Employee data protection
The situations we review
Rarely does only one of them apply. Usually several overlap, and the notice given at hiring does not cover them all.
Video surveillance
Where cameras are placed, what they cover, how long recordings are kept and who can view them. Areas intended for rest or hygiene are excluded.
Biometric clocking
Fingerprints and other biometric elements are a special category of data, with strict conditions. We check whether a lawful basis exists and whether a less intrusive alternative was considered.
Monitoring of work communications
Work email, internet access and business applications. We set out what may be checked, under what conditions, and what has to be told to staff beforehand.
Vehicle tracking
Tracking company vehicles raises the question of working hours and private use. The boundary is drawn in writing, not by practice.
Automated tools in recruitment
Screening candidates with automated tools changes the legal regime of the process. See the note on the AI Act below.
The personnel file
Which documents are kept, for how long and who may consult them. Many files hold copies of identity documents that no longer serve any purpose.
Personal devices used for work
A personal phone or laptop used for work mixes company data with private data. The rules are set at the start, not at the point of departure.
What you get
- A review of the processing that concerns your staff
- Lawful bases and notices for each situation identified
- A monitoring policy
- The data protection section of the internal regulations
- Records of processing activities
- Training for managers
A data protection impact assessment is charged separately. Some of the situations above may require one, and that is determined after the initial review, not before.
What applies in employment
The base is Regulation (EU) 2016/679. In Romania Law no. 190/2018 adds provisions specific to processing at the workplace, including monitoring systems.
One point recurs: the relationship between employer and employee is not one between equals. Consent is therefore rarely a suitable basis for monitoring. The basis has to be found elsewhere, and the choice documented.
For the wider picture of the company’s obligations, see GDPR compliance. For managers, the training component is described on the training page.
Automated tools in recruitment
If you use automated tools to screen candidates, the situation goes beyond data protection. Under Regulation (EU) 2024/1689, as amended by Regulation (EU) 2026/1744, such tools are high-risk systems under Annex III, and the company deploying them has obligations of its own from 2 December 2027.
The date looks distant, but the inventory and the classification are done once and depend on nothing else. The detail is on the AI Act page.
What do you collect about your employees?
Tell us how many people work in the company and which of the systems above you use.
Request a quote