Employee data protection

Processing employee data requires a defined purpose and an appropriate legal basis. Article 5 GDPR requires, among other things, lawfulness, purpose limitation and data minimisation. Article 6 lists legal bases for personal data. Special categories, such as health data, are subject to the additional requirements of Article 9.

For each material HR process, the business should record which data is actually needed, who provides it, who uses it and when the purpose ends. A field retained for convenience is not necessary merely because the system can store it. Recruitment, sickness, performance assessment and internal reports deserve separate analysis.

The information provided under Articles 13 or 14 GDPR should reflect the actual process. General notices may not be enough when new analysis tools, control systems or external platforms are introduced.

Employee data is often stored in payroll, time recording, recruitment, sickness, document and communication systems. Access should not follow from department membership alone. Article 32 GDPR requires a level of security appropriate to the risk. This includes organisational rules that limit and review permissions.

A workable access model describes roles, categories, approval, removal and substitution. Payroll needs different information from a manager. IT administrators may have broad technical rights without automatically becoming the function entitled to inspect every personnel record. Logs can support controls, but they should not be collected indefinitely without a defined purpose and clear access to the analysis.

At departure, the process must react quickly and in coordination. Accounts, keys, mobile devices, shared folders and external access need review. That is separate from deciding which documents must be retained for statutory duties or specific claims.

Time recording, GPS, video, login logs, communications and performance analytics can serve different purposes. Technical availability does not mean that every analysis is lawful. Before implementation, the business should describe the purpose, data volume, affected people, authorised users and deletion logic. Continuous behavioural or performance monitoring is particularly intrusive.

Employment law may apply alongside the GDPR. Section 96(1)(3) of the Austrian Labour Constitution Act addresses control measures and technical systems for monitoring employees where they affect human dignity. Section 96a contains separate rules for certain automated systems processing employee data. Whether works council consent is needed can therefore only be assessed from the concrete system and its effects.

The dedicated article on monitoring employees with software examines that situation. AI systems at work also raise questions about purpose, training data, evaluation and works agreements, addressed in the article on AI at work.

The GDPR does not provide one retention period for all employee data. Article 5(1)(e) limits storage to what is necessary. Employment, tax, social security and corporate law duties, as well as specific claims, may support continued retention. The reason should be recorded for each data category.

At departure, the whole personnel file should not be deleted immediately, but the entire account should not be archived without a time limit either. A sound process separates active access, handover material, restricted evidence and records supported by a specific legal or litigation reason. Article 17 provides exceptions to erasure, including where a legal obligation or the establishment, exercise or defence of legal claims requires storage.

A deletion concept should record more than periods. It should identify triggers, owners, technical routines, restrictions and the treatment of archives or backups. The dedicated article on former employee data provides more detail on departure situations.

Employees can exercise GDPR rights as data subjects. This includes the right of access under Article 15. A business should have a process covering identity, systems, deadlines, participating functions and possible restrictions. A request must not disappear between HR, IT and the privacy function.

For access, the business must assess which personal data is processed and which information Article 15 requires. Rights and freedoms of other people, trade secrets or legal restrictions may matter. The response must therefore reflect the actual records and circumstances of the case.

The focus topic on data subject rights and access provides a general process. Employee data should also remain connected to the governance framework, processing records, policies and controls.

Good employee data protection is not a single document. It connects HR, IT, managers, the privacy function, information security and, where needed, the works council. For each new processing activity, it should be clear who describes the purpose, which data is needed, which risks exist and how the decision is documented.

A focused legal and organisational review will usually benefit from the processing record, information notices, access model, deletion and retention rules, provider overview, policies, system description and relevant works agreements. These materials show whether the main issue concerns purpose, access, control, retention or co-determination.

We review the specific processing with you and organise the legal and operational steps so that HR, IT and managers can work with them. For new systems, a review before implementation is usually simpler than correcting ongoing analyses later.