Guide • Compliance • 16 min read
GDPR for HR: handling employee data correctly
Cara memproses data peribadi pekerja secara sah di bawah GDPR — asas yang sah, pengekalan, hak, keselamatan dan pemindahan antarabangsa.
Data HR ialah data berisiko tinggi
Fungsi HR mengendalikan sebahagian daripada data peribadi yang paling sensitif dalam mana-mana organisasi: butiran hubungan, gaji, maklumat bank, rekod prestasi, maklumat kesihatan, dan kadangkala semakan rekod jenayah. Di bawah General Data Protection Regulation (GDPR) dan pelaksanaan nasionalnya — Irish Data Protection Act 2018 dan UK GDPR / Data Protection Act 2018 — data ini mesti diproses secara sah, adil dan telus.
Getting this right is both a legal duty and a trust issue. Employees are data subjects with enforceable rights, and the Data Protection Commission in Ireland (or the ICO in the UK) can investigate complaints and impose significant fines. Treat employee data with the same rigour you would customer data.
Memilih asas yang sah
Every processing activity needs a lawful basis. A common mistake is to rely on consent for the employment relationship. Because of the power imbalance between employer and employee, consent is rarely freely given and is therefore usually the wrong basis for core HR processing. More appropriate bases are typically the performance of the employment contract, compliance with a legal obligation (for example tax and revenue reporting), and legitimate interests.
Data kategori khas — termasuk maklumat kesihatan yang digunakan untuk cuti sakit atau tujuan kesihatan pekerjaan — memerlukan syarat tambahan di bawah Article 9, yang lazimnya berkaitan dengan undang-undang pekerjaan, keselamatan sosial dan perlindungan sosial. Peta setiap jenis pemprosesan HR kepada asas dan syaratnya, serta rekodkan rasionalnya.
Transparency and data-subject rights
Employees must be told, in clear language, what data you hold, why, how long you keep it and who you share it with. This is usually delivered through an employee privacy notice, distinct from your customer-facing privacy policy. Provide it at the point of hiring and keep it current.
Data subjects can exercise rights including access (the subject access request), rectification, erasure in some circumstances, restriction and objection. Have a documented process for responding within the statutory timescale (generally one month). HR is a frequent recipient of access requests, so plan for how you will locate and redact information held across systems.
Pengekalan, peminimuman dan keselamatan
Jangan simpan data lebih lama daripada yang perlu. Bina jadual pengekalan yang mencerminkan kedua-dua keperluan undang-undang (rekod penggajian dan cukai, rekod masa bekerja, dokumentasi kesihatan dan keselamatan) serta keperluan perniagaan yang sebenar, dan padam atau anonimkan data melepasi tempoh tersebut. Kumpulkan hanya perkara yang anda benar-benar gunakan — peminimuman data ialah prinsip, bukan sekadar perkara kecil.
Security is a legal requirement, not just good practice. Apply role-based access so that managers see only what they need, encrypt data in transit and at rest, and keep an audit trail of who accessed what. A reputable HRIS gives you granular permissions and access logging out of the box, which is far safer than scattering employee data across spreadsheets and shared drives.
Pemindahan antarabangsa dan vendor
Jika perisian HR atau penyedia penggajian anda menyimpan data di luar Kawasan Ekonomi Eropah, anda mesti memastikan mekanisme pemindahan yang mencukupi — keputusan kesetaraan, klausa kontrak standard, atau perlindungan setara. Sejak Brexit, pemindahan antara EU dan UK dilindungi oleh status kesetaraan UK, tetapi perkara ini harus dipantau kerana ia tertakluk pada semakan.
Whenever you use a third party to process employee data, you need a written data-processing agreement setting out their obligations, and you should carry out due diligence on their security posture. Keep a record of your processors and where data is hosted so you can answer questions and respond to incidents quickly.
