational damage plus regulatory cascade. The agent prevents litigation exposure through automated DSAR 30-day response + Right to Erasure cascade + accessibility WCAG 2.1 AA conformance + EU AI Act Article 50 transparency chatbot + qualified electronic signature audit trail instead of fragmented forms.
12 deterministic procedural decisions plus 2 ML-augmented intent indicators plus 0 human escalations
The agent decomposes employee self-service portal management into 14 micro-decisions: 12 rule-based, 2 ML-augmented intent indicators, 0 mandatory human escalations (escalation rules route to human specialists for sensitive topics but the agent itself does not require mandatory human approval for portal operation). Each decision documents: step description, decision question, decider classification (R for rule-based, A for ML indicator non-final decision), reasoning with statute citation plus audit trail, appeal path. The 12 R decisions encompass: Identity Verification plus Multi-Factor Authentication, Authorisation Framework plus Data Access Scope, Subject Access Request DSAR plus 30-day Response Calendar, Right to Rectification plus Right to Erasure plus Right to Data Portability, Self-Service Transaction plus Qualified Electronic Signature QSig, Pay Slip Access plus Pay Transparency Auskunft plus W-2 plus P60 Self-Service, Leave Request plus FMLA plus Working Time Directive plus Notice Generation, Sickness Notification plus Statutory Sick Pay plus DOL Notice, Address Change plus Bank Account plus Tax Withholding plus Beneficiary Update, Chatbot Interaction plus EU AI Act Article 50 Transparency plus AI Literacy, Accessibility plus WCAG 2.1 AA plus ADA Title III plus Reasonable Adjustments, Audit Trail plus Decision Logging plus Records of Processing Activities. The 2 A decisions encompass: Inquiry Classification plus Self-Service Channel Routing (NLP intent recognition with retrieval-augmented generation grounded in policy documents), Escalation Routing plus Confidence Threshold plus Topic Sensitivity (ML-augmented topic sensitivity classification grievance + harassment + retaliation + whistleblower + hardship). LLM output indicator not final decision; classification determines downstream channel routing; confidence threshold and escalation rules; mandatory escalation for grievance + harassment + retaliation + whistleblower disclosure to Employee-Relations-Case-Agent Cluster #31.
Why document portals are not enough at four parallel jurisdictions
Most organisations already have document portals. Yet ticket volume remains high. The reason is almost always the same: the portal does not answer questions - it offers forms. Anyone wanting to know whether special leave for a move also applies to an intra-city move finds a PDF of the company policy on the portal. But no answer. Anyone wanting to know their accrued holiday balance finds a leave request form but not the actual balance. Anyone wanting to exercise their GDPR Art. 15 right of access finds a generic privacy policy but no DSAR workflow with 30-day response calendar. The difference between a document portal and a self-service agent is the difference between a library and an advisor. Both have the same knowledge. But only one understands the question and gives an answer that fits the specific situation. Anyone who receives a correct, source-referenced answer within seconds no longer opens a ticket. In projects with genuine answer-capable self-service systems, HR ticket volume regularly drops by more than half. The remaining inquiries are those that require human judgement - and they finally get the attention they deserve.
Edge cases with cross-border DSAR plus mobile accessibility plus AI-augmented chatbot
Complex self-service scenarios are explicitly documented. Cross-border DSAR consolidation under GDPR Art. 15 + UK GDPR + DPA 2018 + CCPA/CPRA Right to Know with redaction third-party data + privileged communications + categories + sources + recipients + retention + rights + automated decision-making logic + 30-day response + 2-month extension. Mobile accessibility under WCAG 2.1 AA + ADA Title III + DOJ Final Rule 28 CFR Part 36 effective 2026 + UK Public Sector Bodies Accessibility Regulations 2018 + EAA Directive 2019/882 effective 28 June 2025 with native iOS + Android apps + assistive technology screen reader VoiceOver + TalkBack + keyboard navigation + reasonable accommodation interactive process. AI-augmented chatbot under EU AI Act Article 4 AI literacy + Article 50 transparency + Article 26 deployer obligations + GDPR Art. 22 with retrieval-augmented generation grounded in verified policy documents + source citations + confidence threshold + escalation rules. Self-service whistleblower channel under EU Whistleblower Directive 2019/1937 + UK PIDA + US SOX 806 + Dodd-Frank §922 with protected reporting channels + retaliation prohibition + reverse burden of proof + 5-year retention. Multi-jurisdictional employees with conflicting privacy regimes plus cross-border data transfer GDPR Chapter V + Standard Contractual Clauses + EU-US Data Privacy Framework + UK IDTA + Schrems II Transfer Impact Assessment.
Integration with Workday + SAP + Oracle + ADP + ServiceNow + Microsoft across US + UK + EU
The agent integrates with the leading global HRIS + Self-Service + Chatbot platforms via API: Workday HCM Employee Self-Service ESS + Manager Self-Service MSS + Workday Mobile + Workday Help as cloud-native US Fortune 500 market leader. SAP SuccessFactors Employee Central Self-Service + SAP SuccessFactors Mobile + SAP HCM Employee Self-Service + SAP S/4HANA Employee Self-Service + SAP Concur as German Konzern HCM market leader with collective agreement-aware self-service. Oracle HCM Cloud Employee Self-Service + Oracle Mobile + Oracle Recruiting Cloud as enterprise HCM tightly integrated with Oracle ERP. ADP Workforce Now Employee Self-Service + ADP Mobile + ADP Smart Compliance for US payroll + ACA reporting + COBRA Notice. BambooHR Employee Self-Service + Personio HRIS + Personio Self-Service + ServiceNow HR Service Delivery + ServiceNow Employee Center + ServiceNow Now Assist HR Chatbot + Microsoft Dynamics 365 HR + Microsoft Viva + Microsoft Copilot HR + Microsoft Teams HR Bots for mid-market self-service with EU + UK + US workflows. OpenAI ChatGPT Enterprise HR Bot + Glean HR + Anthropic Claude Enterprise + Slack HR Bots as LLM-powered self-service chatbot platforms with retrieval-augmented generation + EU AI Act Article 4 + Article 50 + GDPR Art. 22 + audit trail. Lattice Self-Service + 15Five + Culture Amp + Sage People Self-Service + Sage HR + Bridge LMS + Eightfold AI Talent Intelligence + Beamery for specialised self-service. Cross-reference to Employee-Data-Management-Agent Cluster #30 + Employee-Relations-Case-Agent Cluster #31 + Audit-Compliance-Agent Cluster #22 + Compliance-Monitoring-Agent Cluster #25.
Micro-Decision Table
Who decides in this agent?
14 decision steps, split by decider
Inquiry Classification plus Self-Service Channel Routing Is the inquiry a fact question (leave balance + pay slip + benefits entitlement + W-2) + rule question (notice period + parental leave + special leave) + judgement question (grievance + conflict + hardship) + transaction request (address change + leave request + sickness notification) + Subject Access Request GDPR Art. 15 + Right to Erasure Art. 17? AI Agent
Natural language classification of employee intent with retrieval-augmented generation grounded in verified policy documents; LLM output indicator not final decision; classification determines downstream channel routing (read-only data lookup + rule engine + escalation to HR specialist + transactional workflow + DSAR workflow); EU AI Act Article 50 transparency obligation chatbot identifies itself; GDPR Art. 22 no fully automated decision-making
Decision Record
Challengeable: Yes - fully documented, reviewable by humans, objection via formal process.
Challengeable by:
Identity Verification plus Authorisation plus Multi-Factor Authentication Which authentication method applies: Single Sign-On SSO + Multi-Factor Authentication MFA + biometric + one-time password OTP + verifiable consumer request CCPA/CPRA + verifiable identity DSAR ICO? Rules Engine Auditor
Rule-based identity verification per inquiry type + jurisdiction; CCPA/CPRA verifiable consumer request (matching attributes + government identification + signed declaration); UK GDPR + DPA 2018 + ICO verifiable identity DSAR proportionate to request; GDPR Art. 12 transparent information; multi-factor authentication for sensitive transactions (address changes + bank account + benefits elections); audit trail of authentication
Decision Record
Challengeable: Yes - rule application verifiable. Objection possible for incorrect data or wrong rule version.
Challengeable by: Auditor
Authorisation Framework plus Data Access Scope Which role + jurisdiction + employee group permits which data scope: own data only + manager view + HR-only + payroll-only + works council restricted + DPO restricted? Rules Engine Vendor
Rule-based authorisation framework per role + jurisdiction + employee group; principle of least privilege; GDPR Art. 5(1)(c) data minimisation + Art. 32 appropriate security measures + Art. 88 employee data; CCPA/CPRA service provider role; UK GDPR + DPA 2018 + ICO Employment Practices Code Section 5 monitoring at work; segregated medical files ADA Title I 42 USC 12112(d) + 29 CFR 1630.14
Decision Record
Challengeable: Yes - rule application verifiable. Objection possible for incorrect data or wrong rule version.
Challengeable by: Vendor
Subject Access Request DSAR plus 30-day Response Calendar What is the SAR scope + 30-day response deadline + 2-month extension + verification + redaction third-party data + categories + sources + recipients + retention + rights + source GDPR Art. 15 + UK GDPR + DPA 2018? Rules Engine Auditor
Rule-based SAR workflow per GDPR Art. 12 transparent information + Art. 15 right of access + UK GDPR + DPA 2018 Section 45 SAR + ICO Subject Access Request guidance; 30-day response one-month + extension 2 months for complex requests with notification; categories of data + recipients + retention + rights + source + automated decision-making; redaction third-party data + privileged communications; CCPA/CPRA Right to Know 45-day response + extension 45 days; cross-jurisdictional consolidation EU + UK + US
Decision Record
Challengeable: Yes - rule application verifiable. Objection possible for incorrect data or wrong rule version.
Challengeable by: Auditor
Right to Rectification plus Right to Erasure plus Right to Data Portability What rectification scope + erasure cascade + data portability format + 30-day response + GDPR Art. 16 + Art. 17 + Art. 20 + CCPA/CPRA Right to Correct + Right to Delete + Right to Data Portability? Rules Engine Auditor
Rule-based rights workflow per GDPR Art. 16 right to rectification + Art. 17 right to erasure (right to be forgotten) + Art. 18 right to restriction + Art. 20 right to data portability structured commonly used machine-readable format + Art. 19 notification obligation; CCPA/CPRA Right to Correct + Right to Delete + Right to Data Portability; cross-system erasure cascade per Records of Processing Activities; retention legal obligation exception (FLSA 3 years + ERISA 6 years + UK DPA 2018 6 years + EEOC 1 year + tax 7 years)
Decision Record
Challengeable: Yes - rule application verifiable. Objection possible for incorrect data or wrong rule version.
Challengeable by: Auditor
Self-Service Transaction plus Qualified Electronic Signature QSig Which signature level applies: Simple Electronic Signature SES + Advanced Electronic Signature AdES + Qualified Electronic Signature QSig per eIDAS + US E-SIGN Act + UETA for transaction type (leave request + sickness + address change + benefits elections + COBRA election)? Rules Engine Vendor
Rule-based signature level selection per transaction type + jurisdiction + risk; eIDAS Regulation 910/2014 SES + AdES + QSig per Annex I; QSig required for legally binding transactions (employment contract amendments + termination + severance agreement); AdES sufficient for routine transactions (leave + sickness); SES sufficient for low-risk transactions (address); US E-SIGN Act 15 USC 7001 + UETA + ESIGN consumer disclosure + intent + retention + admissibility evidence; audit trail of signature
Decision Record
Challengeable: Yes - rule application verifiable. Objection possible for incorrect data or wrong rule version.
Challengeable by: Vendor
Pay Slip Access plus Pay Transparency Auskunft plus W-2 plus P60 Self-Service What payroll document delivery: pay slip + EU Pay Transparency Directive 2023/970 information right + W-2 + 1099 + 1095-C + UK P60 + P45 + electronic delivery consent + retention period? Rules Engine Auditor
Rule-based payroll document delivery per jurisdiction; EU Pay Transparency Directive 2023/970 transposition by 7 June 2026 information right pay levels + average pay levels by sex + criteria for pay determination; US IRS Pub 15 + W-2 electronic delivery consent + 1099 + 1095-C ACA reporting + retention; UK HMRC P60 + P45 + RTI Real Time Information; electronic delivery with consent + revocability + paper option; retention 7 years tax + 6 years ERISA
Decision Record
Challengeable: Yes - rule application verifiable. Objection possible for incorrect data or wrong rule version.
Challengeable by: Auditor
Leave Request plus FMLA plus Working Time Directive plus Notice Generation Which leave type + entitlement calculation + accrual + carryover + notice + Notice of Eligibility + Rights and Responsibilities + Designation Notice + ACAS Code applies? Rules Engine
Rule-based leave entitlement per jurisdiction + employee group; US FMLA 12 weeks unpaid leave + serious health condition + qualifying exigency + military caregiver leave + Notice of Eligibility + Rights and Responsibilities + Designation Notice; EU Working Time Directive 2003/88/EC paid annual leave 4 weeks; UK Working Time Regulations 1998 + 5.6 weeks statutory annual leave; UK ERA 1996 + parental leave + shared parental leave + paternity leave + adoption leave; collective agreement-aware accrual + carryover; manager approval workflow
Decision Record
Challengeable: Yes - rule application verifiable. Objection possible for incorrect data or wrong rule version.
Challengeable by:
Sickness Notification plus Statutory Sick Pay plus DOL Notice Which sickness notification workflow: same-day notification + medical certificate threshold + Statutory Sick Pay + EU sick pay + 6-week continued pay + DOL Notification + ADA reasonable accommodation interactive process? Rules Engine Auditor
Rule-based sickness notification per jurisdiction; UK Statutory Sick Pay SSP GBP 116.75 per week (2024-2025) + qualifying days + waiting days + Self-Certification 7 days + Fit Note Statement; EU national continued pay (typically 4-6 weeks) + sick pay + medical certificate threshold; US DOL Notification + ADA Title I reasonable accommodation interactive process + 29 CFR 1630.2(o); cross-reference to FMLA Notice of Eligibility + Designation Notice; segregated medical files ADA + 29 CFR 1630.14
Decision Record
Challengeable: Yes - rule application verifiable. Objection possible for incorrect data or wrong rule version.
Challengeable by: Auditor
Address Change plus Bank Account plus Tax Withholding plus Beneficiary Update Which transactional workflow: address change + bank account update + tax withholding W-4 + UK PAYE + beneficiary designation + emergency contact + multi-factor authentication + downstream system propagation? Rules Engine Vendor
Rule-based transactional workflow per data type + jurisdiction; address change + downstream propagation payroll + benefits + tax + COBRA + beneficiary; bank account update + multi-factor authentication + verification (test deposit + voided check); tax withholding W-4 + UK PAYE + state withholding + 401(k) deferral; beneficiary designation + ERISA Spousal Consent + emergency contact; audit trail of changes
Decision Record
Challengeable: Yes - rule application verifiable. Objection possible for incorrect data or wrong rule version.
Challengeable by: Vendor
Chatbot Interaction plus EU AI Act Article 50 Transparency plus AI Literacy Does the chatbot identify itself as AI + does it provide source citations + does it escalate at confidence threshold + EU AI Act Article 4 AI literacy + Article 50 transparency + GDPR Art. 22 no automated decisions? Rules Engine
Rule-based chatbot transparency per EU AI Act Regulation 2024/1689 Article 4 AI literacy provider deployer obligations + Article 13 transparency information to deployers + Article 26 deployer obligations + Article 50 transparency obligations chatbot identifies itself + AI-generated content disclosure + interaction with AI system disclosure; GDPR Art. 22 prohibition fully automated decision-making with legal effects + Art. 13-14 information; source citations + confidence threshold + escalation rules
Decision Record
Challengeable: Yes - rule application verifiable. Objection possible for incorrect data or wrong rule version.
Challengeable by:
Escalation Routing plus Confidence Threshold plus Topic Sensitivity Should the inquiry escalate to HR specialist by topic (grievance + harassment + retaliation + whistleblower + hardship) + jurisdiction + escalation level + ACAS Code + EU Whistleblower Directive 2019/1937 protected channel? AI Agent
ML-augmented confidence threshold and topic sensitivity classification with NLP intent recognition; LLM output indicator not final decision; topic sensitivity classification mandatory escalation grievance + harassment + retaliation + whistleblower + hardship + accessibility complaint; EU Whistleblower Directive 2019/1937 protected reporting channel + UK PIDA + US SOX 806 mandatory channel; cross-reference to Employee-Relations-Case-Agent Cluster #31 + Employee-Data-Management-Agent Cluster #30
Decision Record
Challengeable: Yes - fully documented, reviewable by humans, objection via formal process.
Challengeable by:
Accessibility plus WCAG 2.1 AA plus ADA Title III plus Reasonable Adjustments Does the self-service portal conform to WCAG 2.1 AA + ADA Title III + Section 508 + UK Equality Act Section 20 reasonable adjustments + EU Web Accessibility Directive + reasonable accommodation interactive process? Rules Engine Auditor
Rule-based accessibility conformance per WCAG 2.1 AA (4 principles perceivable + operable + understandable + robust + 50 success criteria) + ADA Title III + DOJ Final Rule 28 CFR Part 36 + Section 508 Revised + UK Equality Act 2010 Section 20 reasonable adjustments + Section 21 + UK Public Sector Bodies Accessibility Regulations 2018 + EN 301 549 V3.2.1 + EU Web Accessibility Directive 2016/2102 + EAA Directive 2019/882 effective 28 June 2025; reasonable accommodation interactive process for individual employee requests
Decision Record
Challengeable: Yes - rule application verifiable. Objection possible for incorrect data or wrong rule version.
Challengeable by: Auditor
Audit Trail plus Decision Logging plus Records of Processing Activities Are all interactions + transactions + DSARs + decisions logged with reasoning + timestamp + employee identity + outcome + retention 5 years + Records of Processing Activities GDPR Art. 30? Rules Engine Vendor
Rule-based audit trail with decision logging per interaction + transaction + DSAR + escalation + reasoning + timestamp + employee identity + outcome + GDPR Art. 30 Records of Processing Activities + Art. 5(1)(e) storage limitation + Art. 5(2) accountability principle; retention case-specific (FLSA 3 years + ERISA 6 years + UK DPA 2018 6 years + EEOC 1 year + EU Whistleblower Directive 5-year retention + GDPR Art. 5(1)(e) storage limitation); cross-reference to Audit-Compliance-Agent Cluster #22
Decision Record
Challengeable: Yes - rule application verifiable. Objection possible for incorrect data or wrong rule version.
Challengeable by: Vendor
Decision Record and Right to Challenge
Every decision this agent makes or prepares is documented in a complete decision record. Affected employees can review, understand, and challenge every individual decision.
Does this agent fit your process?
We analyse your specific HR process and show how this agent fits into your system landscape. 30 minutes, no preparation needed.
Analyse your processGovernance Notes
Assessment
Prerequisites
- Self-Service Portal Integration with Workday HCM ESS + SAP SuccessFactors Employee Central + Oracle HCM Cloud + ADP Workforce Now + BambooHR + Personio + ServiceNow HR + Microsoft Dynamics 365 HR with Read/Write access to employee master data + payroll + benefits + leave + GDPR Art. 12-22 + Art. 88 + UK GDPR + DPA 2018 + ICO Employment Practices Code + CCPA/CPRA service provider role
- Subject Access Request DSAR Workflow with 30-day response calendar + 2-month extension + verifiable identity + redaction third-party data + privileged communications + categories + sources + recipients + retention + rights + automated decision-making + cross-system DSAR consolidation + GDPR Art. 12 + Art. 15 + UK GDPR + DPA 2018 + ICO SAR guidance + CCPA/CPRA 45-day Right to Know + extension 45 days
- Right to Erasure plus Right to Rectification plus Right to Data Portability with cross-system cascade per Records of Processing Activities + GDPR Art. 16 + Art. 17 + Art. 18 + Art. 19 notification + Art. 20 structured commonly used machine-readable format + CCPA/CPRA Right to Correct + Right to Delete + Right to Data Portability + retention legal obligation exception (FLSA 3 years + ERISA 6 years + UK DPA 2018 6 years + EEOC 1 year + tax 7 years)
- Accessibility Conformance with WCAG 2.1 AA (4 principles perceivable + operable + understandable + robust + 50 success criteria + automated testing axe-core + Lighthouse + manual testing assistive technology screen reader keyboard navigation) + ADA Title III + DOJ Final Rule 28 CFR Part 36 + Section 508 Revised + UK Equality Act Section 20 reasonable adjustments + UK Public Sector Bodies Accessibility Regulations 2018 + EU Web Accessibility Directive + EAA Directive 2019/882 effective 28 June 2025
- Identity Verification plus Authorisation with Single Sign-On SSO + Multi-Factor Authentication MFA + biometric + one-time password OTP + verifiable consumer request CCPA/CPRA + verifiable identity DSAR ICO + audit trail authentication + role-based authorisation principle of least privilege + GDPR Art. 5(1)(c) data minimisation + Art. 32 appropriate security measures
- Qualified Electronic Signature QSig Integration with eIDAS Regulation 910/2014 Trust Service Provider TSP + ETSI EN 319 411 + ETSI EN 319 412 + UK eIDAS Regulations 2016 + US E-SIGN Act + UETA + ESIGN consumer disclosure + intent + retention + admissibility evidence + signature level selection (SES + AdES + QSig) per transaction risk + audit trail signature
- EU AI Act Compliance with Article 4 AI literacy provider deployer obligations + Article 13 transparency information + Article 26 deployer obligations + Article 50 transparency obligations chatbot + GDPR Art. 22 prohibition fully automated decision-making + Article 13-14 information + source citations + confidence threshold + escalation rules + audit trail of chatbot interactions
- Records of Processing Activities GDPR Art. 30 + Cross-System Inventory of personal data + categories + sources + recipients + retention + cross-border transfers + DPIA Article 35 + Standard Contractual Clauses + EU-US Data Privacy Framework + UK IDTA + Schrems II Transfer Impact Assessment + cross-reference to Employee-Data-Management-Agent Cluster #30
What this assessment contains: 9 slides for your leadership team
Personalised with your numbers. Generated in 2 minutes directly in your browser. No upload, no login.
- 1
Title slide - Process name, decision points, automation potential
- 2
Executive summary - FTE freed, cost per transaction before/after, break-even date, cost of waiting
- 3
Current state - Transaction volume, error costs, growth scenario with FTE comparison
- 4
Solution architecture - Human - rules engine - AI agent with specific decision points
- 5
Governance - EU AI Act, works council, audit trail - with traffic light status
- 6
Risk analysis - 5 risks with likelihood, impact and mitigation
- 7
Roadmap - 3-phase plan with concrete calendar dates and Go/No-Go
- 8
Business case - 3-scenario comparison (do nothing/hire/automate) plus 3×3 sensitivity matrix
- 9
Discussion proposal - Concrete next steps with timeline and responsibilities
Includes: 3-scenario comparison
Do nothing vs. new hire vs. automation - with your salary level, your error rate and your growth plan. The one slide your CFO wants to see first.
Show calculation methodology
Hourly rate: Annual salary (your input) × 1.3 employer burden ÷ 1,720 annual work hours
Savings: Transactions × 12 × automation rate × minutes/transaction × hourly rate × economic factor
Quality ROI: Error reduction × transactions × 12 × EUR 260/error (APQC Open Standards Benchmarking)
FTE: Saved hours ÷ 1,720 annual work hours
Break-Even: Benchmark investment ÷ monthly combined savings (efficiency + quality)
New hire: Annual salary × 1.3 + EUR 12,000 recruiting per FTE
All data stays in your browser. Nothing is transmitted to any server.
Employee Self-Service Agent - GDPR Art. 12-17 SAR, ADA Title III, WCAG 2.1 AA | Gosign
Initial assessment for your leadership team
A thorough initial assessment in 2 minutes - with your numbers, your risk profile and industry benchmarks. No vendor logo, no sales pitch.
All data stays in your browser. Nothing is transmitted.
Related Pages
Related Agents
Employee Data Management Agent - GDPR Art. 88, UK GDPR, CCPA/CPRA | Gosign
Employee master data plus EU GDPR Art. 5+9+22+88 plus UK GDPR plus CCPA/CPRA Right to Know plus 12+ state privacy laws plus HIPAA plus DPIA plus RAT plus Article 28 DPA plus Master Data Management in one platform - cross-jurisdictional centralised employee data across US + UK + EU for HR Operations, Data Protection Officer, CISO, Works Council and General Counsel.
HR Document Management Agent - GDPR Art. 15-17, IRS 26 CFR 1.6001-1, eIDAS | Gosign
Cross-jurisdictional electronic personnel file platform plus GDPR Article 15 Right of Access plus Article 17 Right to Erasure plus IRS 26 CFR 1.6001-1 plus ADEA 3 years plus UK ICO Subject Access Request plus eIDAS qualified electronic signature plus ESIGN Act plus UETA plus EU AI Act Article 4 - retention compliance built in across UK + EU + US for CHRO, HR Director, Data Protection Officer, Compliance Officer, Records Manager, Internal Audit.
Sick Leave Processing Agent - FMLA, UK SSP, HIPAA Privacy Rule | Gosign
Cross-jurisdictional sick leave platform plus US ADA + ADAAA + FMLA plus State Paid Family Leave plus UK Statutory Sick Pay 116.75 GBP per week plus Med 3 Fit Notes plus EU GDPR Article 88 plus HIPAA Privacy Rule plus AICPA SOC 2 Type II plus ISO 30414 - 60 seconds processing instead of three weeks postal delay across UK + EU + US for CHRO, HR Director, Occupational Health, DPO, Compliance Officer, Internal Audit.
Frequently Asked Questions
How does GDPR Art. 15 Subject Access Request differ from UK GDPR + DPA 2018 SAR and US California CCPA/CPRA Right to Know?
Three parallel privacy frameworks with different mechanics for employee data access requests. EU GDPR Regulation 2016/679 Art. 15 right of access: data subject confirmation + copy + categories of data + recipients + retention + rights + source + automated decision-making logic + cross-border transfers + 30-day response one-month + extension 2 months for complex requests with notification + free first copy + reasonable fee subsequent + electronic format. UK GDPR + DPA 2018 Section 45 SAR + ICO Subject Access Request guidance: identical scope to EU GDPR Art. 15 + 30-day response + 2-month extension + ICO Employment Practices Code Section 4 medical information + redaction third-party data + privileged communications + verifiable identity proportionate. US California CCPA Civil Code 1798.100-1798.199 + CPRA Proposition 24 Right to Know: categories of personal information + sources + business purposes + 45-day response + extension 45 days + verifiable consumer request + employee carve-out expired 1 January 2023 + California Privacy Protection Agency CPPA enforcement. State variations Virginia VCDPA + Colorado CPA + Connecticut CTDPA + Utah UCPA + 12+ state privacy laws with similar but not identical mechanics. The agent automates DSAR consolidation across EU + UK + US with 30-day calendar + 2-month extension + redaction third-party + categories + sources + recipients + retention + rights + automated decision-making logic + cross-system DSAR consolidation.
How does EU Pay Transparency Directive 2023/970 transposition by 7 June 2026 affect employee self-service Pay Transparency Auskunft?
EU Pay Transparency Directive 2023/970 transposition by 7 June 2026 requires employers to provide pay transparency information to employees. Information right: pay levels + average pay levels by sex + criteria for pay determination + pay progression. Employee right to request: own pay level + average pay levels by sex for same work or work of equal value + pay determination criteria + pay progression. Reporting obligation: 100+ employees biennial reporting + 250+ employees annual reporting + gender pay gap by category of worker + reasons for gap exceeding 5 percent + remedial action. Pay transparency in recruitment: pay range disclosure + ban on asking salary history. Burden of proof reversal: complainant establishes facts + employer proves no discrimination. UK Pay Transparency Reporting Regulations 2017 (existing) + UK Equal Pay Act + Section 78 Equality Act 2010 + 250+ employees gender pay gap reporting. US California Pay Transparency Law SB 1162 + Colorado Equal Pay for Equal Work Act + New York State Pay Transparency Law + Washington State Pay Transparency Law + Illinois Equal Pay Act + Massachusetts Equal Pay Act + state-specific salary range disclosure in job postings. The agent automates Pay Transparency Auskunft via self-service portal with own pay level + average pay levels by sex + criteria for pay determination + pay progression + 30-day response + cross-reference to Compensation-Benchmarking-Agent Cluster #26.
How does ADA Title III website accessibility plus DOJ Final Rule 28 CFR Part 36 effective 2026 plus WCAG 2.1 AA apply to self-service portal?
US ADA Title III Americans with Disabilities Act 42 USC 12181-12189 prohibits discrimination on the basis of disability in places of public accommodation including websites. DOJ Final Rule 28 CFR Part 36 effective 2026 requires websites of public accommodations to conform to WCAG 2.1 AA Web Content Accessibility Guidelines. WCAG 2.1 AA conformance: 4 principles perceivable + operable + understandable + robust + 50 success criteria including text alternatives + captions + adaptable + distinguishable + keyboard accessible + sufficient time + seizures and physical reactions + navigable + readable + predictable + input assistance + compatible. US Section 508 Rehabilitation Act 29 USC 794d + 36 CFR Part 1194 Revised Section 508 Standards federal contractor + WCAG 2.1 AA. UK Equality Act 2010 Section 20 reasonable adjustments + Section 21 failure to make reasonable adjustments + UK Public Sector Bodies (Websites and Mobile Applications) Accessibility Regulations 2018 + EN 301 549 V3.2.1 + WCAG 2.1 AA. EU Web Accessibility Directive 2016/2102 + EAA Directive 2019/882 effective 28 June 2025 + WCAG 2.1 AA. ADA Title I 42 USC 12112 employment + reasonable accommodation interactive process + 29 CFR 1630.2(o) for individual employee requests. Litigation exposure: Title III civil penalties up to USD 75,000 first violation + USD 150,000 subsequent + state AG coordination + private right of action + class action exposure (Robles v. Domino's Pizza 2019 + Gil v. Winn-Dixie 2017 + Andrews v. Blick Art Materials 2017). The agent automates WCAG 2.1 AA conformance with automated testing axe-core + Lighthouse + manual testing assistive technology screen reader keyboard navigation + reasonable accommodation interactive process + accessibility statement + audit trail.
How does EU AI Act Article 4 AI literacy plus Article 50 transparency chatbot plus GDPR Art. 22 apply to self-service chatbot?
EU AI Act Regulation 2024/1689 Article 4 AI literacy provider deployer obligations require providers and deployers to ensure sufficient level of AI literacy among staff and other persons dealing with AI systems on their behalf. Article 50 transparency obligations: providers ensure AI systems intended to interact with natural persons inform that they are interacting with AI system + biometric categorisation + emotion recognition + AI-generated content disclosure deepfakes + text published on matter of public interest. Article 26 deployer obligations: appropriate technical and organisational measures + human oversight + monitoring + record-keeping + transparency to affected persons. Article 13 transparency information to deployers + Article 14 human oversight + Article 86 right to explanation high-risk AI decisions. GDPR Art. 22 prohibition fully automated decision-making with legal effects or similarly significantly affect data subjects + Art. 22(2) exceptions necessary for contract + authorised by Union or Member State law with safeguards + explicit consent + Art. 22(3) safeguards right to human intervention + right to express point of view + right to contest decision. The Self-Service Agent NOT classified as EU AI Act high-risk Annex III Point 4 HR-Recruitment AI System (information-only without making employment-affecting decisions). The agent enforces Article 50 transparency with chatbot identifies itself as AI + AI-generated content disclosure + interaction with AI system disclosure + source citations grounded in policy documents + confidence threshold + escalation to human specialist + GDPR Art. 22 no automated decisions + audit trail + cross-reference to Employee-Data-Management-Agent Cluster #30.
How does eIDAS qualified electronic signature QSig plus US E-SIGN Act plus UETA apply to self-service applications (Leave + Sickness + Address changes)?
eIDAS Regulation 910/2014 establishes three signature levels per Annex I: Simple Electronic Signature SES (data in electronic form + attached or logically associated + indicating signing); Advanced Electronic Signature AdES (uniquely linked to signatory + capable of identifying + created using means under sole control + linked in such a way that subsequent change detectable per Article 26); Qualified Electronic Signature QSig (AdES + qualified certificate + qualified signature creation device per Article 28). Trust Service Providers TSP + ETSI EN 319 411 + ETSI EN 319 412 + UK eIDAS Regulations 2016 post-Brexit. US E-SIGN Act 15 USC 7001 Electronic Signatures in Global and National Commerce Act + UETA Uniform Electronic Transactions Act state-level adoption + ESIGN consumer disclosure + intent to conduct electronically + accuracy of records + retention + admissibility evidence. Signature level selection per transaction type and risk: SES sufficient for low-risk transactions (address change + emergency contact + read-only acknowledgement); AdES sufficient for routine transactions (leave request + sickness notification + W-4 withholding + 401(k) deferral + benefits elections + acknowledgement of policy); QSig required for legally binding transactions (employment contract amendments + termination acceptance + severance agreement + non-compete acknowledgement + intellectual property assignment). Audit trail of signature: signatory identity + timestamp + IP address + signed document hash + certificate validity + retention. The agent automates signature level selection per transaction type + jurisdiction + risk + audit trail + cross-reference to HR-Document-Management-Agent.
How does the Employee Self-Service Agent differ from the Employee Relations Case Agent and Employee Data Management Agent?
All three agents work in HR governance but with different focuses. The Employee Self-Service Agent (this one) focuses on employee self-service portal lifecycle + GDPR Art. 12-17 Subject Access Request + Right to Erasure + Right to Data Portability + Self-Service Applications (Leave + Sickness + Certifications + Address changes) + Pay Slip + Pay Transparency Auskunft + qualified electronic signature QSig + Mobile App + Chatbot + ADA Title III + WCAG 2.1 AA accessibility + EU AI Act Article 4 AI literacy + Article 50 transparency. The Employee Relations Case Agent (Cluster #31) focuses on case management lifecycle + grievance + harassment investigation + disciplinary action + whistleblower + retaliation + termination preparation + Performance Improvement Plan PIP + Severance Agreement + Class Action Risk Mitigation + Title VII Faragher-Ellerth Affirmative Defense + EEOC McDonnell Douglas burden-shifting + UK Equality Act Section 109 employer liability + ACAS Code of Practice + EU Whistleblower Directive 2019/1937. The Employee Data Management Agent (Cluster #30) focuses on employee data lifecycle management + Master Data synchronisation + GDPR Art. 5+9+22+88 + UK GDPR + CCPA/CPRA + 12+ state privacy laws + HIPAA + ADA + ERISA + FCRA + Privacy by Design + Pseudonymisation + Encryption + Right to Erasure cross-system cascade + DSAR + DPIA + RAT + Article 28 DPA + Cross-Border Transfer + Breach Notification 72h. Cross-reference: Employee Self-Service Agent provides employee-facing portal that triggers Employee Data Management Agent for DSAR + Right to Erasure + cross-system propagation. Employee Self-Service Agent escalates judgement questions (grievance + harassment + retaliation + whistleblower) to Employee Relations Case Agent. Consistency check: all three agents reference GDPR Art. 12-22 + Art. 88 + UK GDPR + CCPA/CPRA. The Employee Self-Service Agent is the gateway to the entire HR self-service ecosystem with information provision + transactional workflows + accessibility + AI transparency.
How does the agent handle EU Whistleblower Directive 2019/1937 self-service whistleblower channel plus UK PIDA plus US SOX 806 mandatory escalation?
The self-service portal includes a dedicated whistleblower channel as required by EU Whistleblower Directive 2019/1937. Three parallel whistleblower frameworks coexist. EU Whistleblower Directive 2019/1937 (transposition national law): protected reporting channels (internal + external + public) + 100+ employee threshold + retaliation prohibition + reverse burden of proof Article 21 + 7-day acknowledgement + 3-month feedback + 5-year retention + cross-border reporting Article 13 + qualifying disclosures (Union law breaches + financial services + product safety + environment + public procurement + AML + consumer protection + data protection + privacy + nuclear safety + food safety + animal welfare + public health + competition law + corporate tax + Union financial interests). UK PIDA 1998 Public Interest Disclosure Act + ERA 1996 Section 43A-43L: qualifying disclosures (criminal offence + legal obligation breach + miscarriage of justice + health and safety + environmental damage + concealment) + reasonable belief test + public interest test (Chesterton Global Ltd v Nurmohamed 2017) + protected disclosures internal + prescribed persons + ERA Section 47B detriment + Section 103A automatic unfair dismissal. US SOX 806 18 USC 1514A whistleblower protection publicly traded companies + Dodd-Frank §922 15 USC 78u-6 SEC Whistleblower Program 10-30 percent monetary award sanctions exceeding USD 1M + 2024 DOJ Whistleblower Award Program criminal corporate misconduct + 22 sectoral whistleblower statutes administered by OSHA Whistleblower Protection Program. The Self-Service Agent identifies whistleblower disclosure intent + routes to protected reporting channel + maintains confidentiality + tracks reverse burden + escalates to compliance function and outside counsel where required + cross-reference to Employee-Relations-Case-Agent Cluster #31.
What Happens Next?
30 minutes
Initial call
We analyse your process and identify the optimal starting point.
1 week
Discover
Mapping your decision logic. Rule sets documented, Decision Layer designed.
3-4 weeks
Build
Production agent in your infrastructure. Governance, audit trail, cert-ready from day 1.
12-18 months
Self-sufficient
Full access to source code, prompts and rule versions. No vendor lock-in.
Implement This Agent?
We assess your process landscape and show how this agent fits into your infrastructure.