Performance Reviews Across Borders: Legal and Data Rules Global HR Teams Must Plan for in 2027

Evolving story: Several regulations in this article are either newly effective or coming into force at specific dates through December 2027. The guidance here reflects the regulations in effect as of October 2026. Plan to review this guide after Spain's October 2026 effective date has passed, and again once the UK, Colorado, and India deadlines take effect in January and May 2027.

Running global performance reviews with a single process is efficient until it creates legal exposure in six countries at once. A one-size-fits-all review cycle that works in a US headquarters may breach works council rights in Germany, violate algorithmic transparency rules in Spain, and fall short of poor-performance documentation standards in Canada before a single conversation takes place.

The 2025–2027 regulatory calendar has sharpened this risk considerably. New data-protection laws, artificial intelligence (AI) disclosure mandates, and unfair dismissal reforms are reshaping what a legally defensible review process looks like across North America, Europe, and Asia-Pacific. Several of those changes take effect on specific dates through December 2027, meaning what is compliant today may not be compliant in three months.

This guide breaks down the specific rules that apply jurisdiction by jurisdiction, the regulatory calendar HR teams need to track, and how to build a single review framework that accommodates all of them without requiring a separate process for every country. For background on how performance documentation connects to termination risk, see our guide to performance improvement plans and international dismissal law.

What the global review-compliance landscape covers

Performance review compliance is not a single rule type. It is four overlapping ones:

• Data protection governs how review records are created, stored, shared, and deleted.

• AI and algorithmic transparency determines whether and how employers can use automated scoring in review processes.

• Labor and employment law sets the floor for documentation standards and how review outcomes can be used in termination decisions.

• Works council co-determination rights (especially in Europe) regulate whether employers can implement or change a review system at all without employee-representative consent.

Each of these four frameworks operates independently, with its own enforcement body and its own penalty regime. A review process that passes General Data Protection Regulation (GDPR) scrutiny may still violate co-determination requirements. A process that satisfies algorithmic-transparency disclosure rules may still fail under local fair-dismissal standards. The 2025–2027 regulatory calendar has added new entries across all four categories simultaneously, making an outdated global review policy a genuine compliance liability. For a sense of what inadequate documentation means in practice when performance-related dismissals reach a tribunal, see our international dismissal law guide.

North America: US and Canada rules

The United States and Canada both require employers to meet transparency and documentation standards in performance review processes, though the specific mechanisms differ. US requirements are currently driven by state AI disclosure laws taking effect between 2026 and 2027. Canadian standards come from common law employment principles and provincial monitoring-policy legislation.

United States: California, Illinois, and Colorado

California has long given employees the right to inspect and copy performance records their employer maintains, under Labor Code §1198.5. Senate Bill 513, effective January 1, 2026, extended that access right to include education and training records as part of the personnel file, meaning employers who maintain training records must now make those available alongside performance evaluations. HR systems that hold performance and training data under separate access rules need updating.

Illinois House Bill 3773, effective January 1, 2026, prohibits employers from using AI systems that have a discriminatory effect in employment decisions (including performance reviews) and requires employers to notify employees whenever AI is used in decisions affecting their terms or conditions of employment. The notification obligation applies regardless of whether the AI-assisted outcome is adverse.

Colorado's Senate Bill 26-189 (the Automated Decision-Making Technology Act, or ADMT Act) takes effect January 1, 2027, and applies to consequential employment decisions that are materially influenced by automated systems. Employers must provide pre-use notice when ADMT shapes a performance evaluation and must offer a meaningful human review option when an adverse outcome results. Implementing rules are due from the Colorado Attorney General by the same date. The official bill text is at the Colorado General Assembly.

Canada: just cause and electronic monitoring

Under Canadian common law employment principles, poor performance alone does not constitute just cause for dismissal without a documented record of communicated standards, warnings, and a reasonable opportunity to improve. A global performance review process that triggers termination without that documentation trail creates significant liability for Canadian employees, regardless of what exit standards apply in other markets.

Ontario's Employment Standards Act requires employers with 25 or more employees to maintain a written electronic monitoring policy that discloses whether and how the employer tracks employees electronically, including any monitoring that feeds into performance records. That policy must be available to all Ontario employees and updated when monitoring practices change.

Latin America: Mexico's workweek reform and documentation requirements

Exits based on poor performance in Mexico require documented evidence of communicated performance standards and progressive warnings. Unlike jurisdictions where verbal warnings may suffice, Mexican labor law's pro-worker interpretation standards mean that undocumented verbal feedback carries little weight in proceedings before a labor board (Junta de Conciliación y Arbitraje) or the new Federal Center for Labor Conciliation.

Mexico is phasing in a reduction of the statutory maximum workweek from 48 to 40 hours, with actual hour reductions beginning January 1, 2027. The schedule runs 46 hours in 2027, 44 in 2028, 42 in 2029, and 40 hours by 2030, with no reduction to existing wages or benefits permitted under the reform. Employers using output-based performance metrics that assume a 48-hour workweek will need to recalibrate those standards as the maximum weekly hours decrease.

A separate Federal Labor Law reform, effective May 1, 2026, creates a mandatory electronic time-tracking obligation from January 1, 2027. Electronic timekeeping records carry full evidentiary weight in labor proceedings, which means disputed performance assessments linked to attendance or productivity data will be evaluated against the employer's own electronic records.

Europe and the UK: works council rights, behavioral criteria, and algorithmic transparency

The EU's regulatory framework for performance reviews operates through three distinct channels. Co-determination rights require works council involvement before review systems are implemented or changed. Data-protection standards under the GDPR govern how behavioral and performance data is handled. The EU AI Act classifies AI used in employment evaluations as high-risk. The UK has departed from the EU AI Act framework but has introduced its own parallel obligations under the Employment Rights Act 2025 and the Data (Use and Access) Act 2025.

Germany

German employers must obtain works council consent before implementing or materially changing a performance appraisal system. The Works Constitution Act (Betriebsverfassungsgesetz, BetrVG) requires consent under §94 for appraisal principles and questionnaires, and under §87(1) no. 6 for technical monitoring systems used to evaluate employee performance or conduct. This applies whether the review system is manual or algorithmic. A global review rollout that bypasses the Betriebsrat, even on an expedited implementation schedule, is legally invalid in Germany.

France

A Cour de cassation ruling from October 2025 reinforced that performance evaluation criteria must be sufficiently precise and objective to be judicially reviewable. Vague behavioral standards (such as "demonstrates strong interpersonal skills" without defined benchmarks) are at elevated legal risk. In practice, this requires French-specific addenda to any global review rubric that relies on soft-skill or cultural-fit criteria.

Separately, the Comité Social et Économique (CSE) must be consulted before AI-powered HR tools are introduced in workplaces with 50 or more employees, a requirement that has been actively litigated since 2026. Global review platforms that introduce an AI scoring module need CSE consultation before rollout in France.

Spain

Royal Decree 723/2026, effective October 5, 2026, requires employers to give employees prior written notice when algorithmic or automated systems are used in HR decisions, including performance evaluations. The notice must explain how the system works and what data it uses. This is a standalone obligation under Spanish law, independent of GDPR's algorithmic transparency rights, and it applies to any employer using AI-assisted review tools for Spanish employees.

UK

The Employment Rights Act 2025 reduces the unfair dismissal qualifying period from two years to six months, effective January 1, 2027. Any dismissal decision following a performance review process will be subject to full unfair dismissal scrutiny once the employee has six months of service from that date. The Act also removes the cap on compensatory awards, raising the financial cost of successful claims considerably. For a detailed breakdown of how this interacts with day-one rights already in force, see our guide to the UK Employment Rights Act and day-one dismissal implications.

The Data (Use and Access) Act 2025 strengthens employee data access rights and introduces specific safeguards for automated-decision systems. Employees have an enforceable right to access personal data held about them in performance systems and to request human review of automated decisions that affect their employment.

Asia-Pacific: India's data duties and labour framework

India's regulatory environment for performance reviews has changed materially in the 12 months running up to October 2026, with the DPDP Act's phased commencement establishing a firm May 2027 deadline for employer data duties.

India

India's Digital Personal Data Protection (DPDP) Act, 2023 commences in stages. The Data Protection Board of India and foundational definitions took effect in November 2025. The substantive obligations that apply to employers (including notice before data collection, employee data-principal rights to correction, access, and erasure, and the requirement to store performance data only for as long as necessary) commence May 13, 2027. Performance review records are personal data under the Act. By May 2027, employers must have a purpose limitation and retention policy in place for how long those records are held, and a mechanism to honor access and correction requests.

India's consolidated labour codes, which modernize and consolidate earlier industrial relations, social security, wages, and safety legislation, are now in force. For performance exit processes, the Industrial Relations Code's provisions on standing orders require employers in regulated industries to have documented disciplinary and performance standards accessible to employees.

Country comparison: rules at a glance

The table below covers additional markets where global review processes create distinct compliance obligations. For each, the key rule type, the specific requirement, and the compliance action are listed.

Building one global review process with local flexibility

A global review process designed for compliance builds in a base template that covers the universal requirements: documented performance standards communicated before reviews begin, a record of how scores are derived, and a clear mechanism for employees to see and respond to their own assessments. Country addenda then layer in the requirements that differ by jurisdiction.

The EU AI Act's Annex III classifies AI systems used to evaluate employees' work performance or behavior as high-risk. Providers and deployers of such systems face conformity assessment requirements, with compliance deadlines for high-risk AI systems running to December 2, 2027. For global HR teams using AI-assisted review tools, that deadline is the practical planning horizon for assessing whether a vendor meets the Act's documentation, transparency, and human oversight requirements.

Audit trails are the connective tissue of a defensible global review process. Every material event in the review cycle (rating assigned, calibration adjusted, manager sign-off received, employee response recorded) should generate a timestamped record. In jurisdictions where employees have a right to access their own performance data, including under GDPR, the DPDP Act, the UK Data (Use and Access) Act 2025, and California Labor Code §1198.5, that audit trail is also the source from which access requests are fulfilled. For practical frameworks on running calibrated reviews in a global team, see our guides on implementing 360-degree performance appraisals and running a performance calibration meeting.

Contractors and employees hired through an EOR

Performance review obligations differ materially depending on whether a company hires workers directly, through an Employer of Record (EOR), or as contractors. Independent contractors fall outside the unfair dismissal, works council, and most data-employee-rights frameworks described in this article. Misclassification risk remains real: a contractor managed like an employee (including through formal performance review systems with ratings and improvement plans) may be reclassified by local authorities.

Workers hired through an EOR are employees of the EOR in the local jurisdiction. The EOR is the worker's legal employer and handles local employment administration and employer obligations, while the client remains responsible for coordinating performance feedback and following the EOR's local process. Client-side performance processes need to be integrated with the EOR's local HR framework rather than running in parallel to it. For guidance on choosing the right model for long-term international hiring, see our comparison of contractor management vs. EOR.

Stay compliant with Deel HR

Deel HR centralizes performance records and lets teams configure country-specific workflows, helping global review processes stay consistent as requirements vary across jurisdictions. Centralized records and an audit trail across every review cycle help global HR teams maintain consistent documentation and respond to data-access requests without switching systems.

• Centralized performance records with audit trails that support documentation and data-access processes across jurisdictions

• Country-specific workflow configuration so teams can account for differing local approval, consultation, and documentation requirements

• Embedded AI assistance to help teams draft and organize review documentation, subject to human review and applicable disclosure requirements

• Connected HR and payroll data so HR records and relevant workforce data are accessible in one place, reducing silos across review and payroll processes

Book a demo to see how Deel HR can help centralize documentation and configure performance-review workflows across countries.