HR data is sensitive, and always there.
Every company that employs people is processing personal data about them, from the first application to the final payslip. Employees and candidates have the same rights as customers, and they ask about them more often than you might expect. Having notices, records and a retention schedule in place makes those requests routine instead of stressful.
Employees can't freely consent
Because of the imbalance between employer and employee, consent is rarely a safe basis for HR processing. The pack suggests the right basis for each activity and flags where consent doesn't work.
Some HR data is special
Absence and sickness records can reveal health information, which needs extra care. The clauses and ROPA mark where stricter rules apply and what to keep to a minimum.
Retention rules differ by country
Tax and labour law set minimum periods, and they vary between member states. The retention schedule separates what you must keep from what you should delete or anonymise.
Seven parts. One HR-ready baseline.
Each part stands on its own and also points to the next: the notices name your tools, the ROPA records them, and the retention schedule says how long each category stays.
HR-specific privacy policy and notice clauses Ready to copy
Drop-in wording with fill-in placeholders, one block per topic.
- Employee personal data and HR files
- Recruitment and candidate data
- Payroll, benefits and tax information
- Performance reviews and absence records
- Access control and CCTV If used
- Retention and deletion of employee and candidate data
- International transfers of HR data If any
Simple ROPA starter for typical HR activities
A pre-filled Record of Processing Activities. Edit, don't invent.
- Recruitment and applicant management
- Employee onboarding and personnel files
- Payroll and benefits administration
- Performance management and training
- Absence and leave management
- Employee monitoring or access logs If applicable
- Suggested legal bases, data categories, retention periods and recipient lists (payroll provider, accountant, etc.)
Recruitment & candidate data checklist
Get hiring right from the first application.
- What to include in a job application privacy notice
- How long to keep unsuccessful candidate data
- Consent vs. legitimate interest for recruitment
- What to tell candidates about data sharing with agencies or tools
Employee data request & deletion process
For current and former employees.
- Simple steps for access, rectification or deletion requests
- What you can refuse or delay (legal retention obligations)
- Template response and internal checklist
Sub-processor & vendor checklist for HR tools
Know who holds your people data.
- Common HR tools and what to verify with each: DPA, data location, transfer mechanisms
- Template email to request a DPA from a vendor
Retention schedule for HR data
How long to keep what, and what to do afterwards.
- Suggested periods for contracts, payroll records, performance notes and candidate data
- Notes on national differences (tax and labour law requirements)
- When to delete or anonymise data
30-day action plan for an HR team
A short, prioritised list so the work actually gets done. See the plan below.
- Week by week, in the order employees notice
- Each week ends with something you can show your team
Real wording, not a table of contents.
Two short excerpts from the pack. Highlighted fields are the parts you fill in for your own company.
Recruitment and candidate data
When you apply for a job with us, we process the details you give us, such as your CV, contact details and interview notes, to assess your suitability and to take steps at your request before a contract is made. If your application is unsuccessful, we delete your data after [retention period], unless you separately agree that we may keep your details for future vacancies.
We use [recruitment tool] to manage applications. Questions can be sent to [hr-privacy@yourcompany.eu].
The full pack adds wording for recruitment agencies and background checks where national law allows them.
Absence and leave management
| Purpose | Record and administer leave and sickness absence, pay entitlements, meet employment-law duties |
|---|---|
| Legal basis | Art. 6(1)(b) contract and Art. 6(1)(c) legal obligation; health details under Art. 9(2)(b) |
| Data subjects | Employees |
| Categories | Absence dates and type, certificates (no diagnosis where avoidable) |
| Recipients | Payroll provider, HR system provider, social insurance body where required |
| Retention | [national period], then delete or anonymise |
Each of the six activities also lists transfers and security measures.
These are shortened starting points. Your own notices and records must reflect what your company actually does, and national employment rules vary. The pack shows you where to check.
From scattered files to a documented HR process.
Prioritised for a small HR team with no dedicated privacy person.
Tell people what you do
- Update employee and candidate privacy notices
Record it
- Create or update your ROPA for the main HR activities
Tidy and verify
- Review retention rules
- Check main HR tool DPAs
Handle requests
- Set up a simple process for employee data requests
Who it's for, and who it isn't.
A good fit if you
- Are a small or mid-sized company with employees in the EU
- Run recruitment, payroll and personnel files with standard HR tools
- Have no dedicated privacy team
- Want notices, records and a retention schedule in one place
Not enough on its own if you
- Run large-scale employee monitoring or profiling, which may need a DPIA
- Run occupational health programmes or process biometric data
- Need works council agreements or a lawyer-reviewed contract; the pack is not legal advice
- Are a recruitment agency, where candidate data is your core business
Seven parts. One payment.
Everything on this page, delivered together. Adapt it to your company, update your notices and answer the next employee question from the same documents.
- HR privacy policy & notice clauses
- ROPA starter with six pre-filled activities
- Recruitment & candidate data checklist
- Employee data request & deletion process
- Sub-processor & vendor checklist for HR tools
- Retention schedule for HR data
- 30-day action plan
Before you ask —
Who is the HR Compliance Pack for?
Small and mid-sized companies that handle employee and candidate data in the EU: HR managers, office managers, founders and anyone who runs recruitment, payroll and personnel files without a dedicated privacy team.
What do I receive?
Seven parts: HR privacy policy and notice clauses, a pre-filled ROPA starter, a recruitment and candidate data checklist, an employee data request and deletion process, a sub-processor and vendor checklist for HR tools, a retention schedule for HR data and a 30-day action plan. You get your download page straight after checkout, with no account to create.
Can we rely on employee consent?
Usually not. Because of the imbalance between employer and employee, consent is rarely a safe basis for HR processing. Contract, legal obligation and legitimate interest are the more common bases. The pack suggests a basis for each activity and flags where consent is not appropriate.
How long can we keep unsuccessful candidate data?
It depends on the country and on what you tell candidates. The checklist helps you choose a defined period, state it in your application privacy notice and delete or anonymise afterwards, and leaves the national figure as a field for you to confirm.
Do retention periods differ between EU countries?
Yes. Tax, social security and labour law set different minimum periods in different member states. The retention schedule gives suggested periods and notes on national differences, and is meant to be confirmed against the rules where you operate.
Is this legal advice?
No. The pack is a practical starting point. Employment data rules vary by country and sometimes involve works councils or employee representatives, so have a qualified lawyer review anything you rely on.
What if it isn't what I expected?
Email hello@gdprgard.eu within 14 days for a full refund. No form to fill in.
Give your people clear answers.
Get the notices, records, request process and retention schedule in one pack and put your HR data handling in order.
Get the Pack — €39