Guide • Compliance • 16 min read
GDPR for HR: handling employee data correctly
How to process employee personal data lawfully under the GDPR — lawful bases, retention, rights, security and international transfers.
HR data is high-risk data
HR functions handle some of the most sensitive personal data in any organisation: contact details, salary, bank information, performance records, health information, and sometimes criminal-record checks. Under the General Data Protection Regulation (GDPR) and its national implementations — the Irish Data Protection Act 2018 and the UK GDPR / Data Protection Act 2018 — this data must be processed lawfully, fairly and transparently.
Getting this right is both a legal duty and a trust issue. Employees are data subjects with enforceable rights, and the Data Protection Commission in Ireland (or the ICO in the UK) can investigate complaints and impose significant fines. Treat employee data with the same rigour you would customer data.
Choosing a lawful basis
Every processing activity needs a lawful basis. A common mistake is to rely on consent for the employment relationship. Because of the power imbalance between employer and employee, consent is rarely freely given and is therefore usually the wrong basis for core HR processing. More appropriate bases are typically the performance of the employment contract, compliance with a legal obligation (for example tax and revenue reporting), and legitimate interests.
Special category data — including health information used for sick leave or occupational-health purposes — needs an additional condition under Article 9, often relating to employment, social security and social protection law. Map each type of HR processing to its basis and condition, and record the reasoning.
Transparency and data-subject rights
Employees must be told, in clear language, what data you hold, why, how long you keep it and who you share it with. This is usually delivered through an employee privacy notice, distinct from your customer-facing privacy policy. Provide it at the point of hiring and keep it current.
Data subjects can exercise rights including access (the subject access request), rectification, erasure in some circumstances, restriction and objection. Have a documented process for responding within the statutory timescale (generally one month). HR is a frequent recipient of access requests, so plan for how you will locate and redact information held across systems.
Retention, minimisation and security
Do not keep data longer than necessary. Build a retention schedule that reflects both legal requirements (payroll and tax records, working-time records, health-and-safety documentation) and genuine business need, and delete or anonymise beyond those periods. Collect only what you actually use — data minimisation is a principle, not a nicety.
Security is a legal requirement, not just good practice. Apply role-based access so that managers see only what they need, encrypt data in transit and at rest, and keep an audit trail of who accessed what. A reputable HRIS gives you granular permissions and access logging out of the box, which is far safer than scattering employee data across spreadsheets and shared drives.
International transfers and vendors
If your HR software or payroll provider stores data outside the European Economic Area, you must ensure an adequate transfer mechanism — an adequacy decision, standard contractual clauses, or equivalent safeguards. Since Brexit, transfers between the EU and the UK are covered by the UK's adequacy status, but this should be monitored as it is subject to review.
Whenever you use a third party to process employee data, you need a written data-processing agreement setting out their obligations, and you should carry out due diligence on their security posture. Keep a record of your processors and where data is hosted so you can answer questions and respond to incidents quickly.
