Managing Employee Data: A Practical GDPR Guide

Employee records need clear rules: what you collect, who can access it and when it should be deleted. Start with the purpose of each record, rather than a list of information that might be useful someday.

Fact-checked on 21 September 2026. National employment rules and the circumstances of the processing also matter.

Collect information for a defined purpose

Contact details, payroll information, working hours and performance records serve different purposes. Record the purpose, the people who need access and the applicable retention rule for each category. An HR system should help you keep these distinctions clear.

The GDPR requires data minimisation. Being an employer is not a general permission to collect an employee's private information. Criminal-conviction and offence data is governed by Article 10, separately from the special categories in Article 9. GDPR, Articles 5, 9 and 10

Health information, trade-union membership and biometric data used for unique identification need particular care. For special-category processing, identify both an Article 6 basis and an applicable Article 9 condition. Employment-law necessity under Article 9(2)(b) depends on authorisation in EU or national law, or a qualifying collective agreement, with safeguards. EDPB: lawful processing and sensitive data

Choose the lawful basis for each activity

Contractual necessity, legal obligation and legitimate interests are common in employment, but the appropriate basis depends on the activity. A clause in a contract does not make every related use of data necessary. Legitimate interests require a necessity and balancing assessment; additional national rules can apply to monitoring.

Consent is often unsuitable where the employment relationship prevents a free choice. Where it is used, refusal and withdrawal must be possible without detriment. Document the basis before processing begins. EDPB: legal bases

Explain the processing clearly

For information collected directly from the employee, Article 13 normally requires the privacy information when the data is obtained. Data obtained elsewhere falls under Article 14, with its own timing and exceptions. Cover purposes, legal bases, recipients, retention, transfers where relevant, and applicable rights. An acknowledgement of a notice is not consent to every activity it describes. GDPR, Articles 13 and 14

Make the notice easy to find after onboarding. If the employee asks about a particular use of their data, someone should be able to explain the actual process behind the wording.

Handle employee requests through a clear process

Employees can request access and correction, and may have rights to erasure, restriction, portability or objection depending on the circumstances. Erasure is not unconditional: lawful retention duties and legal claims can justify keeping some records. Restriction is also not an absolute ban on every use of retained information.

Portability concerns data provided by the individual, processed by automated means on consent or contract grounds. It does not cover every HR record. Requests normally require a response within one month; a permitted extension must be explained within that first month. Corrections, erasure and restrictions may need to be communicated to recipients, subject to the Article 19 exceptions. EDPB: individuals' rights

A useful internal workflow is to:

1. Record when the request arrived and assign an owner.
2. Establish what is being requested and verify identity proportionately.
3. Search the relevant systems, including documents and correspondence.
4. Review the response for other people's information and applicable restrictions.
5. Send the response securely and record what was done.

Set retention by record type and jurisdiction

There is no single EU retention table for all employee data. Payroll evidence, candidate files and occupational-health records can have different requirements. Record the reason for each period, when the clock starts, any restricted archive stage and what happens when the period ends.

France's CNIL publishes HR retention guidance, but its country-specific periods should not be presented as EU-wide rules. Legal holds and statutory retention can change when deletion is appropriate. CNIL: retention periods

A software default is a setting to assess, not proof that the chosen period is lawful. Include exports, connected services and backup handling in your process.

Keep a record of activities, not a second employee list

A record of processing activities describes operations such as payroll or recruitment. It is not a separate row for every new employee. Do not assume that having fewer than 250 staff removes the obligation: the exemption is limited and ongoing HR processing is not occasional. EDPB: records and accountability

Check each provider's role

Where a supplier processes data on your behalf, an Article 28 processor contract is required. Other recipients may act as independent or joint controllers and need a different assessment; not every disclosure is a processor relationship. GDPR, Articles 26 and 28

For transfers outside the EEA, check the applicable adequacy decision or safeguards as well as the service contract. EU incorporation and server location do not establish the complete data flow. EDPB: international transfers

PersoHR provides data exports, erasure workflows and audit records to support these processes. Your organisation still needs to decide which rules apply, configure the service accordingly and review requests before acting on them.