HR 洞察 • 10 分钟阅读
了解人力资源部门的 GDPR
APR 2, 2026
人力资源部门每天都会处理敏感个人数据。这里有一份通俗易懂的 GDPR 义务指南，以及如何保持合规。
HR 的 GDPR 基础
英国《通用数据保护条例》（UK GDPR）及其欧盟对应法规规定了个人数据如何被收集、存储、使用和删除。对人力资源部门而言，个人数据涵盖从求职申请到工资单再到病假记录的所有内容。六项数据保护原则分别是合法性、公平性和透明性；目的限制；数据最小化；准确性；存储限制；以及完整性和保密性。HR 必须能够证明对全部六项原则的合规。
Legal bases for processing employee data
Every HR data processing activity must have a legal basis. The most common for employees are: performance of a contract (processing payroll data to pay an employee), legal obligation (maintaining right-to-work records), and legitimate interests (monitoring email use on company devices for security purposes). Special category data, which includes health information, racial or ethnic origin, and biometric data, requires an additional condition: most commonly explicit consent or necessity for employment law purposes.
Employee rights you must honour
Employees have the right to access their personal data (subject access requests must be responded to within one month), the right to have inaccurate data corrected, the right to erasure in some circumstances, and the right to restrict processing. Establish a clear process for handling these requests, train your HR team to recognise them, and ensure you can retrieve the relevant data from your HRIS quickly. Late or incomplete responses can result in regulatory action.
HR 的高风险领域
Certain HR activities carry higher data protection risk: automated decision-making in recruitment (using AI to screen CVs), the transfer of employee data to third-party payroll providers, the collection of biometric data for time-and-attendance systems, and the use of employee monitoring tools. Conduct a Data Protection Impact Assessment (DPIA) before implementing any new technology that processes special category data or involves automated decisions affecting individuals.
