GDPR and Employee Data, in Plain Terms

The short version

• GDPR treats your employees as data subjects with full rights. The HR file, the payroll record, the performance review and the CCTV clip are all personal data, and the same rules that protect your customers protect your staff.
• Consent is almost never the right lawful basis for employee data. The power gap between employer and employee means consent is rarely freely given. You lean on the employment contract, on legal obligations, and on legitimate interests instead.
• Health, biometrics, trade union membership and a handful of other categories are special. You cannot process them just because they are useful. You need a specific legal gateway, usually an employment-law obligation.
• A breach starts a 72-hour clock. Once you are reasonably sure personal data has been lost, exposed or altered, you have three days to tell the regulator unless the risk is negligible, and you may have to tell the affected employees too.
• Accountability is the real obligation. GDPR is less about asking permission and more about being able to show your work: why you hold each piece of data, how long you keep it, and who you share it with.

1. What GDPR actually is

The General Data Protection Regulation is the European Union's data protection law. It has applied since May 2018, and it governs how any organisation collects, uses, stores and shares the personal data of people in the EU and the wider European Economic Area.

Most people first met GDPR through cookie banners and marketing opt-ins. That framing undersells it. The regulation applies to all personal data an organisation processes, and some of the most sensitive data any company holds is not about its customers at all. It is about its own people.

Think about what sits in a normal HR system. Names, home addresses, dates of birth and national ID numbers. Bank details and salary. Next of kin. Sickness records and accommodations. Performance ratings and disciplinary notes. Right-to-work documents. In many companies, location data from a fleet vehicle or a building access card. Every one of those is personal data, and a good portion of it is the kind GDPR protects most strictly. The mental shift is this: GDPR is not a marketing problem that HR has to tolerate. It is an HR and people-operations obligation in its own right.

2. Why it reaches you, even outside the EU

A common assumption is that GDPR only matters to European companies. It does not work that way. The regulation follows the data, not the flag. If you have an establishment in the EU, such as a branch, a subsidiary or an office, your processing of personal data in that context is in scope, wherever your head office sits. A US parent with a German sales team, or an Indian services firm with a team in Ireland, is processing employee data under GDPR for those people.

It also reaches organisations with no EU establishment at all in certain cases, where they offer goods or services to people in the EU, or monitor the behaviour of people in the EU. For employee data, the usual hook is simpler: if you employ or engage people who are physically in the EU, you are almost certainly processing their data under GDPR. For a growing company, the practical trigger is often hiring. The moment you take on your first employee or contractor based in an EU or EEA country, GDPR is part of how you run HR. Many companies also apply GDPR-grade practices globally, because running two standards for the same HR system is harder than running one.

3. The concepts everything rests on

Four ideas carry most of the weight. Get these straight and the rest of the regulation reads more easily.

Personal data. Any information relating to an identified or identifiable person. That is broader than it sounds. It is not just the obvious identifiers like name and ID number. It includes an email address, an IP address, a staff number, a photo, a voice recording and a performance comment, as long as it can be tied back to an individual.

Special category data. A protected subset that gets extra rules. It covers data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, and trade union membership, plus genetic data, biometric data used to identify someone, health data, and data about sex life or sexual orientation. Criminal conviction data sits in a related, equally restricted bucket. In an HR context this is not exotic: sickness absence is health data, a union check-off on payroll is trade union data, and a fingerprint time clock is biometric data.

Controller and processor. These describe who is responsible. The controller decides why and how data is processed. For your employees' data, that is almost always you, the employer. A processor handles data on your instructions, such as a payroll bureau, a cloud HR platform or a benefits administrator. You stay accountable for what your processors do, which is why the contract with them matters.

The seven principles. Article 5 is the spine of the whole law. Process data lawfully, fairly and transparently. Use it only for the specific purposes you named. Collect only what you need. Keep it accurate. Do not keep it longer than necessary. Keep it secure. And, the one that trips people up, be able to demonstrate all of the above. That last principle, accountability, is why documentation is not optional.

4. The lawful bases for employee data

Every time you process personal data, you need a lawful basis for it. There are six to choose from, and choosing well is most of the job.

The six bases are consent, performance of a contract, compliance with a legal obligation, protection of vital interests, a public task, and legitimate interests. In employment, three of them do nearly all the work.

Performance of the contract. You need an employee's bank details to pay them, their address to send them documents, and their role and hours to manage the relationship. This data is necessary to deliver the employment contract, so the contract is your basis. No separate permission required.

Legal obligation. Tax authorities, social security systems and labour law require you to collect and keep certain records. Right-to-work checks, tax identifiers and statutory payroll reporting fall here. You are not choosing to hold this data, the law is telling you to.

Legitimate interests. This is the flexible basis, used where processing is genuinely in your reasonable interest and does not override the employee's rights. Proportionate security monitoring, an internal staff directory or network logs can sit here. The trade-off is that you have to do and document a balancing test, weighing your interest against the intrusion.

Consent is almost never valid in employment. Consent under GDPR has to be freely given, and a regulator will look at an employee asked for consent by their employer and see a power imbalance. Can the employee really say no without worrying about their job? Usually not. So consent given in that setting is often treated as invalid. There are narrow exceptions, such as a genuinely optional perk the employee can decline with no consequence, but as a rule, if you find yourself relying on employee consent for something core to the job, you have probably picked the wrong basis. Find the contract or legal-obligation footing instead.

5. Special category and criminal data in HR

Special category data is not forbidden, but it is gated. You cannot process it under an ordinary Article 6 basis alone. You need an additional, specific condition, and in employment most of those conditions trace back to law.

The most common gateway for employers is the condition that processing is necessary to carry out obligations and exercise rights in the field of employment, social security and social protection law. Sick pay, disability accommodations, occupational health and equal-opportunities monitoring usually rely on this. A second common one covers occupational medicine and assessing an employee's working capacity, used for health and medical records handled under professional confidentiality.

Explicit consent is a theoretical gateway for special category data, but it runs into the same power-imbalance problem as ordinary consent, so it is rarely safe to lean on at work. Criminal conviction data is handled even more tightly. You can only process it where you are under official authority or specifically authorised by law, which is why background checks are permitted for some roles and not others. If a role does not legally require a criminal record check, asking for one is a problem, not a precaution.

The practical takeaway is to treat these categories as high-voltage. Collect them only when a clear legal gateway applies, store them separately and more securely than ordinary HR data, and restrict who can see them to the people who genuinely need to.

6. The rights your employees have

GDPR gives every data subject a set of rights, and your employees can exercise them against you. Most requests are routine, but you need a process, because the clock on each one is short. You generally have one month to respond, extendable by two further months for complex requests, and you cannot charge for it in normal cases.

The right that generates the most work is access. A data subject access request, or DSAR, often surfaces during a grievance or an exit, and it can be wide-ranging. The time to build a calm, repeatable DSAR process is before you receive a hostile one, not during.

A note on erasure. Employees sometimes expect that leaving the company means their data disappears. It does not, and it should not. You are legally required to keep payroll, tax and certain HR records for years after employment ends. Erasure gives way to those retention duties. The honest answer to a departing employee is that you will keep what the law requires and delete the rest on schedule.

7. What you must do as an employer

Rights are the employee-facing half of GDPR. Accountability is the employer-facing half, and it is where most of the real operational work lives. None of this is dramatic. It is the quiet infrastructure that lets you prove you are handling data properly.

Keep a privacy notice for staff. A clear, employee-facing notice that explains what data you hold, why, on what basis, how long you keep it, and what rights they have. It should exist before you collect the data, usually shared at onboarding.

Maintain a record of processing. Most organisations need a record of processing activities, a simple internal inventory of what data you hold, why, where it lives, who you share it with, and how long you keep it. It sounds bureaucratic. In practice it is the single document that makes every other GDPR task easier, because you cannot protect data you have not mapped.

Set and enforce retention periods. Decide, per category of data, how long you keep it, tie that to the statutory minimums where they exist, and actually delete or anonymise data when the period ends. A retention schedule that nobody runs is a finding waiting to happen. Unsuccessful job applicants are a classic blind spot: their CVs should go once the hiring round closes, unless they have agreed to be kept on file.

Put contracts around your processors. Every third party that touches employee data on your behalf, the payroll bureau, the HRIS vendor, the benefits platform, needs a data processing agreement that binds them to GDPR-grade handling. If you have not signed one, you are exposed for their mistakes as well as your own.

Mind international transfers. Moving HR data from the EU to a parent or shared-services team in another country is a transfer, and it needs a legal mechanism, such as an adequacy decision or standard contractual clauses. Multinationals routing payroll or HR data back to a US or Indian head office need this in place.

Build in privacy by design. When you adopt a new HR tool or process, bake in data protection from the start rather than bolting it on. Collect less, default to tighter access, and switch off fields you do not need.

The Data Protection Officer

A Data Protection Officer is a defined role under GDPR, not just a job title you hand to whoever has spare capacity. Appointing one is mandatory in three situations: when you are a public authority, when your core activities involve large-scale, regular and systematic monitoring of people, or when your core activities involve large-scale processing of special category or criminal data. Many companies that do not strictly have to appoint a DPO choose to, because the role is useful.

What makes the DPO distinctive is independence. They advise and monitor, they report to the highest level of management, they cannot be penalised for doing their job, and they must not be put in a position where they are marking their own homework, so the role should not sit with someone who also decides how data is used. In the employee-data context, a DPO earns their keep by advising on the right lawful basis for each type of data, pre-screening new monitoring before it goes live, running or overseeing privacy impact assessments, giving employees a clear point of contact for their rights, and steering breach response when something goes wrong.

Data Protection Impact Assessments

A DPIA is a structured risk assessment you run before starting processing that is likely to be high risk. It forces you to describe what you are doing, test whether it is necessary and proportionate, identify the risks to people, and decide how to reduce them.

Several common HR activities push you into DPIA territory. Systematic or large-scale monitoring of employees is the classic one. So is new technology that profiles or scores people, large-scale handling of special category data, and some uses of biometrics. If you are about to roll out employee monitoring, an AI-assisted hiring tool or a biometric time clock, assume a DPIA is required and do it first. A DPIA done after launch is a report. Done before, it is a decision-making tool, and sometimes it tells you to stop.

8. Employee monitoring, done lawfully

Monitoring is where the gap between what technology allows and what the law allows is widest. You can track almost anything. You are permitted to track very little without care.

The usual lawful basis for monitoring is legitimate interests, which means you have to pass a proportionality test. You need a specific, documented purpose, such as securing systems or protecting property. "To improve productivity" or "for security" in the abstract is not enough. You have to show the monitoring is necessary for that purpose, that you chose the least intrusive method that works, and that your interest is not outweighed by the employee's privacy.

Two non-negotiables sit on top of that. Transparency: employees have to be told, in advance and specifically, what is monitored, how, why, and for how long the data is kept. New hires should know before they start, and monitored spaces like CCTV areas should be clearly marked. And minimisation: capture only what the purpose needs, and delete it on a short schedule.

How this plays out by type

• Email and messaging: logging who sent what and when, for a documented reason, is generally defensible. Reading the content of private messages generally is not.
• Internet and device activity: permissible for a specific, proportionate reason. Blanket surveillance with no defined purpose is not.
• CCTV: fine for premises, perimeters and parking. Off-limits in bathrooms, changing rooms and break areas except in rare, strictly justified cases.
• GPS and vehicles: reasonable for property protection and logistics. Tracking personal use of a company vehicle needs a separate basis and clear notice.
• Remote work: the same rules apply. Continuous screenshots, keystroke logging and always-on webcams are almost always disproportionate.

Covert monitoring is a last resort, not a tool. As a default, secret monitoring of employees is not allowed. Where national law permits it at all, it is typically only with a concrete, documented suspicion of a specific wrongdoing, after less intrusive options have been exhausted. If you are reaching for hidden cameras or silent trackers, that is the moment to call your DPO or your lawyer, not after.

National rules matter more here than almost anywhere else in GDPR. The regulation lets individual member states set their own, often stricter, workplace rules, and several require you to consult employee representatives before you monitor. Check the local position for every country you operate in.

9. When data goes wrong: breach notification

A personal data breach is any security failure that leads to personal data being destroyed, lost, altered, disclosed or accessed without authorisation. It is broader than a hack. A laptop left in a taxi, an email sent to the wrong distribution list, a payroll file shared with the wrong manager, and a ransomware attack are all breaches. They fall into three overlapping types: a confidentiality breach, where data is exposed; an integrity breach, where it is wrongly altered; and an availability breach, where you lose access to it.

The clock starts at awareness. Once you have a reasonable degree of certainty that a breach has happened, you are aware, and the 72-hour window opens. That is usually the moment an employee reports the suspicious email or the missing device, not weeks later when forensics wrap up. Do not wait for a complete picture before starting the clock.

Notify the regulator within 72 hours, unless the risk is negligible. You must report the breach to your supervisory authority without undue delay and within 72 hours where feasible, unless the breach is unlikely to result in a risk to people's rights and freedoms. If you decide not to report, you must document why, because the regulator can ask.

You can report in phases. If you do not have everything within 72 hours, send what you know, then follow up. A partial, on-time notification beats a complete, late one.

Tell the affected people if the risk is high. Where a breach is likely to result in a high risk to individuals, you also have to tell the employees themselves, without undue delay, in plain language, explaining what happened, the likely consequences, and what you are doing about it. You can avoid individual notice in limited cases, such as when the data was strongly encrypted and is unintelligible.

Processors must tell you fast. If a breach happens at one of your processors, such as your payroll provider, they are obliged to notify you without undue delay, so your clock can start. Make sure that duty is written into your contract with them.

Log every breach, even the ones you do not report. You must keep an internal register of all personal data breaches, recording what happened, its effects, and what you did. This is also where you keep the reasoning for any breach you decided not to report. If you cannot show that record, a regulator will assume the worst.

The failure mode to avoid is panic followed by silence. The organisations that handle breaches well are not the ones that never have them. They are the ones that detect quickly, start the clock honestly, and have a rehearsed response rather than an improvised one.

10. Penalties and enforcement

GDPR has real teeth, and regulators have shown they will use them. Fines run on two tiers. The lower tier reaches up to 10 million euros or 2 percent of total worldwide annual turnover, whichever is higher. The upper tier, for the most serious violations such as breaching the core principles or data subject rights, reaches up to 20 million euros or 4 percent of worldwide annual turnover, again whichever is higher.

Those headline numbers are the ceiling, not the norm, and most enforcement against employers is more mundane: an order to change a practice, a reprimand, or a smaller fine. But the reputational and trust cost of mishandling your own employees' data is its own penalty, and it does not wait for a regulator.

Enforcement practice also varies by country, because national authorities apply the shared rules with their own priorities and their own interpretations of the employment-specific rules their member state has set. For a multinational employer, "GDPR compliant" is not a single finish line. It is a baseline you clear everywhere, plus the local specifics you clear in each country you operate in.

11. A readiness plan you can start now

You do not need a transformation programme to get the fundamentals right. You need a sequence. Here is one you can start this quarter.

1. Map what you hold

Build or refresh your record of processing for employee data. List every category of data, where it lives, why you hold it, who you share it with, and how long you keep it. You cannot fix what you have not mapped.

2. Assign a lawful basis to each category

Go line by line and name the basis. Where you find yourself relying on employee consent for something core, that is a flag to fix, not a box to tick.

3. Ring-fence the sensitive data

Identify your special category and criminal data, confirm the legal gateway for each, store it separately, and tighten who can access it.

4. Write the privacy notice and the retention schedule

One document tells employees what you do with their data. The other tells your own team when to delete it. Then actually run the deletions.

5. Paper your processors and transfers

Confirm you have a data processing agreement with every vendor that touches employee data, and a valid transfer mechanism for any data that leaves the EEA.

6. Rehearse the breach response

Write a one-page runbook: who gets told, who decides on reporting, where the register lives, and how the 72-hour clock gets started. Run it once as a drill before you need it for real.

Done in order, this takes an HR team of modest size a few focused weeks, not a year. The point is not perfection. It is defensibility: being able to show, on any given day, that you know what employee data you hold and why.

12. Where Sageo fits, and where it does not

We should be straight about this. Sageo is not a GDPR compliance tool, and we are not your lawyers or your DPO. A guide like this one is where our role in the legal layer ends.

What we do touch is the layer underneath compliance: the quality of the people data you collect in the first place, and how defensibly you make decisions with it. Good people systems make GDPR easier almost as a side effect. When performance and competency data is captured through a structured framework rather than scattered across managers' notebooks and inboxes, it is easier to find for a DSAR, easier to justify, and easier to retain and delete on a schedule. When the logic behind a rating or a promotion decision is documented and consistent, you are better placed if an employee ever challenges an automated or semi-automated decision.

What Sageo helps with

• Structured, purpose-built performance and competency data, so you collect what you need and not a pile of ad-hoc commentary
• Documented, consistent decision frameworks that create a defensible audit trail for people decisions
• A single, governed system of record for performance data, which is far easier to map, access, and retain than data spread across spreadsheets and chat threads

What you need elsewhere

• The legal and governance layer: your DPO, your privacy notices, your lawful-basis analysis, your breach reporting. That is counsel and compliance territory.
• The security and IT layer: access controls, encryption, backups, and the technical measures that keep the data safe.
• Jurisdiction-specific employment-law advice for every country you operate in.

The honest summary is that Sageo reduces the surface area of risk by making your people data cleaner and your decisions more defensible. It does not replace the compliance stack. Anyone who tells you a single tool makes you "GDPR compliant" is selling you something.

How this guide was researched

This guide draws on the text of the GDPR itself, in particular the articles on principles (Article 5), lawful bases (Article 6), special category and criminal data (Articles 9 and 10), data subject rights (Articles 12 to 22), accountability obligations including records, impact assessments and the DPO role (Articles 30, 35, and 37 to 39), breach notification (Articles 33 and 34), and penalties (Article 83). It also reflects widely used practitioner guidance on employee data, workplace monitoring, the DPO's role in HR, and breach response. Where member-state practice diverges, we have flagged it rather than stated a single rule.

Written by

Deepti Gupta

Co-founder, Sageo

18+ years building people functions from the ground up at Myntra, Freshworks and Dream11, scaling teams from 100 to 2,500 people and designing company-wide performance and compensation systems. Sageo automates the frameworks she has built by hand throughout her career.

More from DeeptiLinkedIn

Reviewed by

Vinayak Ravi

Co-founder, Sageo

19+ years of B2B SaaS go-to-market leadership. He built the organic growth engine at Freshworks through its rise to a public company and has led demand generation at some of the sector's fastest-scaling software startups.

More from VinayakLinkedIn