Glossary

Employee data protection

Data protection glossary · 5 minutes read

Employee data protection governs the protection of employees' personal data in the employment relationship. Employers may only process employee data where a legal basis exists and the applicable data protection requirements are met. The key legal framework is the General Data Protection Regulation (GDPR), together with the European legal requirements governing the protection of employee data. Protected information includes, among other things, job application documents, salary data, health information and details of work performance.

What types of data are protected by employee data protection?

Employee data protection covers personal information processed in connection with the application process, the performance of an employment relationship or its termination.

This includes, for example:

Job application documents and CVs
Names, addresses and contact details
Employee identification numbers and salary information
Working hours and absences
Performance appraisals
Sickness and health data
Data relating to the use of company IT systems

Business email addresses, log data and information about the use of company systems also constitute personal data if they can be attributed to an individual employee.

Additional requirements apply to health data and other special categories of personal data under Article 9 GDPR.

When may employers process personal data?

The processing of employee data requires an appropriate legal basis. Article 6 GDPR provides for various legal grounds for processing.

In the employment context, processing necessary for the performance of an employment contract under Article 6(1)(b) GDPR is particularly relevant. This includes, for example, calculating and paying salaries.

Further processing activities are permitted where another legal basis applies and its requirements are met. This may include compliance with legal obligations or the pursuit of legitimate interests, subject to the required balancing of interests.

Regardless of the legal basis, employers must comply with the principles set out in Article 5 GDPR. These include, in particular, purpose limitation, data minimisation and storage limitation.

What is the significance of Section 26 BDSG for employee data protection?

Section 26 of the German Federal Data Protection Act (Bundesdatenschutzgesetz – BDSG) contains national provisions governing the processing of personal data in the employment context. However, its application is limited by the European legal requirements set out in Article 88 GDPR.

According to the case law of the German Federal Labour Court (Bundesarbeitsgericht – BAG), Section 26(1), first sentence, BDSG does not meet the requirements for a more specific national provision within the meaning of Article 88 GDPR. In particular, it lacks the specific safeguards required for such provisions.

Where no more specific provisions compliant with EU law exist, the processing of employee data is governed directly by the provisions of the GDPR.

This interpretation is based, in particular, on the judgment of the German Federal Labour Court dated 8 May 2025 (Case No. 8 AZR 209/21).

Are employers allowed to monitor their employees?

Employee monitoring is only permitted if the applicable data protection requirements are observed. The decisive factors include the purpose of the measure, its necessity and the interests of the employees concerned.

Examples include:

Video surveillance in the workplace
Monitoring the use of company internet access and email accounts
Analysis of telephone and connection data
Recording and analysing employee performance

Routine and comprehensive monitoring of employees without a specific reason is generally disproportionate. For each monitoring measure, employers must assess whether an appropriate legal basis exists and whether less intrusive alternatives are available.

Where the works council has co-determination rights, the applicable works constitution requirements must also be observed.

What data protection rights do employees have?

Employees generally enjoy the same data subject rights in relation to their employers as other individuals whose personal data is processed.

These include, in particular:

Right of access under Article 15 GDPR: Employees have the right to request information about the processing of their personal data.
Right to rectification under Article 16 GDPR: Inaccurate personal data must be corrected.
Right to erasure under Article 17 GDPR: Subject to the statutory requirements, employees may request the erasure of their personal data.
Right to restriction of processing under Article 18 GDPR: Under certain conditions, employees may request that the processing of their personal data be restricted.

In addition, employers are subject to information obligations under Articles 13 and 14 GDPR.

Practical example: When is the processing of employee data unlawful?

A company introduces new HR management software. To test its functionality, it transfers personal employee data into the new system.

In addition to names and employee identification numbers, the transfer includes private addresses, salary information and other personal details. Some of this data is not necessary for the intended testing purposes.

Processing data for testing purposes requires an appropriate legal basis. The company must also assess which personal data is actually necessary for the specific test. If anonymised or artificially generated test data would be sufficient, the use of actual employee data is not automatically justified.

legal data assessment: Before introducing new HR management or employee monitoring systems, companies should assess the lawfulness of each intended processing activity under data protection law. In particular, the data used must be limited to what is necessary. A works agreement does not exempt employers from complying with the requirements of the GDPR.

Legal basis

Articles 5, 6, 9, 13–18 and 88 GDPR; Section 26 BDSG.

Case law: German Federal Labour Court (BAG), judgment of 8 May 2025 – 8 AZR 209/21.

Frequently asked questions about employee data protection

May employers process employee data without consent?

Yes. Consent is not required for every processing activity. Personal data may, for example, be processed where this is necessary for the performance of an employment contract or compliance with a legal obligation, provided the requirements of the relevant legal basis are met.

May employers monitor their employees' business emails?

Monitoring business emails is not permitted without restrictions. Whether and to what extent such monitoring is allowed depends, in particular, on the purpose of processing, the legal basis, necessity and applicable workplace agreements. There is no general permission to monitor all employee emails.

How long may employers store employees' personal data?

There is no uniform retention period. As a general rule, personal data may only be stored for as long as necessary for the relevant purpose or as required by statutory retention obligations. Once these periods have expired, the data must be erased in accordance with the applicable legal requirements.

May employers process their employees' health data?

Health data belongs to the special categories of personal data under Article 9 GDPR. Its processing is only permitted where, in addition to an appropriate legal basis, the specific requirements of Article 9(2) GDPR are met.

Does employee data protection also apply to job applicants?

Yes. Applicant data is also subject to data protection requirements. Employers may only process personal information contained in job applications where an appropriate legal basis exists and the applicable data protection principles are observed.