General Data Protection Regulation (GDPR)
Definition
A comprehensive European Union regulation governing the collection, processing, and storage of personal data belonging to individuals in the EU and European Economic Area.
What is GDPR?
The General Data Protection Regulation (GDPR) took effect in May 2018 and establishes strict rules for how organizations collect, use, store, and protect personal data. GDPR has global implications, and any employer that processes personal data of EU or European Economic Area (EEA) residents (including employees, job applicants, or customers) may be subject to its requirements regardless of where the organization is headquartered.
Why is GDPR Important for Employers?
- Employers processing personal data of EU-based employees, applicants, or contacts must have a lawful basis for doing so
- Employees have the right to access, correct, delete, and port their personal data, and employers must be able to fulfill these requests
- Noncompliance can result in fines of up to €20 million or 4% of global annual turnover, whichever is greater
- Data breaches must be reported to the relevant supervisory authority within 72 hours in many circumstances
FAQs
Does GDPR apply to U.S.-based employers?
Yes, if a U.S.-based employer processes personal data belonging to individuals located in the EU or EEA (including employees, applicants, or customers), GDPR requirements may apply to that data.
What types of employee data fall under GDPR?
GDPR covers any information that can identify an individual, including names, email addresses, payroll and banking data, performance records, health information, biometric data, and IP addresses.
What steps should employers take to comply with GDPR?
Employers should conduct a data inventory, establish and document a lawful basis for each processing activity, update employee privacy notices, implement appropriate data security measures, and establish procedures for responding to employee data subject requests.
How ExtensisHR Can Help
We work with employers to:
- Advise on HR data handling practices and documentation that support GDPR compliance
- Review employee data processes, including onboarding, offboarding, and recordkeeping
- Support the development of data retention schedules and employee privacy policies