GDPR Q28
How do I handle employee data under GDPR?
Q28. How do I handle employee data under GDPR?
Category: Employment
Employee data contains sensitive details about staff, so employers must handle it carefully and fairly.
In simple terms
- Use lawful bases such as contract, legal obligation, or legitimate interests.
- Be transparent with staff about monitoring and data use.
- Apply extra safeguards for special category data like health information.
Collecting and using employee data
Explain what data you collect, why, and how long you keep it. Use privacy notices at recruitment and employment stages.
- Limit data collection to what is necessary for HR, payroll, and workforce management.
- Use legitimate interests assessments where monitoring is involved.
- Consult staff and unions when introducing new monitoring technologies.
Protecting sensitive information
Health data, trade union membership, or diversity information require Article 9 conditions and strong security.
- Restrict access to HR systems and audit staff access regularly.
- Encrypt portable devices and use secure portals for payslips.
- Document retention periods for different HR records.
Practical steps to take
- Provide staff with privacy notices covering recruitment, employment, and exit processes.
- Keep HR data accurate and allow employees to update details easily.
- Train managers on confidentiality and handling SARs from staff.
- Conduct DPIAs for intrusive monitoring or biometric systems.
- Securely delete data when the retention period expires.
Real-life examples
Sickness absence records
An employer stores medical notes in a restricted folder and only shares summaries with managers.
Remote working policy
A business introduces monitoring software but carries out a DPIA, informs staff, and sets clear limits on data collection.
Helpful reminders
- Avoid excessive monitoring—balance business needs with privacy.
- Keep special category data separate from general HR files.
- Support employees who exercise their rights, such as access or rectification.
Key takeaway
Treat staff data with the same care you expect for your own—clear notices, limited access, and fair monitoring are essential.
Article references
Further reading
Have we made a mistake, or an error or omission? Email support@akadata.ltd so we can correct it quickly.