GDPR for HR: Employee Data Processing Guide [2026]

Quick Answer: Does GDPR Apply to Employee Data?

Yes. The General Data Protection Regulation (Regulation (EU) 2016/679) applies to all personal data processed in the context of employment. This includes recruitment data, payroll information, performance reviews, health records, disciplinary files, and any other information that identifies or could identify an employee.

---

Lawful Bases for HR Data Processing

Article 6 of the GDPR requires a lawful basis for every processing activity. For HR, the most relevant bases are:

1. Performance of a Contract (Article 6(1)(b))

This is the primary basis for most core HR processing. If processing is necessary to fulfil the employment contract, this basis applies:

• Paying salaries and benefits
• Managing working time and attendance
• Administering leave entitlements
• Providing contractual benefits (health insurance, pension)
• Issuing employment references upon request

2. Legal Obligation (Article 6(1)(c))

Where processing is required by law:

• Tax withholding and reporting to revenue authorities
• Social security contributions
• Health and safety record-keeping
• Working time records (per the CCOO ruling, C-55/18)
• Equality monitoring where required by national law
• Reporting to labour inspectorates

3. Legitimate Interest (Article 6(1)(f))

Employers may process data where they have a legitimate interest that is not overridden by the employee's rights. This requires a documented balancing test (Legitimate Interest Assessment, or LIA):

• Performance management and appraisals
• Internal investigations (disciplinary, grievance)
• IT security monitoring (with proportionality safeguards)
• Business planning and restructuring
• Intra-group transfers of employee data for administrative purposes

4. Consent (Article 6(1)(a)) -- Use With Extreme Caution

Employee consent is problematic in the employment context because of the inherent power imbalance. The Article 29 Working Party (now the European Data Protection Board, EDPB) has stated that consent is rarely freely given in employment. Use consent only where:

• The employee faces no detriment for refusing (e.g., optional social events, photo consent for company website)
• There is no alternative lawful basis available
• The employee can withdraw consent without any negative consequence

Do not rely on consent for core HR processing like payroll, attendance, or performance management. If the employee cannot realistically refuse, consent is not valid.

---

Special Category Data in HR

Article 9 imposes stricter rules on special category data, which in HR commonly includes:

• Health data: Sick notes, occupational health reports, disability information, medical certificates
• Trade union membership: For payroll deduction purposes or consultation requirements
• Racial or ethnic origin: For equality monitoring
• Biometric data: Fingerprint or facial recognition for access control or time tracking
• Religious beliefs: For accommodating religious holidays or dietary requirements

Processing special category data requires both a lawful basis under Article 6 and a condition under Article 9(2). The most relevant conditions for HR:

• Employment law obligations (Article 9(2)(b)): Processing necessary for employment, social security, and social protection law
• Explicit consent (Article 9(2)(a)): Only where truly voluntary and specific
• Legal claims (Article 9(2)(f)): Processing necessary for the establishment, exercise, or defence of legal claims

---

Data Minimisation and Purpose Limitation

Data Minimisation (Article 5(1)(c))

Only collect data that is adequate, relevant, and limited to what is necessary for the specified purpose. Practical implications for HR:

• Do not collect information about family members beyond what is needed for benefits administration
• Remove unnecessary fields from application forms (e.g., date of birth if not legally required)
• Limit access to sensitive data on a need-to-know basis
• Do not retain interview notes for unsuccessful candidates longer than necessary

Purpose Limitation (Article 5(1)(b))

Data collected for one purpose must not be processed for an incompatible purpose without a new lawful basis. For example, health data collected for sick leave administration cannot be used to inform promotion decisions, and recruitment data cannot be repurposed for marketing.

---

Retention Periods for HR Data

The GDPR does not specify exact retention periods but requires that data is kept for no longer than necessary (Article 5(1)(e)). HR teams should set retention schedules based on:

National laws often set minimum retention periods that override the GDPR's general principle. Always check the requirements in each country where you have employees.

---

Data Protection Impact Assessments (DPIAs)

When Is a DPIA Required?

Article 35 requires a DPIA before processing that is likely to result in a high risk to individuals. In HR, a DPIA is typically required for:

• Implementing a new HR information system (HRIS)
• Introducing employee monitoring (email, internet, GPS tracking)
• Deploying biometric systems (fingerprint, facial recognition)
• Large-scale profiling (algorithmic performance scoring, AI-assisted recruitment)
• Processing health data at scale (occupational health programmes)
• Cross-border transfers of employee data within a multinational group

What a DPIA Must Include

1. Systematic description of the processing and its purposes
2. Assessment of necessity and proportionality
3. Assessment of risks to individuals' rights and freedoms
4. Measures to address those risks (safeguards, security, mechanisms to ensure compliance)

If the DPIA identifies high residual risk that cannot be mitigated, you must consult your supervisory authority before proceeding (Article 36).

---

Cross-Border Transfers of Employee Data

Transfers Within the EU/EEA

Data flows freely within the EU/EEA. No additional safeguards are required for transfers between member states.

Transfers Outside the EU/EEA

Transferring employee data to countries outside the EU/EEA (third countries) requires a valid transfer mechanism under Chapter V of the GDPR:

• Adequacy decision (Article 45): The European Commission has recognised certain countries as providing adequate protection, including the UK (until June 2025, extended to December 2025), Japan, South Korea, Canada (commercial organisations), Israel, Switzerland, New Zealand, and Argentina
• Standard Contractual Clauses (SCCs) (Article 46(2)(c)): The most commonly used mechanism for transfers to non-adequate countries. The new SCCs adopted in June 2021 (Commission Implementing Decision 2021/914) must be used
• Binding Corporate Rules (BCRs) (Article 47): For intra-group transfers within multinational companies. Requires approval from the lead supervisory authority
• EU-US Data Privacy Framework (Article 45): Adopted in July 2023, covering transfers to certified US organisations

Following the Schrems II ruling (C-311/18), organisations using SCCs must conduct a Transfer Impact Assessment (TIA) to evaluate whether the recipient country's laws provide essentially equivalent protection to the GDPR.

---

Employee Data Subject Access Requests (DSARs)

The Right of Access (Article 15)

Employees have the right to obtain from their employer:

• Confirmation of whether their personal data is being processed
• A copy of their personal data
• Information about the purposes, categories of data, recipients, retention periods, and the source of the data

Handling Employee DSARs

• Response time: 1 calendar month (extendable by 2 months for complex requests)
• Format: Data must be provided in a commonly used electronic format if requested electronically
• Fee: Generally free; a reasonable fee may be charged only for manifestly unfounded or excessive requests
• Exemptions: You may redact data about other identifiable individuals, legal professional privilege, and in some jurisdictions, management planning information

Common Challenges in HR DSARs

Employee DSARs in the HR context can be complex because they may cover:

• Emails discussing the employee between managers
• Performance review notes and calibration discussions
• Investigation files involving multiple employees
• References provided to other employers

The key principle is that the employee is entitled to their own personal data, but you can redact information that would reveal personal data of other individuals.

---

Data Breach Notification

72-Hour Notification to the Supervisory Authority

Article 33 requires that a personal data breach is reported to the competent supervisory authority within 72 hours of becoming aware of it, unless the breach is unlikely to result in a risk to individuals.

Common HR data breaches include:

• Payslips or contracts sent to the wrong employee
• Unencrypted laptop containing HR data lost or stolen
• Ransomware attack on HR systems
• Unauthorised access to employee records by a colleague
• Misdirected emails containing sensitive employee information

Notification to Affected Employees

Article 34 requires that affected individuals are notified without undue delay if the breach is likely to result in a high risk to their rights and freedoms. This might include breaches involving health data, financial information, or identity documents.

---

Data Protection Officer (DPO) Requirements

When Is a DPO Mandatory?

Article 37 requires a DPO when:

• The organisation is a public authority (except courts)
• Core activities involve regular and systematic monitoring of individuals on a large scale
• Core activities involve large-scale processing of special category data (e.g., a hospital's HR department processing health data)

Many national laws extend the DPO requirement. For example, Germany's Federal Data Protection Act (BDSG) requires a DPO whenever 20 or more employees are constantly engaged in automated data processing.

DPO Independence

The DPO must be able to perform their duties independently (Article 38). They cannot be dismissed or penalised for performing their tasks, must report to the highest management level, and cannot hold a position that creates a conflict of interest (e.g., they should not also be the HR Director or IT Director).

---

Fines and Enforcement

Two Tiers of Fines

Notable HR-Related Enforcement Actions

• H&M (Germany, 2020): EUR 35.3 million fine for extensive employee surveillance, including recording private details about employees' health, family situations, and religious beliefs
• Clearview AI (France, Italy, Greece, 2022-2023): Multiple fines totalling over EUR 50 million for scraping biometric data, including from employees
• IKEA France (2021): EUR 1.1 million fine for unlawfully surveilling employees through accessing police and tax records
• Dedalus Biologie (France, 2022): EUR 1.5 million fine for insufficient security measures leading to a health data breach

---

How Grove HR Supports GDPR Compliance

Grove HR is designed with GDPR compliance built in:

• Lawful basis documentation for each category of employee data processing
• Automated retention policies that flag and archive data when retention periods expire
• DSAR workflow enabling employees to submit access requests and HR to respond within the 1-month deadline
• Audit trail recording every access, modification, and export of employee data
• Role-based access control enforcing data minimisation and need-to-know principles
• Data encryption at rest and in transit for all employee records
• EU hosting on European infrastructure with no third-country transfers
• Breach notification workflow to document incidents and track the 72-hour reporting deadline