People Intelligence: privacy, limits and responsible use
People Intelligence describes employees, so the limits are part of the product rather than a disclaimer attached to it. This article sets out what is protected, what is deliberately withheld, and what no Insight is allowed to do.
Insights are computed, not generated
This is the first thing to be clear about, because it is frequently assumed otherwise.
People Intelligence Insights, on the dashboard and on the employee profile, are produced by deterministic code running inside the GFoundry platform. They are queries, aggregations and rules. No language model is involved in producing an Insight, and no employee data is sent to an external AI provider in order to draw one. The same inputs always produce the same card.
That makes them different from Gi's AI agents, such as the Data Analyst Agent, which do use an external AI provider. It is worth knowing which one you are discussing when the question comes up.
The Data Analyst Agent is a separate tool
Charts you pin in the Data Analyst Agent stay in that agent's Pinned charts list; they are not added to your People Intelligence dashboard. When you use the agent, employee names and emails are replaced by pseudonymous identifiers before anything is sent to the AI provider, and the real names are put back inside GFoundry after the answer comes back. See the Data Analyst Agent article for the details.
If your dashboard shows an older card labelled Insight saved from chat, that chart came from a conversation with the agent. It is a frozen snapshot and is never recomputed.
Excel exports carry real names
The Data Analyst Agent can also produce Excel files. Unlike anything on the dashboard, those files do contain real employee names, because a file you are going to act on is useless without them. The names are filled in inside GFoundry and never pass through the AI provider. The files are scoped to your organisation, and the download link is valid for 24 hours and then expires.
Practically, an export is the point at which employee data leaves the platform's controls and enters your laptop, your email and your shared drives. Treat it the way you treat any other HR file, because after the download that is exactly what it is.
Who can see People Intelligence
People Intelligence and the Talent Insights tab on employee profiles are available only when they have been enabled for your organisation, and only to platform administrators and people who hold the Gi assistant manager permission. Your organisation decides who holds that permission.
Anyone with that access sees the whole organisation: People Intelligence does not narrow what someone sees to their own team.
Small groups in anonymous surveys
Insights built on anonymous responses, which are eNPS, wellbeing by team, the Team Health Index and the organisational dimensions, are not computed when you filter them to a segment that is too small: fewer than 10 people for eNPS and wellbeing, fewer than 5 for the Team Health Index and the organisational dimensions. The card says the segment is too small to protect privacy. The whole-organisation view is not affected.
The reason is specific. If someone can filter an anonymous survey down to a four-person team, the promise of anonymity made to those four people is gone, and the next survey will be answered accordingly. This protection is enforced where the data is computed. It cannot be filtered around in the interface. These Insights are also never offered on an individual profile.
Insights that list named employees work differently. They do not apply a minimum group size, because naming people is what those cards are for and a count threshold would protect nobody. What governs them is who is allowed to open People Intelligence. If you believe a colleague can see People Intelligence and should not, raise it with your administrator straight away: that is a permissions matter, not a display preference.
What is deliberately withheld
Several things the platform holds are kept out of People Intelligence on purpose.
Free text people wrote. Development plan action content, goal titles and feedback content are counted and tracked on profile cards but never displayed. An employee writing a development goal is not writing a dashboard entry.
Successor names. Succession coverage appears as a structured status, never as a free-text name.
Manager names carried in the wrong column. Potential review coverage is shown only at organisation level, not per team, because in some organisations that source's team column contains managers' names. Breaking it down would expose personal data through a field that was never meant to carry it.
Behavioural patterns whose wording harms the person described. A defined set of sensitive patterns is never shown on a profile, regardless of whether the underlying signal is present.
Individual exit-risk patterns. Exit-risk patterns are withheld on profiles because the model behind them was withdrawn. When withholding leaves a card with less to show, the card says how many were withheld. "Nothing detected" and "some withheld" are different facts, and presenting the second as the first would be a quiet all-clear the data does not support.
No Insight decides anything
Nothing in People Intelligence produces an outcome for an employee. There is no automated scoring that feeds a promotion, a pay decision, a performance rating or an exit. Every Insight is an input to a decision made by a person who is accountable for it.
Three consequences worth stating explicitly:
Diagnostic Insights are never sufficient on their own for a decision about an individual. They describe a pattern in platform behaviour. Platform behaviour is a partial view of a working life, and it is partial in ways that correlate with role, seniority, shift patterns, leave and accessibility needs.
Experimental Insights carry the strongest version of the same rule. The Manager Index Insights are marked Experimental: a hypothesis still under validation that must not drive decisions about people on its own. Using one to assess or penalise a manager is a misuse of the Insight.
Behavioural profiles are not personality assessments. They summarise activity over time. They are not psychometric instruments, they are not stable traits, and a person's profile changes when their behaviour does.
Your organisation is the boundary
Insights are computed within your organisation's data and are never mixed with another organisation's. Behavioural scores are normalised within your own organisation, which is also why they are not a benchmark: a participation score of 70 in your organisation and 70 in another are two different measurements, and the product does not invite you to compare them.
Honest absence rather than a confident blank
A recurring design rule, and one that has privacy consequences worth naming: an Insight with nothing to show says so, rather than disappearing or rendering an empty chart.
A card that vanishes when it has no data teaches people to read a gap as an answer. A card that says "this organisation has no data for this card" is honest about what is missing, keeps the reader from inferring a result that was never computed, and makes it visible when a data feed has broken rather than letting silence pass for good news. On a profile, a card that could not be computed says so, and says that this does not mean there is nothing to show.
Questions a works council or DPO usually asks
Is any employee subject to automated decision-making? No. No Insight produces an outcome. All decisions are made by people.
Is employee data sent to an AI provider to build these dashboards? No. Insights are computed in the platform with no model involved. The Data Analyst Agent is a separate tool that does use an external provider, with names and emails replaced by pseudonymous identifiers.
Do any of these outputs contain employee names? Nominative Insights show names to authorised users inside the platform. Excel exports from the Data Analyst Agent contain names in the file. Names are not sent to the AI provider.
Who can open an employee's profile Insights? Only platform administrators and people with the Gi assistant manager permission, on organisations where People Intelligence is enabled. They can open the Insights of anyone in the organisation, so the permission list is the control.
Can anonymous survey answers be traced to a person? Not through People Intelligence. Segments too small to protect respondents are refused before the calculation runs, and survey Insights are never offered on an individual profile.
How do we know what a number means? Every catalogue Insight carries a versioned contract stating its population, exclusions, sources, thresholds and limitations. Ask us for the contract of any Insight in your catalogue.
Where is the data held and under what terms? See Understanding Compliance on GFoundry: Security, Terms, and Data Protection. The Data Processing Agreement, including the list of sub-processors, is available on request.
Advice for rolling this out internally
Decide who gets access before you decide which Insights to use. The list of people with the Gi assistant manager permission is the real privacy control, and it is yours to set.
Tell employees the capability exists. People who hear about People Intelligence from you, up front, trust it more than people who discover it later.
Agree what each Insight triggers. An Insight with no agreed follow-up becomes either noise or, worse, an informal judgement nobody has to justify.
Set a rule for exports. They are the one artefact that leaves the platform carrying names. Decide who may generate them and where they are allowed to live.
Review the dashboard periodically. An Insight that has not informed a decision in six months is a card to remove, not a card to keep for completeness.