GDPR (General Data Protection Regulation) applies to all personal data — including data about employees. What obligations does this entail for employers and how to meet them without unnecessary bureaucracy?
GDPR (General Data Protection Regulation) is a European regulation in force since 2018 that sets out the rules for processing the personal data of natural persons. In the HR context, it concerns all data that a company processes about its employees, job applicants and former employees.
Different types of HR documents have different retention periods — some are archived for years or even decades, others only briefly. The specific periods are set by legislation and may change over time, so we recommend verifying them with an accountant or lawyer.
From a practical point of view, the most important thing is to have an overview of what data the company holds, where and for how long — and to be able to reliably delete it after the period expires.
A company keeps the CVs of all job applicants from the last several years in an unprotected folder on a shared drive, with no overview of who has access to them. This is a typical risk of a personal data leak. An HRIS with access control and automatic deletion of data after the retention period expires significantly reduces this risk.
Are you managing HR in a system, or still in Excel?
Speybl unifies attendance, onboarding and documents into one place. No commitment, ready to use right away.
Try SpeyblSet it up with us, and start with the one thing that hurts most.
Ready to start? Try Speybl — no credit card, setup with us
Try Speybl →
