GDPR

What it means

GDPR is the EU regulation on personal data protection. It applies to every company that processes data about identifiable people - which includes one that merely has employees and client contacts.

It rests on a handful of duties: have a legal basis for processing, process only what is needed, inform the people concerned, keep data for a limited time, and protect it with proportionate measures.

For accounting and payroll data the legal basis is not consent but a legal obligation: the Accounting Act and the tax rules require the data to be processed and retained. A consent a company asks an employee to sign for the payslip is therefore pointless, and misleading too, since the employee cannot actually withdraw it.

How it works in practice

For an ordinary s. r. o. that means records of processing activities, privacy information for staff and clients, a data processing agreement with suppliers such as the accounting firm, the payroll system or the cloud provider, and access properly set.

Payroll and accounting also hold special category data - medical certificates, details about children, garnishment orders. These are not sent by ordinary e-mail without protection; encryption or sharing through protected storage belongs with them.

When a former employee asks for their data to be erased, we first check which of it the company still has to keep, such as payroll records needed for pensions. That part is not deleted but locked down, the rest is erased, and the person gets an answer within one month. The right to erasure does not mean wiping everything.

What to watch out for

A data breach is generally notified to the authority within 72 hours of discovery - so you need to know what happened and who it affects. Staff photographs, cameras and marketing databases are the three areas where companies most often process with no legal basis at all.

Data piles up for longer than needed: CVs of rejected candidates, old mailbox backups, customer exports in spreadsheets on laptops. Each such copy is one more affected file in a personal data breach, and in an inspection it is evidence that the company ignores its own retention periods.