GDPR and Employee Data: What Irish Employers Need to Know
Employers in Ireland hold significant amounts of personal data about employees — contact details, payroll information, performance records, disciplinary files, and more. GDPR imposes strict obligations on how this data is collected, stored, and used.
Lawful Basis for Processing Employee Data
GDPR requires a lawful basis for every category of personal data processing. For employment data, the most common bases are: contract (processing necessary to perform the employment contract), legal obligation (processing required by law), and legitimate interests. Consent is rarely appropriate in employment due to the power imbalance between employer and employee.
Special Category Data
Health data, trade union membership, and certain other categories are “special category” data requiring a higher level of protection and an additional lawful basis. Employers must have an explicit policy for processing special category data.
Employee Monitoring
Monitoring employees — including CCTV, email monitoring, and internet usage tracking — is only lawful if it is proportionate, necessary, and employees are clearly informed in advance through a written monitoring policy.
Employee Rights Under GDPR
Employees have the right to access their personal data (DSAR), rectification of inaccurate data, erasure in limited circumstances, and data portability. Employers must respond to DSARs within one month.
Self-complete template: our Privacy Notice for Employees and Job Applicants template is an editable document you complete yourself. It is not legal advice and does not include review by a solicitor.
Frequently Asked Questions
Can an employee request all their personal data from their employer in Ireland?
Yes — employees can make a Data Subject Access Request (DSAR) for all personal data held about them. Employers must respond within one month at no charge.
Can Irish employers monitor employee emails?
Email monitoring is permitted only if employees are clearly informed in advance, the monitoring is proportionate, and there is a documented email monitoring policy.
How long should Irish employers keep employee records?
Payroll records should be kept for 6 years, working time records for 3 years, and recruitment records typically 1–2 years. A written retention policy is essential.
This article is for informational purposes only. View our GDPR services or consult a solicitor.
