Summary

Article 30 of GDPR requires most organizations to maintain a ROPA. For HR software, this document should capture every processing activity — recruitment, payroll, performance management, and more — along with the lawful basis for each. GDPR requires that every processing activity has one of six lawful bases. In the HR context, the most commonly applicable are: Review every data field your HR software collects. Ask: Do we actually need this? Disable or remove fields that collect unnecessary personal data. GDPR’s data minimization principle requires you to collect only what is adequate, relevant, and limited to what is necessary.

GDPR Implementation Guide for HR Software: A Complete Compliance Roadmap

Human Resources departments handle some of the most sensitive personal data in any organization — employee records, payroll details, health information, performance reviews, and recruitment data. When GDPR came into force in May 2018, it fundamentally changed how HR teams must collect, store, process, and delete this information. If your organization uses HR software, getting GDPR compliance right isn’t optional — and the stakes are high.

This guide walks you through exactly what GDPR means for HR software, the practical steps to achieve compliance, and the documentation you need to protect your organization.

Why GDPR Compliance Matters for HR Software

HR software systems are data processing engines by nature. They aggregate personal data from dozens of touchpoints: job applications, onboarding forms, payroll integrations, absence management, and offboarding workflows. Under GDPR, every one of these data flows must have a lawful basis, a defined purpose, and appropriate security controls.

Fines for non-compliance can reach €20 million or 4% of global annual turnover — whichever is higher. Beyond financial penalties, data breaches involving employee data can cause serious reputational harm and erode employee trust.

Step 1: Map Your HR Data Flows

Before you can protect data, you need to know exactly what data you hold and where it goes.

Conduct a Data Inventory

Work with your HR software vendor and internal IT team to identify:

What personal data is collected (names, addresses, national insurance numbers, bank details, health records, etc.)
Where data is stored (cloud servers, local databases, third-party integrations)
Who has access (HR staff, line managers, payroll providers, benefits platforms)
How long data is retained (and whether retention policies are enforced automatically)

Create a Record of Processing Activities (ROPA)

Step 2: Establish a Lawful Basis for Each Processing Activity

GDPR requires that every processing activity has one of six lawful bases. In the HR context, the most commonly applicable are:

Contract performance — processing necessary to fulfill an employment contract (e.g., payroll)
Legal obligation — processing required by employment law (e.g., tax reporting, right-to-work checks)
Legitimate interests — processing for genuine business purposes where employee rights don’t override (use carefully and document your balancing test)
Consent — valid in limited HR scenarios, but not recommended as a primary basis for employee data since consent must be freely given, which is difficult in an employment relationship

Important: Consent is rarely appropriate for core HR processing. Employees may feel pressured to consent, making it legally questionable.

Step 3: Configure Your HR Software for GDPR Compliance

The technical configuration of your HR platform is just as important as your policies. Here’s what to review:

Access Controls and Role-Based Permissions

Ensure your HR software enforces the principle of least privilege. Employees should only see data relevant to their role. Line managers shouldn’t have access to payroll data they don’t need. Configure role-based access controls and audit them regularly.

Data Minimization Settings

Review every data field your HR software collects. Ask: Do we actually need this? Disable or remove fields that collect unnecessary personal data. GDPR’s data minimization principle requires you to collect only what is adequate, relevant, and limited to what is necessary.

Retention and Deletion Policies

Configure automated retention periods within your HR system:

Recruitment data for unsuccessful candidates: typically 6–12 months (check your jurisdiction)
Employee records: retain for the duration of employment plus a defined post-employment period (often 6–7 years for legal purposes)
Payroll records: typically 6 years for tax compliance in the UK; varies by country

Many HR platforms allow automated deletion or anonymization at the end of a retention period — activate and test these features.

Data Encryption and Security

Confirm that your HR software encrypts data:

At rest (stored data)
In transit (data moving between systems)

Request your vendor’s security certifications (ISO 27001, SOC 2) and review their penetration testing schedules.

Step 4: Review Your HR Software Vendor’s Data Processing Agreement

If your HR software is cloud-based (and most are), your vendor is a data processor under GDPR. You are the data controller. This means you must have a signed Data Processing Agreement (DPA) in place.

Your DPA should confirm that the vendor:

Processes data only on your documented instructions
Implements appropriate technical and organizational security measures
Assists you in responding to data subject access requests
Deletes or returns data at the end of the contract
Notifies you of any data breaches within 72 hours
Discloses any sub-processors they use (and allows you to object)

Most reputable HR software vendors will have a standard DPA available. Review it carefully — don’t simply accept it without scrutiny.

Step 5: Handle Data Subject Rights in HR Contexts

GDPR grants employees (as data subjects) a range of rights. Your HR processes and software must be able to respond to these efficiently:

Right of access (SAR): Employees can request a copy of all personal data you hold about them. Your HR system should allow you to export a complete, readable data package.
Right to rectification: Employees can request corrections to inaccurate data. Ensure your system allows updates with an audit trail.
Right to erasure: Applies in limited HR scenarios (e.g., unsuccessful job applicants after the retention period). Note that legal obligations may override this right.
Right to data portability: Employees can request their data in a structured, machine-readable format.
Right to object: Particularly relevant where legitimate interests is the lawful basis.

You have one month to respond to most requests. Document your process and train your HR team.

Step 6: Train Your HR Team and Update Your Privacy Notices

Technology alone won’t make you compliant. Your HR team needs to understand:

What data they can and cannot collect
How to handle a data subject request
What to do if a data breach occurs
How to apply the lawful basis framework in day-to-day decisions

Update Your Employee Privacy Notice

Your employee-facing privacy notice must be written in clear, plain language and explain:

What data you collect and why
The lawful basis for each type of processing
How long you retain data
Who you share it with (including your HR software vendor)
How employees can exercise their rights

Provide this notice at the point of recruitment and whenever your processing activities change significantly.

Step 7: Establish a Breach Response Process

Under GDPR, you must report certain personal data breaches to your supervisory authority within 72 hours of becoming aware. HR data breaches — such as accidental sharing of payroll data or unauthorized access to employee records — are reportable events.

Your breach response process should include:

A clear internal escalation path
A designated person responsible for breach assessment
Template notification letters for affected employees
A breach register to document all incidents (even those not reported externally)

FAQ: GDPR and HR Software

Do we need employee consent to process their data in HR software?

Generally, no. Consent is rarely the appropriate lawful basis for employee data processing. Most HR processing is covered by contract performance or legal obligation. Relying on consent creates problems because employees may not feel free to refuse.

What happens if our HR software vendor suffers a data breach?

You remain responsible as the data controller. Your DPA should require the vendor to notify you within 72 hours. You then assess whether the breach requires reporting to your supervisory authority and notifying affected employees.

How long should we keep job applicant data?

Best practice is 6–12 months after the end of the recruitment process for unsuccessful candidates. If a candidate gives consent to be kept on file for future roles, document that consent and honor any withdrawal requests promptly.

Does GDPR apply to paper-based HR records?

Yes. GDPR applies to personal data processed in a structured filing system — including paper files. Ensure physical records have the same access controls, retention policies, and disposal procedures as digital records.

What’s the difference between a data controller and a data processor in HR?

Your organization is the data controller — you determine why and how employee data is processed. Your HR software vendor is a data processor — they process data on your behalf and must follow your instructions. This distinction determines your respective legal obligations.

Build Your GDPR Compliance Foundation Today

Achieving GDPR compliance for your HR software isn’t a one-time project — it’s an ongoing program. But you don’t have to build it from scratch.

Our ready-to-use GDPR compliance template bundle for HR teams includes:

✅ Record of Processing Activities (ROPA) template
✅ Employee Privacy Notice template
✅ Data Processing Agreement checklist
✅ Data Subject Request response templates (SAR, erasure, portability)
✅ Data Breach Register and response procedure
✅ HR Data Retention Schedule
✅ Legitimate Interests Assessment (LIA) template

Written by compliance professionals and reviewed by legal experts, these templates are designed to be adapted to your organization quickly — saving you hours of drafting time and reducing your compliance risk from day one.

[Download the HR GDPR Compliance Template Bundle →]

Protect your employees’ data. Protect your organization. Get compliant with confidence.