GDPR when processing employee data

GDPR in the processing of employee data concerns every company that employs anyone. An employer handles a large amount of personal data, from payroll records to health information. With that comes responsibility for protecting it throughout the employment relationship and after it ends. Employees are also paying more and more attention to how a company handles their data, so it is a question of trust as well. In this article we explain the basic obligations and the most common mistakes.

What employee data a company processes

As part of its HR and payroll administration, a company processes a wide range of data. Some of it falls into special categories that enjoy enhanced protection.

• identification and contact details
• payroll and bank details
• data on health and sick leave
• data on family members for the tax bonus

Legal basis for processing

When applying GDPR to employee data, the key is to have the correct legal basis for every processing operation. A company processes most data on the basis of performing the employment contract and meeting its legal obligations, not on the basis of consent. Consent is used only where the employee has a genuinely free choice, for example when a photograph is published.

Duty to inform and employees’ rights

The employer must inform employees what data it processes and for what purpose. Employees have the right to access their data, to have it corrected and, under certain conditions, to have it erased. These rights must be secured in practice, and requests must be answered within a reasonable time.

Data security and retention

Personal data must be protected against unauthorised access, loss or misuse by appropriate technical and organisational measures. It is equally important not to keep data longer than necessary. Specific retention periods apply to payroll and personnel documents.

• limit access to the data to authorised persons only
• secure documents both physically and electronically
• observe the retention and shredding periods

The most common mistakes companies make

Typical failings include collecting excessive data, not informing employees, or relying on consent where it is not appropriate. Storing payroll or medical documents without protection is also a mistake. As the interpretation of the rules is evolving, check the current conditions.

Passing data on to third parties

When processing payroll and HR administration, a company routinely passes employee data on to other parties. These include, for example, insurance companies, the tax office, the bank when paying wages, or an external accounting firm. Each such transfer must have a legal ground and, in the case of an external processor, a data processing agreement as well. Employees should be informed of the range of recipients. Transfers of data abroad or to cloud services call for particular care. GDPR in the processing of employee data therefore does not stop at the company gates; it accompanies the data throughout its entire life cycle.

How to keep GDPR under control

Protecting employee data is not a one-off task but part of everyday practice. We recommend having clear rules on who accesses which data, and securely set-up payroll processes. When processing payroll, our specialists take care to keep data confidential, and they will help you reduce the risk of sensitive information leaking and set up your processes so that data protection works in practice, not just on paper.

Related articles: State contribution for training new employees, Health and safety at work: the employer’s basic obligations, Non-compete clause in an employment contract.

Frequently asked questions

Do I need an employee’s consent to process their data?

A company processes most data on the basis of the employment contract and its legal obligations, so separate consent is not needed. Consent is used only where the employee genuinely has a free choice, for example when a photograph is published. Check the current interpretation.

How long can employees’ payroll documents be kept?

Specific retention periods apply to payroll and personnel documents, and they tend to be fairly long. Data should not be kept longer than necessary or longer than the law requires. Check the specific periods, as they may differ depending on the type of document.