GDPR employee data handling is not a filing exercise. HR teams need to know why each record exists, who can view it, and when it must be deleted. A clean process protects employees and makes an audit far less disruptive.
Start with a GDPR employee data map
List the data HR holds across the employee lifecycle. Include job applications, contracts, payroll records, leave data, performance notes, access logs, benefits information, disciplinary files and exit records. Then record the purpose, system owner, recipients, storage location, access group and retention trigger for each set.
Keep the map useful. A spreadsheet with 80 vague rows will not help an HR manager answer a request. A practical register might separate a signed contract from a manager’s probation note because they have different purposes, access needs and retention periods.
Data minimisation matters here. If a field does not support a defined HR, legal or operational purpose, do not collect it. Article 5 of the GDPR requires personal data to be adequate, relevant and limited to what is necessary.
Choose the lawful basis before processing
Every processing activity needs an Article 6 lawful basis. In employment, the usual options are contractual necessity, compliance with a legal obligation, and legitimate interests. The right choice depends on the actual purpose, not the label HR prefers.
- Contract: use where processing is objectively necessary to perform the employment contract, such as administering agreed pay or benefits.
- Legal obligation: use where employment, tax, social security or safety law requires the record or action.
- Legitimate interests: may fit a proportionate business need, such as protecting company systems, after a documented balancing assessment.
Consent is usually a poor default in employment because workers may not feel free to refuse. If HR processes health data, trade union membership, biometric data or another special category, an Article 6 basis alone is not enough. It also needs an Article 9 condition and appropriate safeguards. The UK ICO makes the same point in its employment guidance on workers’ health information.
Turn retention into a working schedule
The GDPR does not prescribe one universal retention period for employee records. It requires organisations to keep data no longer than necessary for the stated purpose. Retention therefore needs a documented schedule that reflects legal duties, limitation periods, payroll requirements, disputes and operational needs.
Set a clear trigger for each period. For a candidate who was not hired, the trigger may be the close of recruitment. For a leaver’s personnel file, it may be the employment end date. Hold periods and legal claims can pause deletion, but the reason should be recorded.
| Record | Purpose | Example trigger | Owner |
|---|---|---|---|
| Interview notes | Recruitment decision | Role filled | Talent team |
| Employment contract | Employment administration | Employment ends | HR operations |
| Absence evidence | Leave and workplace support | Case closed | HR case owner |
Example: a company closes a recruitment process on 30 June. Its approved schedule says unsuccessful-candidate notes are deleted after 180 days unless a documented dispute hold applies. The system owner should queue deletion for 27 December, review any hold before that date, and retain evidence that the deletion ran. The schedule, not a manager’s memory, drives the outcome.
Make employee access requests routine
An employee can request access to their personal data. Under Article 12, organisations should respond without undue delay and normally within one month of receiving the request. A complex or numerous request can justify up to two additional months, but the employee must be told within the initial month.
Set one intake route, even if requests arrive through a manager, HR inbox or private email. Confirm identity where needed. Freeze routine deletion for relevant records, search the mapped systems, and review material for third-party data or confidential information that may need redaction. Keep a request log with the received date, scope, searches performed, decision-maker and response date.
Five controls that make audits calmer
- Maintain a current processing register for employee data.
- Link each activity to a lawful basis and, where needed, a special-category condition.
- Apply role-based access and review privileged HR access regularly.
- Run retention deletion reports and record exceptions or legal holds.
- Test an access-request workflow with a realistic sample file.
Audit readiness means being able to show the decision trail. It does not mean keeping every document forever. A central personnel management system can help HR assign ownership, standardise permissions and find records quickly, but the organisation still owns the purposes, rules and reviews.
Set the lawful basis, retention trigger, access owner and evidence trail for each HR record now. That is the practical foundation for compliant employee data handling.
