Guide • Compliance • 16 min read
GDPR for HR: handling employee data correctly
GDPR の下で従業員の個人データを適法に処理する方法。法的根拠、保存期間、権利、セキュリティ、国際移転を扱います。
HR データは高リスクデータです
HR部門は、組織内で最も機微な個人データの一部を取り扱います。連絡先情報、給与、銀行情報、評価記録、健康情報、そして場合によっては犯罪歴確認です。一般データ保護規則（GDPR）およびその国内実施法—アイルランドの Data Protection Act 2018 と英国の UK GDPR / Data Protection Act 2018—の下では、このデータは適法、公正、かつ透明に処理されなければなりません。
Getting this right is both a legal duty and a trust issue. Employees are data subjects with enforceable rights, and the Data Protection Commission in Ireland (or the ICO in the UK) can investigate complaints and impose significant fines. Treat employee data with the same rigour you would customer data.
適法な根拠の選択
Every processing activity needs a lawful basis. A common mistake is to rely on consent for the employment relationship. Because of the power imbalance between employer and employee, consent is rarely freely given and is therefore usually the wrong basis for core HR processing. More appropriate bases are typically the performance of the employment contract, compliance with a legal obligation (for example tax and revenue reporting), and legitimate interests.
健康情報などの特別カテゴリーのデータは、病気休暇や職業上の健康目的で使用される場合を含め、Article 9 に基づく追加の条件が必要であり、多くの場合、雇用、社会保障、社会保護法に関連します。HRの各種処理をそれぞれの根拠と条件に対応付け、その理由を記録してください。
Transparency and data-subject rights
Employees must be told, in clear language, what data you hold, why, how long you keep it and who you share it with. This is usually delivered through an employee privacy notice, distinct from your customer-facing privacy policy. Provide it at the point of hiring and keep it current.
Data subjects can exercise rights including access (the subject access request), rectification, erasure in some circumstances, restriction and objection. Have a documented process for responding within the statutory timescale (generally one month). HR is a frequent recipient of access requests, so plan for how you will locate and redact information held across systems.
保存、最小化、セキュリティ
必要以上に長くデータを保持しないでください。法的要件（給与計算および税務記録、労働時間記録、安全衛生文書）と正当な業務上の必要性の双方を反映した保存スケジュールを作成し、その期間を超えるものは削除または匿名化してください。実際に使用するものだけを収集してください。データ最小化は心遣いではなく原則です。
Security is a legal requirement, not just good practice. Apply role-based access so that managers see only what they need, encrypt data in transit and at rest, and keep an audit trail of who accessed what. A reputable HRIS gives you granular permissions and access logging out of the box, which is far safer than scattering employee data across spreadsheets and shared drives.
国際移転とベンダー
HRソフトウェアまたは給与計算プロバイダーが欧州経済領域外にデータを保存する場合、十分性決定、標準契約条項、または同等の保護措置といった適切な移転メカニズムを確保しなければなりません。Brexit 以降、EU と英国間の移転は英国の十分性認定によりカバーされていますが、これは見直し対象であるため監視が必要です。
Whenever you use a third party to process employee data, you need a written data-processing agreement setting out their obligations, and you should carry out due diligence on their security posture. Keep a record of your processors and where data is hosted so you can answer questions and respond to incidents quickly.
