MKB Juristen drafts custom legal documents
It is best not to cobble together or copy important contracts, terms and conditions, and other legal documents yourself. We help entrepreneurs on a budget with customized legal solutions, clear costs upfront, and practical explanations.
- Custom contracts, terms and conditions, and legal documents
- Budget-friendly and clear about the costs upfront
- Request a free consultation or a no-obligation quote
You may only process employee data if this is necessary and based on a valid legal basis. Due to the hierarchical relationship, employee consent is usually not a suitable legal basis; you often rely on the employment contract, a statutory obligation, or a legitimate interest.
The personnel file and the GDPR
A personnel file contains a great deal of privacy-sensitive data. The GDPR requires you to handle this data carefully: you process no more than necessary, you inform your staff about what you record and why, and you secure the file properly.
On what basis do you process?
For every processing activity, you need a legal basis (Article 6 GDPR). In an employment relationship, this is usually the performance of the employment contract, compliance with a statutory obligation (such as payroll administration), or a legitimate interest. Consent is rarely usable, because an employee cannot truly freely refuse it.
Special personal data
Health data, such as sickness absence, are special personal data requiring extra protection. For example, you may not record the nature or cause of an illness; that is the responsibility of the company doctor. Be extra careful here.
Save and delete
Do not retain employee data longer than necessary. Statutory retention periods apply to some data, while for others you must delete them within a reasonable period after the employment relationship ends. Document your retention policy.
Frequently Asked Questions
May I ask my employees for permission?
Usually not as a basis: due to the hierarchical relationship, consent is often not freely granted. It is preferable to rely on the employment contract, a statutory obligation, or a legitimate interest.
May I record the reason for sick leave?
No. You may record that someone is ill and agreements regarding reintegration, but the nature or cause of the illness is the responsibility of the company doctor.
How long am I allowed to keep a personnel file?
No longer than necessary; statutory time limits apply to some data. Delete the remainder within a reasonable period after termination of employment.
Make your personnel administration GDPR-compliant?
Our legal experts assist with your internal privacy statement and a privacy scan. View our privacyteam or schedule a free consultation.
