5.3HR data, GDPR & privacy
The essentials in 30 seconds
- Sensitive data: health, sanctions, pay — legal basis, minimization (nothing “just in case”), limited retention.
- Rights served: clear notice, access and rectification within the applicable deadline — an employee who asks tests the system.
- Security + register: access roles, logging, up-to-date register, DPO if required — a pay export on a USB stick = a breach.
Threaded mini-case — Amira keeps her register
Amira finds a CV pool kept for years with no consent, employee files open to everyone and no processing register. This section tells how she inventories each processing activity (purpose, basis, data, retention, recipients, security), restricts access, purges the pool and has everything validated by her DPO and lawyer in light of Law 18-07, to be checked.
Sequel to cases 5.1-5.2 — Amira secures data after attractiveness and fairness.
1. HR data is sensitive by nature
Health, sanctions, pay, union views: the HRIS holds sensitive data. Reflexes: legal basis (contract, obligation, legitimate interest), minimization (no “just in case” data), retention periods (limited storage then archiving or deletion) — check before every file.
Amira deletes three “just in case” columns from her absence tracker and writes the purpose of each processing activity: every line defends itself.
2. Employee rights: serve them
Information (clear notice: what, why, how long), access and rectification (reply within the applicable deadline), objection (depending on the processing). An employee asking for their file tests the system: answering well builds loyalty.
Amira posts a readable notice and treats every access request as priority: the requester becomes an ambassador instead of a complainant.
3. Security: locks and register
Roles (who sees pay?), logging (who accessed?), processing register (kept up to date), DPO (appointed if required), breach (procedure: contain, notify if required). French reference cited in V2 (CNIL): transpose to local law — similar principles almost everywhere.
Amira restricts pay to two roles, enables access logs and keeps her register: presentable at any inspection, gaps closed.
🔎 Concrete example — A register that survives an inspection
One line per processing activity, each defensible.
Situation: per processing activity: purpose, basis, data, retention, recipients, security; payroll backed by the contract with a framed provider; hiring on legitimate interest with the pool purged without consent.
Lesson: register presented, gaps closed: every line defends itself.
Section vocabulary
- Personal data
- Information about an identified or identifiable person (identity, pay, health…).
Simple example: Amira classes pay and sick leave as sensitive.
What it is not: anonymous statistics not linkable to anyone.
Reflex: does this file identify someone?
- Minimization
- Only collect what is strictly needed for a specific purpose.
Simple example: Amira deletes the “just in case” columns.
What it is not: keeping everything “you never know”.
Reflex: does this data serve the written purpose?
- People's rights
- Information, access, rectification, objection depending on the case.
Simple example: Amira serves each request within the applicable deadline.
What it is not: refusing or stalling an access request.
Reflex: does my notice say what, why, how long?
- Processing register
- An up-to-date inventory: purpose, basis, data, retention, security.
Simple example: Amira presents her register at any inspection.
What it is not: files created with no trace or owner.
Reflex: does each processing activity have its line?
- Privacy
- Access limited to need-to-know (roles, logs, security).
Simple example: Amira restricts pay to two traced roles.
What it is not: the employee file open to the whole company.
Reflex: who accessed pay this month?
In practice — Managing HR data in compliance
- Collect only needed data (minimization), for specific legitimate purposes, and inform people.
- Limit data access (an employee file is not open to everyone) and secure it (especially in the HRIS).
- Set retention periods by document type (locally validated) and archive or delete beyond them.
- Respect people's rights (access, rectification), check tool compliance and adapt to local law with a DPO or lawyer.
Ready-to-say script — frame a new file with the DPO (1 min)
"Before creating this tracker: which legal basis, which strictly needed data, which retention, who accesses it? I write the notice and the register line, and you confirm everything against the applicable rules before opening."
Say to the DPO or lawyer; do not open the file before written validation.
Copy-paste template — register line
PROCESSING: _______________
PURPOSE + LEGAL BASIS: _______________
DATA (minimal): _______________
RETENTION (locally validated): _______________
RECIPIENTS + ROLES: _______________
SECURITY + VALIDATED BY (DPO/lawyer, date): _______________New HR file
Amira applies the four-question reflex (what, why, how long, who) before each creation — never after.
Employee access request
Acknowledge, extract complete, reply within the applicable deadline: the requester tests the system — serve them, do not dodge.
Application pool
Without explicit consent: purge at the locally agreed expiry. With consent: trace it and purge at its end.
Payroll provider / HRIS
Frame contractually (recipients, security, retention) and have it validated by a DPO or lawyer before migration.
✓ Best practices
- Minimize: nothing “just in case”.
- Inform and serve rights within the applicable deadline.
- Lock down: roles + up-to-date register.
✗ Common pitfalls
- Keeping everything “just in case”.
- Everyone accessing everything.
- The eternal pool without consent.
Key takeaways
- HR handles sensitive personal data, framed in Europe by the GDPR.
- Principles: minimization, specific purpose, information, security, limited access, controlled retention.
- Watch file privacy and tool compliance (HRIS, hiring, AI).
- A breach exposes you to penalties; the GDPR applies in Europe, other countries have their own rules.
48h challenge — apply tomorrow
Inventory 3 processing activities on the template above (purpose, basis, retention, roles), purge 1 expired pool without consent and send everything to your DPO or lawyer for validation. Note the gaps.
- I can justify a file (basis, purpose, retention, roles).
- I can serve an access request without dodging.
- My 3 register lines are sent for validation.
Frequently asked questions
Does the GDPR really concern daily HR work?
Yes, very concretely, because HR is one of the departments handling the most sensitive personal data: applications, contracts, pay, reviews, sick leave… Every HR act is data processing. Daily, this means for example: not keeping unsuccessful candidates' CVs indefinitely, not leaving an employee file accessible to everyone, not collecting unneeded information (minimization), securing files and the HRIS, informing employees about the use of their data, and answering their access requests. In Europe, the GDPR frames all this; elsewhere, other personal-data regulations apply, to be identified locally. In any case, it is a matter of compliance and respect for people.
Can an AI tool be used to screen applications with regard to personal data?
It is possible but requires caution, on two counts. First on personal data: a hiring or AI tool processes candidate data, hence subject to data-protection rules (purpose, information, security, limited retention, people's rights). Then on bias and transparency: automated screening can reproduce or amplify discrimination present in training data, and make decisions that are hard to explain. Best practices: keep human control over decisions (AI assists, it does not decide alone), check for discriminatory criteria, inform candidates, and ensure tool compliance. In short: AI can help with screening, but under supervision, with care over bias and data respect — see also section 5.5.
Amira creates an absence tracker. Right reflex?