GDPR for HR: Employee Data Compliance Checklist for Regulated Employers

Why Employee Data Is a Compliance Priority, Not Just an HR Matter

HR departments process some of the most sensitive personal data in any organisation: health records, performance data, disciplinary records, financial information (salaries, pensions, expenses), family circumstances, and in regulated sectors — criminal records checks, regulatory fitness and propriety assessments, and mandatory reporting data.

Despite this, employee data GDPR compliance is frequently treated as a lower priority than client data compliance. Regulators have noticed. Several of the enforcement actions in 2025–2026 involved HR-related violations: employee monitoring without disclosure, excessive retention of former employee records, DSARs from staff during dispute proceedings that revealed systematic data governance failures.

For firms in financial services, legal, healthcare, and other regulated sectors, the stakes are higher still. Regulatory fitness and propriety data, disciplinary records that touch on AML or fraud, and whistleblower data all intersect HR obligations with compliance obligations — creating a more complex risk landscape than typical employers face.

What Employee Data Does Your Firm Process?

Before you can assess compliance, you need a complete inventory. Most HR functions underestimate how much data they hold. A complete inventory includes data at every stage of the employment lifecycle:

Recruitment and pre-employment

• CV, cover letter, application form data
• Interview notes and assessment scores
• Reference letters and referee contact information
• Right-to-work verification documents
• Criminal records checks (DBS/disclosure checks) where legally permitted
• Financial background checks for regulated roles (FCA fit and proper, FINMA, etc.)
• Regulatory reference requests and responses (mandatory in UK financial services)

Active employment

• Personal details (name, address, date of birth, national insurance/tax number)
• Employment contract and terms
• Payroll, salary, and benefits data
• Pension and life assurance nominations
• Performance reviews and objectives
• Training records and professional qualifications
• Disciplinary and grievance records
• Absence and sickness records
• Flexible working and family leave documentation
• IT access logs, email monitoring data (if applicable)
• Travel expense claims and corporate card data
• Regulatory registrations (SMF, AR status in UK; MiFID tied agent registration)

Post-employment

• Resignation / termination documentation
• Settlement agreements and NDA terms
• Regulatory reference data (mandatory in financial services)
• Pension records and deferred benefit documentation
• HMRC / tax authority submissions
• Litigation hold data (if disputes are ongoing)

Lawful Basis for Employee Data Processing

GDPR requires a lawful basis for every processing activity. For employee data, the most commonly applicable bases are:

Special Category Data in HR

Several categories of HR data are "special category" under GDPR Article 9, requiring explicit consent or a specific Article 9 condition alongside the Article 6 lawful basis. In HR, the most common special categories are:

• Health data — sickness absence records, occupational health reports, disability accommodations, phased return-to-work plans. Most common special category in HR. Lawful basis is typically Article 9(2)(b) (employment law obligations) combined with Article 6(1)(c).
• Trade union membership — where employees disclose membership or where deductions are made for union dues. Article 9(2)(b) typically applies.
• Biometric data — fingerprint clocking-in systems, facial recognition access control. Requires explicit consent or Article 9(2)(b) employment law justification with a DPIA.
• Criminal conviction data — DBS checks, financial conduct checks, AML-related screening. Article 10 applies (not Article 9) — requires specific domestic law authorisation. In the UK, this is governed by the Rehabilitation of Offenders Act; in other EU jurisdictions, equivalent national provisions apply.

Employee Monitoring: The GDPR High-Risk Zone

The shift to remote and hybrid work dramatically increased employer use of monitoring software — productivity trackers, keyloggers, screenshot tools, email surveillance, and GPS tracking for remote workers. This is now one of the most actively enforced areas of employee data GDPR compliance.

The legal position across EU supervisory authorities is consistent:

• Employee monitoring is not inherently unlawful — but it must have a valid legal basis (typically legitimate interests or legal obligation)
• It must be proportionate — the least intrusive method that meets the legitimate aim
• Employees must be transparently informed — in their contract, a policy document, or a specific privacy notice — before monitoring begins
• A DPIA is required for systematic or large-scale employee monitoring (GDPR Article 35)
• In many EU jurisdictions (Germany, Netherlands, France, Austria), works council consultation is required before implementing monitoring systems

Data Subject Rights for Employees

Employees have the same GDPR data subject rights as any individual. In practice, the most commonly exercised are:

Right of access (DSAR)

Employees can request all personal data held about them. This is most commonly exercised during disciplinary proceedings, grievance procedures, or employment tribunal claims — precisely when you least want to discover that your data management has gaps. Common issues in employee DSARs include:

• Email records and informal manager communications that contain negative assessments
• Performance note files maintained outside formal HR systems
• IT monitoring data that reveals the extent of surveillance
• Payroll system data revealing pay equity issues
• References provided to other employers without the employee's knowledge

Right to erasure

Erasure requests from employees are more complex than client erasure requests because employment law creates overlapping retention obligations. You cannot delete payroll records that HMRC requires you to retain for 6 years, or pension records needed for 60 years, in response to an erasure request. Retention obligations override the right to erasure — but only for the data that is genuinely covered by the obligation. Extraneous data (informal notes, excessive monitoring data, old performance emails) can and should be deleted when no longer necessary.

Right to object

Employees can object to processing based on legitimate interests. If an employee objects to a monitoring programme, you must assess whether compelling legitimate grounds override their interests. This is a genuine balancing exercise — not a rubber-stamp to continue monitoring regardless.

HR Data Retention: Key Periods

Over-retention is one of the most common HR GDPR failures — and one of the easiest to fix. Establish a retention schedule and enforce it with periodic deletion reviews.

The HR GDPR Compliance Checklist

• Staff privacy notice (employee-facing) in place and current — separate from client-facing privacy notice
• Article 30 Records of Processing Activities (RoPA) includes all HR processing activities
• Lawful basis documented for each HR processing activity (contract, legal obligation, legitimate interests, consent where appropriate)
• Special category data processing documented with Article 9 condition
• Employment contracts updated to reference data processing activities
• Recruitment data retention policy in place (unsuccessful candidates deleted within 12 months)
• DBS / disclosure check policy: results not retained, notation only
• HR data systems access controls: least-privilege, role-based access to sensitive records
• Employee monitoring policy documented, disclosed in contracts/privacy notice, proportionate
• DPIA completed for any systematic employee monitoring
• Works council / employee representative consultation completed for monitoring (where required)
• DSAR procedure covers employee requests, not just client requests
• Retention schedule in place covering all HR data categories
• Annual deletion review scheduled for expired records
• Data breach procedure covers HR data breaches (e.g., emailing payroll data to wrong recipient)
• Third-party HR software and payroll providers have signed DPAs (GDPR Article 28)
• Cross-border transfers assessed where payroll is processed by a US-owned provider
• HR team trained on GDPR data subject rights, breach notification, and data minimisation

Frequently Asked Questions

← Back to Blog