When hiring, paying, or generally interacting with employees, the employer processes personal data and acts as a controller subject to data protection laws.

The processed data generally include:

An employer must properly inform its employees to ensure that it can fulfill its obligations and be compliant. A company cannot be compliant if its employees are, for example, processing personal data outside of the scope communicated by the company to the data subjects.

As a controller, the employer must inform the data subjects (i.e., the employees) of:

This can be done in an internal privacy policy shared with all employees upon their onboarding.

You usually do not need to obtain consent from the employees. Indeed, the legal ground to process personal data in such cases is to execute a contract. For example, the employer has a legitimate interest to know the IBAN of its employees in order to pay them as per the employment agreements.

Employers often process sensitive data. This is notably the case of any health-related data (e.g., sickness of employees, pregnancy, etc.).

Processing sensitive data calls for additional measures. Check out our Basics page for more information.

During the hiring process, an employer also processes the personal data of the applicant. Usually, the applicant is informed directly about the personal data processed via the public-facing Privacy and cookies policies.

The key question for recruitment data is about the retention period. The employer only has a legitimate interest in processing data during the recruitment phase. Once the applicant has been denied, the employer needs consent to keep processing the applicant's data. This means that an employer must ask for consent in order to keep an applicant's file in case another job opens at a later stage.