Human Resources

Legal Framework

Processing employee and HR data falls squarely within the scope of the GDPR, with Article 6(1)(b) GDPR serving as the primary lawful basis for most employment-related processing—personal data necessary for the performance of a contract to which the data subject is party. Where processing goes beyond what is strictly contractual, Article 6(1)(c) GDPR (compliance with a legal obligation) and Article 6(1)(f) GDPR (legitimate interests) may apply, though the latter requires careful balancing under Article 6(1)(f) and is subject to additional constraints for public authorities under Article 6(1)(f)'s final sentence. Article 9 GDPR governs special categories of data frequently present in HR contexts—sickness records, occupational health data, and disability information—requiring an Article 9(2) condition such as 9(2)(b) (employment and social security law obligations) alongside the Article 6 basis. Member States may further specify these conditions under Article 9(2)(b), making national labor law a critical layer. Articles 15 and 17 GDPR establish employee rights of access and erasure, while Article 32 GDPR imposes security obligations on HR systems.

Key Developments

The CJEU's ruling in Schrems I confirmed that supervisory authorities must independently verify whether transfers of employee data to third countries comply with GDPR requirements—a principle with direct relevance to multinational HR operations. The Rīgas satiksme case established a demanding three-part test for legitimate interest processing by public authorities, holding that even where a legitimate interest exists, a public-sector controller may also need a specific legal obligation to lawfully process—narrowing the Article 6(1)(f) avenue for public employers. Dutch enforcement illustrates the operational stakes. The AP fined the Municipality of Ede €25,000 for unlawful processing, and in a separate matter involving ABN AMRO, the AP addressed retention of sickness data after an employee's sick-leave report should have been deleted—highlighting that HR systems must actively purge data when the legal basis expires. A Dutch administrative tribunal further addressed incomplete subject access responses where documents from a legacy HR system were never migrated to the replacement platform (Afas), with the court accepting the controller's explanation but underscoring the evidentiary burden to demonstrate genuine efforts to locate records. The Italian DPA's 2026 fine for post-sick-leave questionnaires signals heightened scrutiny of excessive health-data collection under Article 9 GDPR.

Practical Guidance

• Map each HR processing activity to a specific legal basis: Contractual necessity under Article 6(1)(b) covers payroll and basic personnel administration; sickness and occupational health data require an Article 9(2)(b) condition tied to national employment law, not merely a legitimate interest assessment.

• Implement deletion protocols for time-limited HR data: The ABN AMRO matter demonstrates that sickness records lingering in employee files after the relevant period constitutes ongoing unlawful processing—automate retention schedules tied to the expiry of each legal basis.

• Ensure subject access requests cover legacy systems: When migrating between HR platforms, either migrate all historical records or maintain searchable archives; controllers bear the burden of proving documents are genuinely unavailable, as the Afas migration case illustrates.

• Limit health-data questionnaires to what is strictly necessary: The Italian DPA's fine for post-sick-leave questionnaires establishes that collecting health information beyond what a specific legal obligation requires violates Article 9 GDPR proportionality principles.

• For public-sector employers, avoid reliance on Article 6(1)(f): The Rīgas satiksme ruling effectively requires a statutory mandate for processing; public employers should anchor HR processing in specific legislative provisions rather than legitimate-interest balancing tests.