HR GDPR Compliance Guidelines

HR GDPR Compliance Guidelines

Purpose: These HR GDPR Compliance Guidelines set out the substantive legal and operational requirements for the collection, processing, retention, transfer, and disposal of personal data processed in the context of employment and candidate selection. All employees, contractors, and agents who handle personal data in HR processes must follow the obligations and procedures described below.

Personal Information

Position Information

Start Date:

Employment History (Most Recent)

From: To:

Employment History (Prior)

From: To:

Education

Graduation Date:

References

GDPR: Key Principles and Legal Bases

Lawful Bases for HR Processing: The HR function will rely on one or more lawful bases for processing personal data, including (a) performance of an employment contract, (b) compliance with legal obligations (for example payroll, tax, right-to-work checks), (c) legitimate interests where such interests are balanced against the rights of the data subject (for example workforce planning and internal investigations), and (d) explicit consent where required for special categories of data (for example health information) or for optional staff surveys. The chosen lawful basis must be recorded and documented in accordance with record-keeping procedures.

Data Minimization and Purpose Limitation: HR will collect only personal data that is adequate, relevant, and limited to what is necessary for specified HR purposes. Personal data must not be repurposed for new activities without a documented legal basis and appropriate notice to the affected data subjects.

Categories of Personal Data

HR processes a range of personal data categories including identification (names, addresses), contact details, employment and education history, financial information for payroll, national identifier information where required by law, and special category data (health, disability, criminal records) only where strictly necessary and with appropriate safeguards and lawful basis documented.

Data Subject Rights and Requests

Rights: Employees and applicants have rights including access, rectification, erasure (when not in conflict with legal obligations), restriction of processing, portability, and objection. Requests must be logged immediately, verified for identity, processed within statutory timeframes, and escalated to HR leadership and the data protection function when legal exemptions are considered.

Retention, Archiving, and Disposal

Retention Policy: HR will maintain documented retention periods for employee records and candidate files consistent with legal obligations and legitimate business needs. Retention periods and justification must be recorded. Secure disposal by permanent deletion or physical destruction is required at end of retention.

Data Security and Access Controls

Security Measures: HR must implement appropriate technical and organizational measures to ensure confidentiality, integrity, and availability of personal data. Access must be role-based and logged. Use of portable storage and external sharing must be restricted and encrypted where required.

Third-Party Processors and International Transfers

Processors: All contracts with processors that handle HR data must require data processing agreements that include documented subprocessors, confidentiality obligations, security measures, and permitted transfer mechanisms. International transfers require appropriate safeguards and documented legal basis.

Data Breach Notification

Breach Response: Any suspected personal data breach must be reported to the HR data lead immediately. HR will follow the incident response procedure, investigate, and where required by law notify supervisory authorities within the applicable statutory period and notify affected data subjects without undue delay.

Data Protection Impact Assessments (DPIAs)

DPIA Requirement: HR must perform a DPIA for high-risk processing operations, including large-scale processing of special categories of data, systematic monitoring of employees, or new HR systems. DPIAs must identify risks and mitigation steps and be retained as records of processing activities.

Employee Obligations and Training

Mandatory Training: All staff involved in HR processing must complete GDPR and data protection training annually. Employees must report suspected breaches, avoid unnecessary copying or retention of data, and follow secure disposal procedures.

Monitoring, Audit, and Sanctions

Compliance Monitoring: HR will conduct periodic audits of processing activities and records. Non-compliance with these Guidelines may result in disciplinary action, up to and including termination, and potential legal liability.

Record-Keeping and Documentation

Records of Processing: HR must maintain accurate records of processing activities, including categories of data, processing purposes, retention periods, data sharing, and legal bases. These records will be available for internal review and regulatory inspection.

Applicant Certification and Authorizations

I certify that all information provided in this document is true and complete to the best of my knowledge. I acknowledge that I have read and understood these HR GDPR Compliance Guidelines, that I will comply with the policies and procedures herein, and that I have been informed of my obligations with respect to personal data.

Authorization: By signing below I expressly authorize HR to contact my previous employers, educational institutions and listed references to verify the information provided and to conduct background, identity verification and other pre-employment checks as permitted by law. I understand that any special category data provided will be processed only where necessary and with explicit consent or other lawful basis as described above.

Notes for HR Use

Sign Now