Summary

This guide breaks down exactly what GDPR requires when you use HR software, what your obligations are as a data controller, and how to build a compliant HR data ecosystem from the ground up. Under Article 35, a DPIA is mandatory when processing is “likely to result in a high risk” to individuals. HR software almost always meets this threshold because it involves: GDPR’s data minimization principle (Article 5(1)©) requires you to collect only data that is adequate, relevant, and limited to what is necessary for the specified purpose.

GDPR Requirements for HR Software: A Complete Compliance Guide

Human resources departments handle some of the most sensitive personal data in any organization — employment contracts, salary details, health records, disciplinary notes, and more. When that data flows through HR software, GDPR compliance becomes not just a legal obligation but a genuine business priority. A single misstep can result in fines of up to €20 million or 4% of global annual turnover, whichever is higher.

This guide breaks down exactly what GDPR requires when you use HR software, what your obligations are as a data controller, and how to build a compliant HR data ecosystem from the ground up.

Why HR Software Is a High-Risk Area Under GDPR

HR systems are data-intensive by nature. They store information about employees, job applicants, contractors, and sometimes even family members for benefits purposes. Under GDPR, this makes HR software a focal point for regulatory scrutiny.

The European Data Protection Board (EDPB) has consistently highlighted employment data as a sensitive category requiring careful handling. Unlike customer data, employment data often includes:

Special category data (health conditions, disability status, trade union membership)
Financial records (salary, bank details, tax information)
Performance and disciplinary records
Biometric data (if using time-and-attendance systems with fingerprint or facial recognition)

Because employees are in a position of dependency relative to their employer, regulators apply heightened scrutiny to consent as a legal basis — which means your HR software compliance strategy needs to be particularly robust.

Core GDPR Requirements for HR Software

1. Establish a Lawful Basis for Processing

Before your HR software processes any personal data, you must identify a lawful basis under Article 6 of GDPR. In the HR context, the most commonly applicable bases are:

Contract performance — Processing necessary to fulfill or enter into an employment contract (e.g., payroll, tax filings)
Legal obligation — Processing required by employment law (e.g., right-to-work checks, statutory sick pay records)
Legitimate interests — Processing that serves a genuine business need, balanced against employee rights (e.g., performance monitoring, where proportionate)
Consent — Used sparingly in HR contexts due to the power imbalance; avoid relying on consent for core HR functions

For special category data (health, disability, biometric data), you must also satisfy a condition under Article 9, such as processing for occupational medicine purposes or compliance with employment law obligations.

Action step: Map every data field in your HR software to a specific lawful basis and document this in your Records of Processing Activities (RoPA).

2. Conduct a Data Protection Impact Assessment (DPIA)

Under Article 35, a DPIA is mandatory when processing is “likely to result in a high risk” to individuals. HR software almost always meets this threshold because it involves:

Large-scale processing of employee data
Systematic monitoring of employees
Processing of special category data
Automated decision-making (e.g., AI-driven performance scoring)

Your DPIA should document:

The nature, scope, and purpose of processing
Necessity and proportionality assessments
Risks to employees and the mitigations you’ve put in place
Consultation with your Data Protection Officer (DPO), if applicable

3. Vet Your HR Software Vendor as a Data Processor

When you use a third-party HR software platform, that vendor becomes a data processor under GDPR Article 28. You remain the data controller — meaning you are ultimately responsible for how employee data is handled.

Before signing any contract, verify that your HR software vendor:

Offers a compliant Data Processing Agreement (DPA)
Processes data only on your documented instructions
Has appropriate technical and organizational security measures in place
Can demonstrate compliance (e.g., ISO 27001 certification, SOC 2 reports)
Discloses all sub-processors and obtains your authorization before adding new ones
Assists you in responding to data subject access requests (DSARs)
Commits to deleting or returning data at contract termination

Never assume a vendor’s standard terms are GDPR-compliant. Review the DPA carefully and negotiate where necessary.

4. Implement Data Minimization and Purpose Limitation

GDPR’s data minimization principle (Article 5(1)©) requires you to collect only data that is adequate, relevant, and limited to what is necessary for the specified purpose.

In practice, this means auditing your HR software to ensure:

You are not collecting fields “just in case” they might be useful later
Applicant tracking modules delete candidate data after a defined retention period
Legacy employee records are purged when no longer legally required
Access controls ensure employees only see data relevant to their role

Purpose limitation (Article 5(1)(b)) means data collected for recruitment cannot be repurposed for, say, marketing without a fresh lawful basis.

5. Honor Employee Data Subject Rights

Employees have the same GDPR rights as any other data subject. Your HR software must support — or at minimum not obstruct — the exercise of these rights:

Right of access (Article 15): Employees can request a copy of all personal data held about them. Your HR system should allow you to export a complete, readable record.
Right to rectification (Article 16): Employees can correct inaccurate data. Build a process for reviewing and updating records promptly.
Right to erasure (Article 17): Applies in limited HR circumstances (e.g., unsuccessful applicants after the retention period). Note that legal obligations may override this right.
Right to restriction (Article 18): Employees can request you limit processing while a dispute is resolved.
Right to data portability (Article 20): Applies where processing is based on consent or contract and carried out by automated means.

You must respond to requests within one calendar month, with a possible two-month extension for complex cases.

6. Manage International Data Transfers

Many HR SaaS platforms store data on servers outside the EEA, or have parent companies in the United States. If your HR software transfers employee data to a third country, you must have an appropriate transfer mechanism in place:

Adequacy decision (e.g., transfers to the UK, Canada, or Japan)
Standard Contractual Clauses (SCCs) — the most common mechanism for US-based vendors
Binding Corporate Rules (BCRs) — for intra-group transfers within multinational companies

Following the Schrems II ruling, SCCs alone are insufficient — you must also conduct a Transfer Impact Assessment (TIA) to evaluate whether the destination country’s laws undermine the protections the SCCs provide.

7. Enforce Retention and Deletion Policies

Keeping employee data longer than necessary is a GDPR violation. Your HR software should support automated or scheduled data deletion based on a documented retention schedule.

Typical retention periods in an HR context include:

Payroll records: 6–7 years (varies by jurisdiction)
Recruitment records (unsuccessful candidates): 6–12 months
Disciplinary records: Typically 1–5 years depending on severity
Health and safety records: Up to 40 years in some cases
Employment contracts: Duration of employment plus 6–7 years

Build these retention rules into your HR software configuration and review them annually.

Common GDPR Mistakes in HR Software Implementation

Even well-intentioned HR teams make compliance errors. Watch out for:

Relying on employee consent for core HR processing — consent must be freely given, which is difficult to demonstrate in an employment relationship
Granting excessive admin access to HR software without role-based controls
Forgetting to update the RoPA when introducing new HR modules or features
Ignoring sub-processors added by your vendor without notification
No documented process for handling DSARs within the legal timeframe

FAQ: GDPR and HR Software

Does GDPR apply to HR data about non-EU employees?

GDPR applies based on where data subjects are located, not where the company is incorporated. If you process data about employees based in the EU/EEA, GDPR applies — regardless of where your company is headquartered. Non-EU employees’ data may be covered by equivalent local laws (e.g., UK GDPR, Canada’s PIPEDA).

Can we use employee consent as a legal basis for HR software processing?

In most cases, no. Regulators including the ICO and EDPB have consistently advised that genuine free consent is difficult to obtain from employees due to the inherent power imbalance. Rely instead on contract performance, legal obligation, or legitimate interests — and document your reasoning carefully.

What should a GDPR-compliant Data Processing Agreement with an HR software vendor include?

At minimum, the DPA should cover: the subject matter and duration of processing, the nature and purpose of processing, the type of personal data and categories of data subjects, your instructions to the processor, security obligations, sub-processor management, data breach notification timelines, assistance with DSARs, and deletion/return of data at contract end.

Do we need a DPO to use HR software?

A Data Protection Officer is mandatory if your organization is a public authority, carries out large-scale systematic monitoring, or processes special category data on a large scale. Many HR departments process health data and conduct performance monitoring, so the threshold may be met. Even if not mandatory, appointing a DPO (or an equivalent privacy lead) is strongly recommended.

How long can we keep job applicant data in our HR software?

There is no single prescribed period, but most EU data protection authorities recommend retaining unsuccessful candidate data for 6 to 12 months after the recruitment process ends — long enough to defend against potential discrimination claims, but no longer. Always document your rationale.

Build a Compliant HR Data Environment — Starting Today

Getting GDPR right for HR software requires more than good intentions. It demands documented policies, airtight vendor agreements, and repeatable processes for handling employee data throughout its lifecycle.

Save months of work with our ready-to-use GDPR compliance template bundle for HR teams. Our professionally drafted templates include:

✅ HR Data Processing Agreement (DPA) template
✅ Employee Privacy Notice template
✅ HR-specific Records of Processing Activities (RoPA)
✅ Data Protection Impact Assessment (DPIA) template for HR systems
✅ Data Subject Access Request (DSAR) response workflow
✅ HR Data Retention Schedule with recommended periods
✅ Transfer Impact Assessment (TIA) checklist

[Browse Our GDPR HR Compliance Template Pack →]

Stop starting from scratch. Our templates are written by compliance professionals, regularly updated to reflect regulatory guidance, and ready to customize for your organization in hours — not weeks.