GDPR (EU)
The European Union's General Data Protection Regulation (Regulation 2016/679), which took effect on 25 May 2018, establishing a unified data protection framework across the EU/EEA with strict rules on how organisations collect, process, store, and share personal data.
What Is the GDPR?
Key Takeaways
- ✓The General Data Protection Regulation (GDPR) is the EU's data protection law, directly applicable in all 27 EU member states plus Iceland, Liechtenstein, and Norway (EEA countries). It replaced the Data Protection Directive 95/46/EC.
- ✓It applies to any organisation that processes personal data of individuals in the EU/EEA, regardless of where the organisation is located. A US or Indian company processing EU employee or customer data must comply.
- ✓Personal data means any information relating to an identified or identifiable natural person: name, email, employee ID, IP address, location data, genetic data, biometric data, health data, and more.
- ✓The GDPR establishes 7 key principles: lawfulness/fairness/transparency, purpose limitation, data minimisation, accuracy, storage limitation, integrity/confidentiality, and accountability.
- ✓Maximum fines reach EUR 20 million or 4% of global annual turnover (whichever is higher) for the most serious infringements, with over EUR 4.5 billion in cumulative fines issued since 2018 (GDPR Enforcement Tracker).
The GDPR fundamentally changed how organisations handle personal data. Before 2018, data protection in Europe was governed by a directive that each member state implemented differently, creating inconsistent rules across 28 countries. The GDPR replaced that patchwork with a single regulation that applies uniformly. For HR teams, the GDPR touches almost every process: recruitment (collecting CVs, conducting background checks, storing applicant data), employment (processing payroll, managing performance, monitoring attendance), and offboarding (retaining records, providing references, deleting data). Employee data is some of the most sensitive data an organisation processes: salary information, health records, disciplinary history, diversity data, and communications. The GDPR doesn't ban the processing of personal data. It requires that processing has a lawful basis, is transparent, is limited to what's necessary, and is protected by appropriate security measures. Getting it right requires both legal understanding and operational discipline.
The 7 GDPR Principles
Article 5 sets out seven principles that govern all personal data processing. Every decision about how you collect, store, use, and share data should pass through these principles.
| Principle | What It Means | HR Example |
|---|---|---|
| Lawfulness, fairness, and transparency | Processing must have a legal basis, be fair to the individual, and be clearly communicated | Tell employees what data you collect about them and why (privacy notice) |
| Purpose limitation | Data collected for one purpose can't be reused for an incompatible purpose | Recruitment data can't be repurposed for marketing without consent |
| Data minimisation | Collect only the data that's necessary for the stated purpose | Don't collect marital status if it's not needed for benefits enrollment |
| Accuracy | Personal data must be accurate and kept up to date | Correct employee records when changes are reported (address, name, bank details) |
| Storage limitation | Data shouldn't be kept longer than necessary for its purpose | Delete job applicant data after the retention period (typically 6-12 months) |
| Integrity and confidentiality | Data must be protected against unauthorised access, loss, or destruction | Encrypt employee data at rest and in transit, restrict HR system access by role |
| Accountability | The controller must demonstrate compliance with all of the above | Maintain records of processing activities (ROPA), conduct DPIAs, train staff |
Lawful Bases for Processing Employee Data
Article 6 lists six lawful bases. For HR data, the most commonly used are contractual necessity, legal obligation, and legitimate interests. Consent is problematic in employment contexts.
Contract performance (Article 6(1)(b))
Processing is necessary to perform the employment contract. This covers: paying salaries, administering benefits, managing working hours, and providing the tools and information needed for the employee to do their job. It doesn't cover everything an employer might want to do with employee data. Monitoring employee emails "just in case" isn't necessary to perform the employment contract.
Legal obligation (Article 6(1)(c))
Processing is required by law. This covers: tax withholding and reporting, social security contributions, health and safety record-keeping, equality monitoring (where required by law), and responding to court orders. The legal obligation must be specific. "We might need it for legal purposes one day" isn't a valid legal obligation basis.
Legitimate interests (Article 6(1)(f))
The controller (employer) has a legitimate interest that isn't overridden by the individual's rights and freedoms. This is the most flexible basis but requires a documented Legitimate Interests Assessment (LIA). Common HR uses: internal HR reporting and analytics, monitoring workplace IT for security purposes, conducting disciplinary investigations, and managing company property. The employee's interests, rights, and expectations must be weighed against the employer's interests. Covert monitoring of employees, for example, is very difficult to justify under legitimate interests without strong evidence of suspected wrongdoing.
Why consent is problematic for employers
GDPR consent must be freely given, specific, informed, and unambiguous. In an employment relationship, the power imbalance between employer and employee means consent is rarely considered "freely given." An employee who's asked to consent to data processing may feel they can't refuse without consequences. For this reason, EU data protection authorities generally advise against relying on consent for employee data processing. Use contractual necessity, legal obligation, or legitimate interests instead. Consent may be appropriate for genuinely optional activities (joining a social committee, participating in voluntary surveys) where refusal has no negative consequences.
Data Subject Rights Under GDPR
The GDPR grants individuals eight rights. Each one creates operational obligations for HR teams.
| Right | Article | What It Means for HR |
|---|---|---|
| Right of access (SAR) | Art. 15 | Employees can request a copy of all personal data held about them |
| Right to rectification | Art. 16 | Employees can request correction of inaccurate personal data |
| Right to erasure (right to be forgotten) | Art. 17 | Employees can request deletion of data, subject to legal retention requirements |
| Right to restrict processing | Art. 18 | Employees can request that processing is limited while a dispute is resolved |
| Right to data portability | Art. 20 | Employees can request their data in a structured, machine-readable format |
| Right to object | Art. 21 | Employees can object to processing based on legitimate interests (employer must demonstrate overriding grounds) |
| Rights related to automated decision-making | Art. 22 | Employees have the right not to be subject to decisions based solely on automated processing (including profiling) that produce legal or significant effects |
| Right to be informed | Art. 13/14 | Employees must be told what data is collected, why, how long it's kept, who it's shared with, and their rights |
Data Breach Notification Requirements
When a personal data breach occurs, the GDPR imposes strict notification obligations on both timing and content.
Notification to the supervisory authority (Article 33)
The controller must notify the relevant supervisory authority (e.g., the ICO in the UK, CNIL in France, BfDI in Germany) within 72 hours of becoming aware of a breach, unless the breach is unlikely to result in a risk to individuals' rights and freedoms. The notification must include: the nature of the breach, categories and approximate number of data subjects affected, the likely consequences, and the measures taken or proposed to address the breach. "Becoming aware" means the point at which the controller has a reasonable degree of certainty that a breach has occurred. Deliberately delaying investigation to avoid triggering the 72-hour clock is a compliance failure in itself.
Notification to affected individuals (Article 34)
If the breach is likely to result in a high risk to individuals' rights and freedoms, the controller must also notify the affected individuals "without undue delay." The notification must be in clear, plain language and describe the nature of the breach, the likely consequences, the measures taken, and how the individual can protect themselves. Notification to individuals isn't required if: the data was encrypted or otherwise unintelligible, the controller took measures that eliminated the high risk, or individual notification would involve disproportionate effort (in which case a public communication is required).
International Data Transfers
Transferring personal data outside the EU/EEA is one of the most complex areas of GDPR compliance, particularly for multinational employers.
Adequacy decisions
The European Commission can determine that a third country provides an adequate level of data protection. Transfers to adequate countries don't require additional safeguards. As of 2024, countries with adequacy include: the UK (until June 2025, subject to renewal), Japan, South Korea, Canada (for commercial organisations), New Zealand, Israel, and the US (under the EU-US Data Privacy Framework, adopted July 2023). The adequacy decision for the US followed the invalidation of the Privacy Shield in Schrems II (2020) and requires US companies to self-certify under the Data Privacy Framework.
Standard Contractual Clauses (SCCs)
In the absence of an adequacy decision, the most common transfer mechanism is Standard Contractual Clauses (updated versions adopted by the European Commission in June 2021). SCCs are pre-approved contractual terms that the data exporter and importer must sign. However, following Schrems II, organisations must also conduct a Transfer Impact Assessment (TIA) to verify that the SCCs provide adequate protection in practice, considering the laws and surveillance practices of the recipient country.
GDPR Compliance Checklist for HR Teams
Practical steps every HR department should take to comply with GDPR requirements for employee data.
- Issue an employee privacy notice at the start of employment covering: what data is collected, the lawful basis for each processing activity, retention periods, who data is shared with, international transfers, and employee rights.
- Maintain a Record of Processing Activities (ROPA) for all HR data processing operations as required by Article 30.
- Conduct Data Protection Impact Assessments (DPIAs) before implementing new systems or processes that involve high-risk processing (large-scale monitoring, profiling, processing special category data).
- Establish clear data retention schedules for all HR data categories: recruitment data (6-12 months after rejection), employment records (6 years after employment ends for tax/legal reasons), and health data (as required by occupational health regulations).
- Train all HR staff on GDPR obligations, including recognising and handling SARs, breach reporting procedures, and data minimisation principles.
- Review all HR technology vendors for GDPR compliance, ensure data processing agreements (Article 28) are in place, and verify that sub-processors are disclosed.
- Implement access controls: restrict HR system access by role, use multi-factor authentication, encrypt data at rest and in transit, and maintain audit logs.
- Establish a process for handling data subject rights requests (SARs, erasure requests, portability requests) within the statutory deadlines.
GDPR Enforcement Statistics [2026]
Data on GDPR fines and enforcement actions across the EU/EEA.
Frequently Asked Questions
Does GDPR apply to companies outside the EU?
Can an employer monitor employee emails under GDPR?
How long can an employer keep employee data after they leave?
What counts as 'special category data' in an HR context?
Is a Data Protection Officer (DPO) required?
How does GDPR interact with UK data protection law after Brexit?
Written by Adithyan RK