GDPR for HR and employee data: what applies and what it means for systems

Which GDPR rules apply to HR and employee data?

Employee data is still personal data under the GDPR, so every HR system needs a lawful basis under Article 6, and for most employers the working answer is a legal obligation or the performance of the employment contract, not consent. The EDPB's small business guide says employees will in principle not be in a position to freely consent to processing by their employer, because they may feel unable to refuse. Payroll, social security reporting and tax deductions are typical legal obligation cases, but that basis only holds where an EU or national law defines a clear and specific obligation. Ask your HR and legal teams to map each HR process (recruitment, payroll, leave, performance, monitoring, termination) to one basis and record the reason for it.

Article 88 lets Member States set more specific rules, by law or collective agreement, for processing employees' personal data. These cover recruitment, performance of the employment contract, management of work, health and safety and termination, with safeguards on transparency, intra-group transfers and workplace monitoring. Those national rules differ, so the controls you build for a multi-country workforce may need local variations. Confirm with local counsel or works councils which national employment rules and collective agreements apply in each country where you employ people, and capture them in your records of processing. Health data, such as sickness absence or occupational health records, is special category data under Article 9, which needs a separate exception from the list in Article 9(2), often employment and social protection law. Limit access to these records tightly in your HR systems.

Automated decisions about workers, such as screening applications or ranking performance, fall under Article 22(1) when they produce legal effects or similarly significantly affect the person. Article 29 Working Party guidance, endorsed by the EDPB, says human oversight must be meaningful and carried out by someone with authority and competence to change the decision. The Dutch DPA's 2026 fine against Uber, which started from complaints by 171 drivers and is under appeal, shows how regulators treat unlawful automated decisions about workers. Note that the GDPR requires no audit or certificate, and Article 42 certification is voluntary. Your organization owns its controls. An implementation partner can prepare systems, access logs and evidence, but only an independent auditor or the supervisory authority assesses compliance.

Which lawful basis fits each employee data flow

Employee data flows rarely share one lawful basis. Each flow needs its own basis, its own record of why it applies, and a clear answer to who decides what the data is used for. The cards below take the common flows in turn and name what the system should record and what counsel should confirm.

Payroll and social security

This flow usually rests on legal obligation under Article 6(1)(c). The EDPB's small business guide gives processing employees' data for social security as a typical case, but the obligation must be clear and specific and defined by EU or national law. The system should record the statute or rule that requires each data element, such as contribution fields and tax identifiers, so that fields not required by law do not drift into the payroll record. Ask counsel which national rules apply to each payroll element and how long the records must be kept.

Employment contract administration

Core contract records, such as job title, pay terms and working hours, can often rely on performance of a contract under Article 6(1)(b). The basis covers only what is necessary to perform the contract. Data that the employer wants for other purposes, such as general performance tracking, needs a different basis. The system should tag each field with the purpose it serves and flag any field that has no contract link. Counsel should confirm where the contract boundary ends in each country where staff are employed.

Recruitment

Applicant data is usually processed to take steps at the candidate's request before a contract exists, which is a performance of a contract question under Article 6(1)(b). Retention of rejected applicants' data is a separate decision that needs its own basis and a defined period. Consent is a weak fit here because the candidate may feel unable to refuse. The system should record the purpose and retention period for each candidate record and separate talent pool data from active applications. Counsel should confirm national recruitment rules and any limits on background checks.

Health and safety records

Routine workplace safety records may rest on legal obligation, since health and safety law requires some records. Health information about an employee is special category data under Article 9, so the system also needs an Article 9(2) exception, often the employment and social protection law exception that Member State rules define. Article 88 allows national rules on health and safety at work, which can add safeguards. The system should separate health data from general HR records and limit access to occupational health staff. Counsel should confirm the national exception and the retention rule for each record type.

Monitoring and analytics

Monitoring, such as access logs, productivity dashboards or attrition models, is the flow where legitimate interests under Article 6(1)(f) is most often claimed, and where national rules under Article 88 may restrict it or require consultation with workers' representatives. Legitimate interests requires a documented balancing test that considers the employee's reasonable expectations. The system should record the balancing assessment, the monitoring purpose, and any exclusion of personal data from analytics. Counsel should confirm whether national law restricts this monitoring and whether a DPIA is needed.

How Article 88 national employment rules change system design

Article 88 means the GDPR does not give you one employee data model for the whole EU. It lets each Member State set more specific rules, by law or collective agreement, for processing employees' personal data in recruitment, performance of the employment contract, management of work, health and safety and termination. Those rules can also add safeguards on transparency, intra-group transfers and workplace monitoring. For the system owner, this means the HR platform's configuration is partly set by where each employee works, not only by the employer's headquarters. Before you configure recruitment tools, time tracking, performance modules or access logs, build a register that maps each country where employees sit to its employment law, its works council or collective agreement obligations, and any monitoring or transfer limits that apply.

Turn that register into configuration decisions. For each country, record whether applicants' data may be retained after a rejected application, whether candidate assessments or background checks are restricted, which fields may be shown to managers or other group entities, and whether monitoring features such as activity logging, screen capture or location data need employee representative consultation before they are enabled. Where rules differ, consider separate tenants, country-level field visibility, retention rules keyed to the employee's location, and role-based access that stops a group-wide administrator from viewing data that a local rule restricts. Keep a dated record of each configuration choice and the rule it implements, so you can show an assessor why the setting differs between countries.

Confirm every local requirement with employment counsel in each country and with the works council or employee representatives where a rule requires consultation. This page does not set out what any national law requires, and national rules change. Ask counsel to state, in writing, which features need consultation, which data categories are restricted, and which transfers need additional safeguards. Ask your implementation partner to show how each written answer maps to a setting, a role or a retention rule in the platform, and who signs off when local rules and group policy conflict.

Handling special category data about employees

Sickness records, disability details and union membership are special category data under Article 9, so they need a second lawful condition on top of the usual Article 6 basis. The cards below cover which exception applies, how to separate these fields from ordinary HR records, and how to prove who saw them.

Identify the special categories

Health data such as sick notes, fit-for-work reports and occupational health referrals, disability and adjustment records, trade union membership and religious or biometric data used for access control all fall under Article 9. Inventory them field by field in the HR system, payroll and ticketing tools, because they often appear in free-text notes and attachments that a field list misses. Ask each system owner which of these data types they hold and where.

Match each use to an Article 9(2) exception

Article 9(2) lists ten exceptions, including explicit consent, employment and social protection law, and health and social care. Consent is rarely a sound basis for an employer because the employee may feel unable to refuse. The employment exception only works where the national law of the Member State or a collective agreement sets the obligation, so confirm the specific rule for each purpose, such as sick pay or disability accommodation, with local counsel.

Separate special category fields

Store health, disability and union data in a separate record or restricted module rather than in the general personnel file that managers and generic HR roles open. Link to the employee by an identifier, and keep only the outcome needed elsewhere, such as an absence start and end date for payroll. Separation also makes deletion and retention limits easier to apply to the sensitive part alone.

Restrict access by role and purpose

Limit read access to occupational health staff or named HR advisers who need the data for a defined purpose, and deny it to line managers by default. Enforce this in the platform through role-based permissions, not by asking staff to avoid opening files. Review the access list on a schedule and when roles change, and confirm that system administrators with database access are covered by the same restriction.

Log every access to sensitive records

Record who opened, changed or exported each special category record, when, and from which system, and keep those logs protected from the staff whose activity they record. Review them for unusual patterns, such as a manager viewing many absence records. Ask any self-hosted HR platform vendor or integrator to confirm which events are logged natively and which need configuration.

Document the basis and safeguards

For each special category use, keep a written record of the Article 6 basis, the Article 9(2) exception, the national provision relied on and the safeguards applied. Auditors and supervisory authorities ask for this chain of reasoning before they look at the technical controls. Reviewing it when national rules or collective agreements change keeps the record accurate.

Automated decisions about workers and Article 22

Article 22(1) gives workers the right not to be subject to a decision based solely on automated processing, including profiling, where that decision produces legal effects or similarly and significantly affects them. For HR systems, the trigger is usually not the software itself but the outcome: a candidate screened out before any recruiter looks at the file, a shift allocation that changes pay, or a performance score that drives dismissal or a bonus. Before any scoring or ranking tool goes live, the organization should list each HR decision it touches, record whether a person makes the final call, and decide which decisions fall within Article 22 and which fall outside it. That inventory belongs in the record of processing and the DPIA, and it should be reviewed whenever a vendor adds a new model or feature.

The Article 29 Working Party guidelines on automated decision-making and profiling (WP251 rev.01, last revised 6 February 2018, endorsed by the EDPB) set the test for human involvement. Oversight must be meaningful, carried out by someone with the authority and competence to change the decision, and it must consider the relevant data rather than simply rubber-stamp the output. A manager who clicks approve on every automated ranking, without the information or time to challenge it, does not take the decision out of Article 22. Practically, the organization should confirm that reviewers can see the inputs and the logic behind a score, that they have a documented route to override it, and that overrides are logged and reviewed. Note that the guidelines describe fabricated human involvement as insufficient, so reviewer training and override records matter as much as the workflow diagram.

The Dutch DPA fined Uber EUR 824,990,000 for unlawful automated decision-making about drivers and insufficient information about profiling, under Articles 22 and 13. The case began from complaints by 171 drivers. Uber has appealed, so this is an authority's decision under challenge, not a final ruling, and the amount may change on appeal. Its relevance to employers is the pattern: automated decisions about people who depend on a platform for work, and notices that did not explain the profiling. Before deploying automated HR tools, ask the vendor for the documentation that would let you explain each decision to the worker, and confirm with your data protection officer or counsel how the appeal and any further guidance may affect your position.

Who owns HR compliance and who prepares the evidence

The controller owns every decision about why and how employee data is processed. The HR and legal team sets the lawful basis for each activity, decides when a legal obligation or an employment-law rule applies, and checks what national employment rules add under Article 88. This team also writes the privacy notices given to staff, the retention periods, the policies and the legitimate interest assessments where they are relied on. It decides whether an automated tool such as a scoring or rostering system is used, and who has authority to overturn its output.

Lawful basis: Records which of the six Article 6 bases applies to each HR activity, and why consent is not the basis for most employment processing.
Special category data: Decides the Article 9 exception for health, union or similar data, such as sick leave records or occupational health referrals.
Notices and policies: Owns the employee privacy notice, monitoring policy and retention schedule.
Automated decisions: Approves any tool that affects pay, promotion or dismissal, and names the person with authority to change its outcome.
Records and sign-off: Keeps the decisions in writing so they can be produced to a supervisory authority.

Check that every HR processing activity has a named owner, a documented basis and a review date.",

How to prepare HR systems before a regulator or customer review

This sequence turns scattered HR data into evidence a supervisory authority or enterprise customer can check. Each step produces a record that the next step relies on, so the review pack stays consistent with what the systems actually do.

Inventory every employee data flow
Start by listing each system and process that touches employee personal data, including the HRIS, payroll, applicant tracking, time and attendance, badge access, device management, email and collaboration tools, and any benefits or occupational health providers. Record what data each flow collects, where it is stored, who can access it, and which processors or sub-processors receive it. Involve HR operations and IT together, because HR often does not know which integrations exist. The step is complete when the inventory matches the system configuration and an owner is named for each flow.
Record the lawful basis and national rules per flow
For each flow, record the Article 6(1) basis you rely on and, where the purpose is employment-related, the national employment rule or collective agreement that adds specific conditions under Article 88. Avoid relying on consent for ordinary employment processing, because the EDPB's guidance for small business notes that employees will in principle not be in a position to freely consent to processing by their employer. Where the legal obligation basis applies, such as payroll reporting for social security or tax, name the specific EU or national law. The output is a lawful-basis register entry per flow, reviewed by counsel familiar with the relevant national law.
Run a DPIA where risk is high
Screen each flow for high-risk features such as systematic monitoring of workers, large-scale processing of special category data like health records, or automated scoring that affects pay, promotion or dismissal. Where the screening indicates high risk, carry out a data protection impact assessment under Article 35 that describes the processing, its necessity and proportionality, the risks to workers and the measures that reduce them. If high risk remains after mitigation, Article 36 requires prior consultation with the supervisory authority before processing starts. The output is a signed DPIA per high-risk flow with a dated review trigger.
Configure access and retention controls
Translate the lawful-basis and DPIA decisions into system settings. Restrict HR records to roles with a documented need, separate health and disciplinary data from general personnel files, and log access to sensitive fields. Set retention periods per data category based on the legal or national rule identified in step two, and configure deletion or archiving jobs that run in each system, including backups and exports. Confirm that test and analytics copies do not carry identifiable employee data without a basis. The check is a configuration export or test record showing that each control works as the register describes.
Document automated decisions and human review
List every process where software scores, ranks, screens or recommends a decision about a worker or applicant, such as CV filtering, productivity scoring or shift allocation. For each one, determine whether the decision is based solely on automated processing and has legal or similarly significant effects, which engages the Article 22(1) right. Where it does, document the human review step, who holds authority and competence to change the outcome, and how that person can see the inputs. The Article 29 Working Party guidelines on automated decision-making state that fabricated human involvement does not avoid Article 22. The output is a decision register with review records and the information given to workers.
Assemble the record of processing
Consolidate the outputs of the previous steps into the record of processing activities that Article 30 requires the controller to keep, covering purposes, categories of data subjects and data, recipients, transfers, retention and a description of security measures. Cross-check each entry against the system configuration and the processor contracts so the record describes what happens in practice. Include links to the DPIAs, decision register and lawful-basis entries. The output is a versioned record with a named owner and a change log, ready to hand to a regulator or to an enterprise customer's due diligence team.

What usually breaks employee data compliance

Most employee data failures come from defaults nobody questioned: a consent box used where consent cannot be freely given, national employment rules left unmapped, HR tools that move data out of the EEA, monitoring switched on without an assessment, and automated scores signed off without real review. Each card names one pitfall and the first step that avoids it.

Consent used as a default basis

Teams often collect employee consent for payroll, HR records or workplace tools because it feels safe. The EDPB's small business guide says employees will in principle not be in a position to freely consent to processing by their employer, because they may feel unable to refuse. Avoid it by mapping each HR purpose to a basis under Article 6(1), usually a contract, a legal obligation or legitimate interests, and recording why each one applies.

Unmapped national rules for multi-country staff

Article 88 lets Member States set more specific employment data rules by law or collective agreement, covering recruitment, monitoring and termination. A company with staff in several countries can end up applying one country's rules everywhere, or none. Avoid it by keeping a register of national employment rules for each country where you employ people, with an owner who reviews it when local law or collective agreements change.

HR vendors transferring data outside the EEA

Payroll, recruiting, time-tracking and engagement platforms often store or access employee records from outside the EEA, sometimes through support staff or sub-processors the customer never reviewed. Each such flow is a transfer under Chapter V. Avoid it by listing every HR vendor, its hosting locations and its remote access points, and confirming the transfer mechanism for each before data flows. Self-hosted HR platforms in your own EEA infrastructure reduce this list but do not remove the duty to check remote support.

Monitoring tools deployed without a DPIA

Keystroke logging, screen capture, email scanning, location tracking and video monitoring are often installed by IT or security teams with no privacy review. Such systems can process employee data systematically and intrusively, which is a common trigger for a data protection impact assessment. Avoid it by completing a DPIA before deployment, documenting the purpose, the less intrusive alternatives considered, retention limits and access controls, and reviewing it when the monitoring scope changes.

Rubber-stamp review of automated scores

Scoring tools that rank candidates, flag absence risk or rate performance can feed decisions that significantly affect workers. Article 22 gives the right not to be subject to a decision based solely on automated processing. The Article 29 Working Party guidelines say human oversight must be meaningful and that fabricated human involvement does not avoid Article 22. Avoid it by giving the reviewer authority to change the outcome, the information to do so, and a logged record of each override.

Questions HR and compliance leads ask about GDPR and employee data

Can we rely on employee consent for HR processing under the GDPR?

In most cases, no. The EDPB's guide for small business states that employees will in principle not be in a position to freely consent to processing by their employer, because they may feel unable to refuse. Consent has to be freely given to count under Article 6(1), so HR processing usually needs another basis: performance of the employment contract, a legal obligation such as social security or tax reporting, or legitimate interests where a documented balancing test supports it. Consent can still fit narrow, genuinely optional activities, such as an opt-in perk, but the employer should document why it is optional and make refusing it carry no penalty. Review each HR purpose separately and record the basis you chose before the processing starts.

What does Article 88 change for employee data?

Article 88 lets Member States adopt more specific rules for processing employees' personal data, by law or by collective agreement. These rules can cover recruitment, performance of the employment contract, management of work, health and safety and termination, and they must include suitable safeguards on transparency, intra-group transfers and workplace monitoring. In practice, the GDPR text alone does not settle every HR question. Your national employment law, works council agreements and sector rules can add duties, such as consultation before monitoring systems are introduced. Map the rules for each country where you employ people, and confirm them with local employment counsel, because they differ between Member States.

Do we need a DPIA for HR monitoring?

Often yes, and you should assume so until a documented assessment shows otherwise. Article 35 requires a data protection impact assessment where processing is likely to result in a high risk to individuals, and systematic monitoring of employees, large-scale use of special category data such as health information, or profiling that affects employment decisions are common triggers. A DPIA must describe the processing, assess necessity and proportionality, identify risks and set out measures to address them. Monitoring tools that record keystrokes, location or browsing history need the most careful review. If high risk remains after mitigation, Article 36 requires prior consultation with the supervisory authority before processing starts.

What does a review of automated decisions about workers require?

Article 22(1) gives people the right not to be subject to a decision based solely on automated processing, including profiling, where it produces legal or similarly significant effects. Hiring filters, scoring for promotion and automated dismissal or pay decisions can all fall within this. The Article 29 Working Party guidelines (WP251 rev.01), endorsed by the EDPB, state that human oversight must be meaningful, carried out by someone with the authority and competence to change the decision. A rubber-stamp reviewer does not meet this test. Technically, you need logs of inputs, model or rule versions and reviewer decisions, plus a way for workers to contest outcomes. Be aware that the Dutch DPA fined Uber EUR 824,990,000 for unlawful automated decision-making about drivers, with an appeal pending, so this area draws active enforcement.

What fines can apply to HR data violations under Article 83?

Article 83 sets the higher maximum tier at EUR 20 million or 4% of total worldwide annual turnover, whichever is higher, for infringements of the basic principles, lawful basis, data subject rights and transfer rules. Employee data processing that lacks a valid basis or breaks the principles can fall into this tier. Lower-tier infringements, such as failing to meet security or DPIA duties, carry a maximum of EUR 10 million or 2% of turnover. Actual fines depend on the nature, duration, gravity and mitigating steps, as set out in EDPB Guidelines 04/2022 on calculating fines. Supervisory authorities decide each case, so confirm the national practice in your key markets with counsel.

Can we run GDPR employee data compliance ourselves or do we need outside help?

Many organizations do the legal analysis in-house with their HR, legal and privacy staff, and bring in outside help for specific technical or documentation work. Work that tends to justify outside support includes configuring HR and monitoring systems for access control and retention, building logging for automated decision reviews, running the DPIA technical analysis and preparing evidence. The cost depends on the number of HR systems, how many countries you employ people in, the volume of monitoring and automated tooling, and whether works council consultation is needed. DeployOpen plans, implements and documents self-hosted open-source platforms inside your own infrastructure under a fixed written scope, and prepares systems and evidence. It does not give legal advice or issue certifications. Ask any partner for a written scope that names the legal owner of each decision.

How DeployOpen works on this

DeployOpen plans and implements self-hosted open-source HR platforms inside your own cloud accounts, data centers or air-gapped networks, so employee records stay under your control. We prepare the systems, access controls and evidence that support your HR GDPR position, while your organization keeps ownership of its lawful bases, works council arrangements and decisions.

How we scope

We agree a written scope listing the HR systems, employee data categories and locations in each engagement.
Scope names which Article 88 national rules, collective agreements and special category data flows are in or out.
Engagements are fixed-scope, with deliverables and timelines agreed in writing before work begins.

How we build

We configure access roles so payroll, health and disciplinary records stay limited to people with a need to know.
We set retention, logging and audit trails for HR records, and test that deletion and export actually run.
We document where automated tools touch hiring or performance, so human review points are visible and testable.

How we hand over

You receive configuration records, access matrices, retention settings and test results for each HR system in scope.
Documentation maps each control to the GDPR obligation it supports, for your records of processing and DPIA files.
We walk your HR, IT and legal owners through the evidence so they can maintain it after handover.

How we support

Ongoing support, upgrades and continuous security testing are available as retainers after handover.
We can re-check access roles and retention settings when HR systems change or new employee data flows are added.
Your legal counsel and data protection officer decide lawful bases and conclusions. DeployOpen does not issue audit reports or certificates.

GDPR for HR and employee data