If you look at where the most personal data sits in a company, the answer is almost always the same: HR. An employee file has a name, an address, an ID number, a bank account, a salary, a contract, reviews, sometimes sick leave and family details. All in one place, about a person the company also pays.
That is exactly why HR is also where GDPR gets broken most often, with no bad intent. A CV left on a desk, a salary sheet sent to the wrong person, a camera put up "just to be safe". Things that seem minor until they become a problem.
On what basis you use employee data
This is the most common confusion, so it is worth stating clearly: in HR, employee consent is usually not valid.
The reason is simple. Consent has to be free, given without pressure. But between a company and an employee the power is not equal, and a "yes" given out of fear of upsetting the boss is not a free "yes". That is why the law says that for employees you rely, in most cases, on something else:
- The employment contract — for everything involved in running it: paying the salary, the job description, recording hours.
- A legal obligation — for taxes, contributions, reporting to the state, health and safety at work.
- The company's legitimate interest — for reasonable things, like the security of the systems, as long as it does not override the employee's rights.
Consent is only valid in a few situations where the employee genuinely has a choice and loses nothing by refusing, for example a photo on the company website.
Recruitment and CVs
Recruitment brings a wave of data about people who do not (yet) work for you. Here too there are a few common-sense rules that GDPR puts in black and white.
- You ask only for what is relevant to the role. You do not need marital status, plans to have children or health data to assess a candidate.
- You keep CVs only as long as it makes sense. Once the role is filled, the CVs of rejected candidates are deleted, unless you have a clear reason to keep them.
- For "we'll keep you on file for the future" you need consent. Here consent is genuinely valid, because the person does not depend on you yet.
Workplace monitoring
Cameras, email monitoring, GPS on cars, software that watches what an employee does on the computer. All are possible, but none of them "just to be safe". GDPR requires monitoring to pass three simple tests.
- Does it have a real purpose? Security, protecting assets, a legal requirement. Not mere curiosity or distrust.
- Is it as gentle as possible? You pick the option that interferes least and still solves your problem.
- Do people know? Employees must be told in advance, in writing, what is monitored and why. Doing it secretly is not allowed.
We wrote separately about a heavier form of monitoring, in the article on facial recognition at work. And about the role of people in security, in the human factor.
What an HR department can do in practice
- Role-based access. Salaries are seen by finance, reviews by the direct manager. Not everyone sees everything.
- Clear retention rules. How long you keep each type of document after a person leaves, and what you delete on time.
- Informing employees. A simple note telling them what data you use, why, and what rights they have.
- Care with vendors. The payroll software, the recruitment platform, the occupational health firm. They all touch employee data, so they all need a clear contract.
- Trained people. The HR team taught how to send a file with data safely and what not to ask at an interview.
At INFOSHARE we help HR departments put all of this in place: correct legal bases, retention rules, notices and monitoring policies that actually hold. See our GDPR services, the outsourced DPO role, and for record-keeping, the askGDPR platform.
Frequently asked questions
Can I ask an employee for consent to use their data?
Usually not, and this is where many companies get it wrong. The relationship between employer and employee is not equal, so consent given out of fear of losing your job is not considered freely given, and therefore not valid. For most HR data the correct basis is the employment contract, a legal obligation (payroll, taxes, health and safety) or the legitimate interest of the company, not consent.
How long can I keep the CVs of rejected candidates?
Only as long as it makes sense for that recruitment. Once the role is filled, the CVs of candidates who were not chosen should be deleted, unless you have a clear reason to keep them, for example for another role. If you want to keep a CV for the future, you need the candidate's consent, which here is genuinely valid, because the person does not work for you yet.
Can I monitor employees' email and computers?
Only within clear limits. Monitoring must have a real purpose (for example security), be as little intrusive as possible, and employees must be told in advance, in writing, what is monitored and why. Secret monitoring or reading personal messages is not allowed. Before starting heavier monitoring, you usually need a risk assessment.
Are CCTV cameras in the office allowed?
Yes, but in moderation. You can place cameras in areas where there is a real reason (entrance, cash desk, warehouse), with signs announcing the surveillance. You may not place cameras where people expect privacy, such as changing rooms or break areas, and you cannot use the footage to track in detail how each employee spends their time.
Want HR that is compliant, with no hassle?
We put in place the legal bases, retention rules, notices and monitoring policies, tailored to how your company works.