{"id":210,"date":"2026-06-29T21:06:25","date_gmt":"2026-06-29T19:06:25","guid":{"rendered":"https:\/\/anvaconsulting.eu\/radno-pravo-i-zastita-podataka-sto-poslodavac-smije-prikupljati-o-radniku\/"},"modified":"2026-07-21T12:47:14","modified_gmt":"2026-07-21T10:47:14","slug":"labour-law-and-data-protection-what-may-an-employer-collect-about-an-employee","status":"publish","type":"post","link":"https:\/\/anvaconsulting.eu\/en\/labour-law-and-data-protection-what-may-an-employer-collect-about-an-employee\/","title":{"rendered":"Labour law and data protection: what may an employer collect about an employee?"},"content":{"rendered":"

In an employment relationship an employer must process certain personal data to fulfil legal obligations and manage work processes. However, \u201cwe need it\u201d is not the same as \u201cwe are allowed to.\u201d The combination of the GDPR and labour law sets clear boundaries: purpose, necessity, proportionality and protection of the worker\u2019s dignity.<\/p>\n

Basic HR data<\/h2>\n

The Labour Act as a special law regulates workers\u2019 rights related to employment as well as employers\u2019 obligations regarding the processing of workers\u2019 personal data. Article 29 of the Labour Act stipulates that personal data of workers may be collected, processed, used and disclosed to third parties only if this is determined by this or another law or if it is necessary for exercising rights and obligations from the employment relationship or in connection with it. Examples of data processing based on the employer\u2019s legal obligation are: records of workers and working time; registration for mandatory pension and health insurance; payment of wages; payment of compensation; occupational safety; medical examination; special professional requirements (education, training, schooling). The Regulation on the contents and manner of keeping records of workers prescribes, among other things, the scope of personal data that the employer must collect. The employer starts keeping the record on the date the person starts working and keeps it up to date until the termination of their work and retains it for at least six years from the date their employment ends.<\/p>\n

Processing of special categories of data<\/h2>\n

Article 9 of the General Data Protection Regulation regulates the processing of special categories of personal data and provides that the processing of personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs or trade union membership, and the processing of genetic data, biometric data for the purpose of uniquely identifying a natural person, data concerning health or data concerning a natural person\u2019s sex life or sexual orientation is prohibited. Paragraph 2 of that article sets out the exceptions to the prohibition. Examples of processing special categories of data in employment relationships are: sick leave (temporary incapacity for work), pregnancy, breastfeeding, occupational disease, work injury, exercising preferential treatment in employment (disability, special needs), religion, trade union membership. For example, an employer has the authority to ask for a worker\u2019s religion if the worker takes a day off for a religious holiday. In such a case the lawful basis is Article 6(1)(c) (compliance with a legal obligation) and the exception to the prohibition of processing special categories of data is Article 9(2)(b) (processing is necessary for the purposes of carrying out obligations and exercising rights in the field of employment and social security and social protection).<\/p>\n

Consent as a legal basis in the employment context<\/h2>\n

Consent is often not an adequate legal basis for processing personal data in the employment relationship and appears only in exceptional situations. Workers\u2019 consent may be a legal basis for processing personal data that the employer is not obliged to collect and process under special regulations (e.g., a worker\u2019s personal photo on the company\u2019s website, such as a photo from a team building).<\/p>\n

Legitimate interest of the employer in processing workers\u2019 personal data<\/h2>\n

The employer must demonstrate the existence of a legal basis, i.e., legitimate interest, by conducting a proportionality test. Legitimate interest can be a legal basis for processing provided that the interests or fundamental rights and freedoms of the data subject do not prevail, taking into account the data subject\u2019s reasonable expectations based on their relationship with the controller. Examples of legitimate interests in employment relationships include: protection of persons and property, GPS monitoring, network and information security (as it may involve monitoring workers\u2019 behaviour). For example, call centre employees reasonably expect that the conversation will be recorded for training purposes.<\/p>\n

Principle of transparency<\/h2>\n

The employer should inform workers about the data collected, the purpose and legal basis of processing, the rights of workers in relation to personal data, etc., in a specific document such as an \u201cEmployee Personal Data Processing Notice,\u201d a work regulation or other internal policies (video surveillance policy, information security policy, etc.). The worker should be informed at all stages of employment: in the selection process, during employment (especially if there are changes in processing) and at the worker\u2019s request. Workers should be informed using clear, concise and simple language understandable to an average data subject. For foreign workers it is advisable to translate documents into English.<\/p>\n

A few examples to conclude<\/h2>\n
    \n
  1. The employer must ensure that the scope of personal data being processed is limited, so that for the purpose of protecting employee privacy, only the personal data necessary for identification are displayed on name badges or work uniforms. Therefore, it is sufficient, for example, to display only the employee\u2019s name and\/or an internal identification number under which the employee is registered within the organisation.<\/li>\n
  2. When it comes to identifying the operator as a mandatory element of an invoice, the question arises whether the employee\u2019s full name should be displayed. From a data protection perspective, an invoice issued by a legal entity that includes the employee\u2019s full name (i.e. the person handling payment at the point of sale) would constitute excessive processing of personal data, for which no valid legal basis can be found under the applicable regulations. The employer must ensure that only the necessary scope of data is processed, meaning that either the employee\u2019s first name or an internal code should be used instead.<\/li>\n
  3. Employers must not encourage employees to engage in social media activity, as this cannot be justified under legitimate interest and may interfere with the fundamental human right to freedom of expression.<\/li>\n<\/ol>\n

    Conclusion<\/h2>\n

    In HR compliance, the key lies in achieving the right balance: fulfilling the employer\u2019s legal obligations while protecting the employee\u2019s privacy and dignity. The best results are achieved through a combination of well-defined policies, controlled access, and clearly defined retention periods.<\/p>\n","protected":false},"excerpt":{"rendered":"

    In an employment relationship an employer must process certain personal data to fulfil legal obligations and manage work processes. However, \u201cwe need it\u201d is not the same as \u201cwe are allowed to.\u201d The combination of the GDPR and labour law sets clear boundaries: purpose, necessity, proportionality and protection of the worker\u2019s dignity. Basic HR data […]<\/p>\n","protected":false},"author":1,"featured_media":208,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[2],"tags":[],"class_list":["post-210","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-news"],"acf":[],"_links":{"self":[{"href":"https:\/\/anvaconsulting.eu\/en\/wp-json\/wp\/v2\/posts\/210","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/anvaconsulting.eu\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/anvaconsulting.eu\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/anvaconsulting.eu\/en\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/anvaconsulting.eu\/en\/wp-json\/wp\/v2\/comments?post=210"}],"version-history":[{"count":2,"href":"https:\/\/anvaconsulting.eu\/en\/wp-json\/wp\/v2\/posts\/210\/revisions"}],"predecessor-version":[{"id":213,"href":"https:\/\/anvaconsulting.eu\/en\/wp-json\/wp\/v2\/posts\/210\/revisions\/213"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/anvaconsulting.eu\/en\/wp-json\/wp\/v2\/media\/208"}],"wp:attachment":[{"href":"https:\/\/anvaconsulting.eu\/en\/wp-json\/wp\/v2\/media?parent=210"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/anvaconsulting.eu\/en\/wp-json\/wp\/v2\/categories?post=210"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/anvaconsulting.eu\/en\/wp-json\/wp\/v2\/tags?post=210"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}