Data Protection and GDPR Compliance in HR

Obtaining Lawful Consent for Background Checks

Lawful consent for background checks requires explicit, freely given permission from candidates, but employers cannot use consent to bypass statutory bans on criminal screening. Polish labor law restricts requested data solely to standard employment metrics unless specific regulations apply.

Polish employment law heavily restricts the scope of personal data recruiters can request during the hiring cycle. Hiring managers may legally ask for a candidate’s name, contact details, education, and basic employment history. Demanding anything beyond this baseline requires careful legal navigation. The General Data Protection Regulation (GDPR) mandates that any additional information collection relies on strict necessity, not mere employer curiosity.

In our practice tracking CEE markets, companies often mistakenly assume candidate consent allows unlimited screening. This assumption carries massive regulatory risk. According to the Polish Labor Code, even explicit candidate consent does not authorize background checks on criminal records or credit reviews for standard office roles. Candidates cannot legally validate the handover of sensitive data if statutory law prohibits the employer from processing it.

Specific sectors operate under completely different rules. Financial institutions, schools, and critical infrastructure providers possess explicit statutory rights to verify criminal records to protect public safety. If an organization operates outside these highly regulated environments, attempting to access restricted data triggers severe penalties from the Personal Data Protection Office (UODO). Corporate screening practices must align strictly with the distinct permissions granted by local jurisdiction.

Limits of Social Media Screening

Social media profiling presents another major compliance trap for unwary recruiters. Hiring teams often assume public profiles invite open scrutiny, but GDPR principles severely limit this practice. Evaluating professional networks like LinkedIn remains acceptable, provided the candidate lists them in their application package. Searching personal platforms like Facebook or Instagram blatantly violates the data minimization principle.

Health data represents the absolute highest tier of protected information under European law. Medical questionnaires during recruitment are strictly forbidden unless occupational medicine physicians conduct them independently. Questioning a candidate about underlying conditions, even with written consent, exposes the company to massive legal liability. Interviews should focus entirely on assessing raw professional competence and demonstrable skills.

Validating Educational Credentials

Verifying university degrees requires a highly measured and formal approach. The President of the UODO explicitly states that employers cannot directly contact universities to confirm graduation status behind the candidate's back. HR departments rely entirely on the applicant providing official diplomas, certificates, or certified transcripts. Requesting direct confirmation from educational institutions oversteps the boundaries of legal background verification in Poland.

Managing Data Retention Periods for Employee Files

Data retention periods dictate exactly how long HR departments can legally store employee records before mandatory deletion. In Poland, employers must keep personnel files for 10 years post-employment, moving away from the outdated 50-year requirement.

Retaining employee data indefinitely violates core GDPR storage limitation principles. Businesses destroy personal information the moment the original processing purpose completely expires. Polish regulations enacted a structural shift, reducing the mandatory personnel file retention period from 50 years to just 10 years for employees hired after January 2019. This sweeping rule forces HR departments to implement aggressive and highly structured data lifecycle management policies.

Data from recent corporate setups shows that failing to audit legacy paper archives triggers immediate regulatory scrutiny. Regulators expect modern companies to digitize their HR records using qualified electronic signatures. Transitioning to secure digital archives minimizes physical storage costs while ensuring automated compliance with deletion deadlines. Manual spreadsheet tracking systems simply cannot keep up with staggered retention schedules across a large, dynamic workforce.

Different categories of HR data demand entirely distinct retention timelines. Recruitment files for rejected candidates usually require permanent deletion within three to six months unless the applicant formally consents to future contact. Payroll data, occupational health records, and general personnel files each follow strict statutory deadlines. Missing these deadlines exposes the organization to escalating fines reaching up to 30,000 PLN under Polish labor law.

Automating Deletion Workflows

Relying on manual calendar reminders to destroy sensitive HR data guarantees eventual compliance failure. Progressive organizations deploy automated HR Information Systems (HRIS) that trigger hard deletion protocols based on precise employment termination dates. These robust systems strip identifying information from the database while safely retaining anonymized statistics for business intelligence. This automated approach effortlessly satisfies both strict regulatory demands and internal operational reporting needs.

Handling financial data introduces secondary legal and accounting obligations. While basic personnel files hit the standard 10-year destruction deadline, tax authorities occasionally require access to specific payroll records under different statutory frameworks. Cross-referencing employment law with corporate tax codes ensures critical financial evidence survives premature deletion. Compliance officers regularly map these intersecting retention schedules to prevent conflicting data policies.

HR Data Retention Requirements in Poland (2026)

Data Category	Maximum Retention Period	Legal Basis / Core Justification
Rejected Candidate Resumes	3 to 6 months post-recruitment	Legitimate interest to defend against potential discrimination claims
Standard Personnel Files	10 years after employment termination	Polish Labor Code mandate for post-2019 hires
Accident at Work Records	10 years from the date of the incident	Occupational health and safety documentation laws
Working Time & Shift Records	10 years after employment ends	Payroll transparency and taxation verification

Penalties for Non-Compliance

Supervisory authorities actively hunt for retention violations during routine, unannounced corporate audits. Keeping a database of former employees "just in case" constitutes a severe and highly penalized breach of the storage limitation principle. Penalties in Poland escalate quickly, with local labor inspections issuing fines up to 30,000 PLN for localized infractions. Deleting obsolete data remains a critical defensive maneuver, not an optional administrative task.

Responding to Subject Access Requests (SARs)

A Subject Access Request (SAR) gives employees the right to demand copies of all personal data an organization holds about them. Employers must provide this extensive information free of charge within one month of receipt.

Employees increasingly weaponize access requests during contentious workplace disputes. An SAR legally compels the HR team to locate, extract, and cleanly deliver every piece of personal data linked to that specific individual. This extensive dataset includes performance reviews, direct messages, internal email chains mentioning the employee, and confidential HR notes. Fulfilling these exhaustive requests quickly requires a centralized and highly searchable data architecture.

Ignoring or improperly delaying a formal response guarantees swift regulatory intervention. The GDPR enforces a rigid 30-day statutory deadline to fulfill an access request completely. Highly complex cases technically allow for a two-month extension, but administrators must notify the employee of this impending delay within the initial timeframe. Building a standardized SAR response protocol prevents absolute panic when a disgruntled former employee suddenly demands their complete file.

Redaction plays a foundational role in the SAR fulfillment process. HR professionals carefully review the gathered documents to fiercely protect the privacy of other uninvolved staff members. Handing over an unredacted email thread that inadvertently exposes another employee's personal data creates an immediate secondary GDPR breach. Privacy teams utilize automated redaction tools to scrub third-party identifiers before transmitting the final executive dossier.

Structuring an Internal SAR Taskforce

Assigning complete SAR responsibilities to a single HR representative creates a massive operational bottleneck. Fulfilling a comprehensive request demands tight, coordinated action between HR, IT, and legal departments. IT administrators extract raw chat logs and email archives, while legal counsel evaluates potential data exemptions. Building a dedicated internal taskforce dramatically streamlines this aggressive 30-day fulfillment cycle.

Employees frequently submit access requests vaguely, demanding "everything the company has ever written about me." The data controller maintains the legal right to ask for clarification to strategically narrow the massive search scope. However, this perfectly legal clarification process does not pause the underlying statutory deadline clock. Proactive communication helps manage employee expectations and significantly reduces the sheer volume of data analysts must process.

Handling Malicious or Repetitive Requests

Hostile former employees sometimes use SARs purely to disrupt normal business operations. The GDPR allows companies to outright refuse or charge a reasonable administrative fee for requests deemed "manifestly unfounded or excessive." Proving this high threshold requires meticulous documentation of the individual's prior requests and openly aggressive behavior. Instead of ignoring a malicious request, legal teams issue a formal, legally grounded refusal notice.

Conducting Data Protection Impact Assessments (DPIAs)

A Data Protection Impact Assessment (DPIA) is a mandatory risk evaluation process required whenever new HR technologies threaten employee privacy. Organizations complete it before deploying intrusive tools like biometric time clocks or surveillance software.

Modern HR tech stacks introduce severe and often hidden privacy risks. Rolling out AI-driven recruitment software, remote worker monitoring tools, or biometric access controls automatically triggers the legal requirement for a DPIA. This mandatory assessment forces organizations to systematically evaluate the fundamental necessity, proportionality, and security risks of the new processing activity. Treating this critical evaluation as a mere paperwork exercise leaves the company completely vulnerable.

We consistently see that organizations skipping DPIAs during rapid tech rollouts face the steepest UODO fines. Regulators actively target modern companies utilizing algorithmic decision-making without highly documented risk assessments. The DPIA document proves an organization proactively considered employee privacy long before switching on the new software. It serves as the primary corporate defense mechanism during a hostile audit.

A valid, compliant DPIA requires deep input from multiple specialized stakeholders. The Data Protection Officer (DPO), IT security lead, and external legal counsel collaborate to identify potential catastrophic data breaches. If the formal assessment reveals high risks that the technical team cannot mitigate, leadership must consult the supervisory authority prior to deployment. Proactive risk management always costs significantly less than defending a negligent data privacy violation.

Navigating High-Risk Processing Scenarios

Biometric time-tracking devices consistently flag as high-risk under strict UODO guidelines. Scanning a fingerprint to enter an office building processes special category biometric data, requiring incredibly robust justification. A thorough DPIA often reveals that less intrusive methods, like standard RFID keycards, achieve the exact same corporate security goals. Regulators look highly favorably on companies that actively choose privacy-preserving technological alternatives.

Vendor risk management ties directly and intimately into the overall DPIA process. When purchasing third-party HR software, the ultimate legal burden of data protection remains firmly on the employer's shoulders. Procurement teams thoroughly audit the vendor's security protocols and specific data hosting locations before officially signing the contract. A software provider storing European employee data on non-compliant, offshore servers immediately fails the assessment criteria.

Continuous Review and Auditing

A DPIA is never a static, one-time document. If a trusted software vendor updates their core algorithm or shifts their cloud hosting to a new country, the initial assessment becomes instantly obsolete. HR and IT leaders schedule mandatory annual reviews of all existing DPIAs to account for these subtle technological shifts. Treating privacy as an ongoing operational metric easily prevents sudden, unexpected compliance failures.

Frequently Asked Questions (FAQ)

This section resolves common regulatory uncertainties facing HR leaders. It provides immediate, definitive guidance on background screening, data retention limits, access requests, and mandatory privacy assessments.

Can we legally check a candidate's criminal record in Poland?

No, standard employers cannot request criminal records. The Polish Labor Code restricts this practice exclusively to legally mandated sectors like finance, education, and security, regardless of candidate consent.

What is the fine for keeping employee records past the retention limit?

Storing records beyond the 10-year limit violates GDPR storage limitation principles and Polish labor law. This infraction potentially results in statutory fines up to 30,000 PLN or massive GDPR-level penalties.

Are we required to provide internal HR notes in a Subject Access Request?

Yes, internal notes containing personal data or subjective evaluations about the employee fall directly under the scope of an SAR. Companies must disclose them after carefully redacting any third-party information.

When exactly is a DPIA mandatory for HR departments?

A DPIA is strictly mandatory before implementing any technology that poses a high risk to employee privacy. Common regulatory triggers include biometric access systems, AI-driven hiring tools, and comprehensive remote employee monitoring software.