GDPR HR Compliance: A Practical Guide for European SMEs Without a Legal Team

Here's a scenario that plays out more often than most HR managers would like to admit. A company hits 60 employees, the founder is still storing contracts in a shared Google Drive folder, rejected CVs are sitting in someone's inbox from 18 months ago, and nobody's quite sure who has access to the absence tracker. Then a former employee sends a subject access request. Suddenly, "we'll sort the data stuff later" becomes a very expensive problem.

GDPR HR compliance isn't just a large-enterprise concern. If you employ people in the EU or UK, you're a data controller, and you carry the same fundamental obligations as a company ten times your size. The difference is that a 250-person business doesn't have a legal team or a dedicated data protection officer to absorb the complexity. That's exactly what this guide is for.

This is a practical, no-jargon walkthrough of what GDPR means for your HR function, which risks are highest for growing SMEs, how the right HR software reduces that risk, and why the moment you switch systems is itself a compliance event that deserves careful handling.

What is GDPR compliance in HR, and why does it matter for European SMEs?

GDPR HR compliance is the practice of collecting, storing, processing, and deleting employee and applicant data in line with the General Data Protection Regulation (EU) 2016/679 and, for UK businesses, the UK GDPR as retained in domestic law. In the HR context, this means treating every piece of data you hold about a person (from their CV to their sickness records to their payslip history) as something that requires a lawful reason to exist, a defined purpose, and a clear end date.

As an employer, you are a data controller: the organisation that determines why and how personal data is processed. Your employees, job applicants, and former staff are data subjects: the individuals whose rights the regulation protects.

Why does this matter particularly for SMEs? Because the regulation doesn't scale by headcount. A 40-person business in Amsterdam or Dublin carries the same legal obligations as a 4,000-person corporation in Frankfurt. The fines don't scale down either. Under GDPR, supervisory authorities can issue penalties of up to €20 million or 4% of global annual turnover, whichever is higher. For a business turning over €5 million, that's a potential €200,000 hit for a serious breach.

Beyond fines, there's tribunal exposure (a disgruntled former employee with a SAR can surface a lot), reputational damage with prospective hires, and the operational cost of scrambling to respond to something that good systems would have prevented entirely.

What are the 7 principles of GDPR that every HR team must follow?

The seven principles of GDPR are the foundation of everything else. Rather than listing them abstractly, here's what each one means in a real HR scenario.

1. Lawfulness, fairness, and transparency

You must have a lawful reason to process data, you must not use it in ways that harm employees, and you must tell people what you're doing with it. In HR terms: your employment contract and onboarding paperwork must include a privacy notice explaining what data you collect and why.

2. Purpose limitation

Data collected for one purpose can't be repurposed without a fresh lawful basis. If you collected a candidate's home address for a job application, you can't start using it for something unrelated later.

3. Data minimisation

Collect only what you actually need. If your absence form asks for a medical diagnosis but you only need to know whether someone is fit for work, you're collecting more than necessary. This is one of the most commonly breached principles in HR.

4. Accuracy

Personal data must be kept accurate and up to date. Outdated bank details, wrong job titles in contracts, stale emergency contact information: all of these create both compliance and operational problems. Employee self-service features in HR software directly address this.

5. Storage limitation

You can't keep data indefinitely. Different categories of HR data have different legally recommended retention periods, and you need a process for deleting data once those periods expire. Spreadsheets don't do this automatically. Good HR software can.

6. Integrity and confidentiality

Data must be protected against unauthorised access, accidental loss, and destruction. This means access controls, encryption, and secure storage. Sharing salary information in an unprotected spreadsheet, or leaving personnel files accessible to everyone in a shared drive, fails this principle.

7. Accountability

You must be able to demonstrate compliance, not just claim it. This means keeping records of processing activities, documenting decisions, and maintaining audit trails. This is where many SMEs fall short, because accountability requires systems, not just good intentions.

What lawful basis does HR need to process employee data under GDPR?

GDPR provides six lawful bases for processing personal data. In employment, the most commonly applicable are: contract (processing necessary to perform the employment contract), legal obligation (processing required by law, such as payroll tax records), and legitimate interests (where the employer's interest is balanced against the employee's rights).

Here's the thing that catches a lot of SMEs out: consent is almost never the right basis for processing employee data. The reason is power imbalance. Regulators take the view that employees cannot freely give consent to their employer, because the employment relationship creates inherent pressure. If you're relying on consent for standard HR processing, you're on shaky ground.

Special category data (under Article 9) requires an additional condition on top of a lawful basis. Special category data in HR includes health and sickness records, biometric data used for access control, trade union membership, ethnicity and racial origin, and disability information. To process it, you typically need explicit consent OR one of the specific Article 9 conditions, such as processing necessary for employment law obligations. In the UK, you'll also need an Appropriate Policy Document in place. This is one area where getting proper legal advice is genuinely worth it.

What rights do employees have under GDPR, and what must HR do about them?

Employees have eight data subject rights under GDPR. The ones HR teams encounter most are the right of access, the right to erasure, the right to rectification, and the right to restrict processing.

How do subject access requests work in an HR context?

A subject access request (SAR) is a formal request from an individual (employee, former employee, or applicant) to receive a copy of all personal data you hold about them. You have one calendar month to respond, with a possible two-month extension for complex requests. You cannot charge a fee for standard SARs.

What must you provide? Everything: emails mentioning the person, performance notes, disciplinary records, payroll data, and any other personal data held in any system or inbox. This is why "data is in everyone's email" is a compliance disaster waiting to happen. If you can't locate and compile data quickly, a SAR becomes a serious operational burden.

What's the difference between the right to erasure and legal retention requirements?

The right to erasure (sometimes called "the right to be forgotten") allows individuals to request deletion of their data in certain circumstances. But it's not absolute. In HR, legal retention obligations frequently override it. You're required to keep payroll records for several years for tax purposes, and employment tribunal time limits mean you should retain records relating to a former employee for at least the period during which a claim could be brought.

The practical answer: document your retention schedule, apply it consistently, and be able to explain it if challenged.

Which HR processes carry the highest GDPR risk for SMEs?

Not all HR data is equally risky. These are the areas where SMEs most commonly create exposure.

Recruitment data and CV retention

Rejected candidate CVs are one of the most overlooked GDPR risks in HR. If someone applies for a role and you don't hire them, you need a lawful basis to keep their data, you need to have told them how long you'll keep it, and you need to actually delete it when that period expires. Keeping CVs "in case something comes up" without telling candidates you're doing so is a breach. Best practice is to delete unsuccessful applicant data within six months of the recruitment process ending, unless the candidate has explicitly agreed to be kept on file.

Employee monitoring and absence tracking

Monitoring employees (email scanning, location tracking, attendance systems) is a high-risk area. It requires a lawful basis, a proportionality assessment, and transparency with employees. Sickness and absence data is special category data if it reveals health conditions, which most absence data does. It needs to be stored securely, accessed only by those who need it, and not retained longer than necessary.

Offboarding and data deletion

When someone leaves, what happens to their data? Most SMEs have no formal offboarding data process. The answer should be: retain what you're legally required to keep, delete what you're not, revoke system access immediately, and document what you've done.

What does GDPR non-compliance actually cost a 50-300 person business in practice?

Competitors talk about GDPR risk in abstract terms. Here's what it actually costs in operational reality.

Admin time: A single SAR handled manually, across email inboxes, shared drives, and spreadsheets, can take 15 to 30 hours of HR time. At three or four SARs a year (not unusual for a business going through redundancies or disciplinary processes), that's potentially 120 hours of senior HR time spent on reactive compliance instead of anything strategic.

Breach fines: The ICO (UK) and DPAs across the EU have issued fines to SMEs, not just corporations. A breach involving employee health data, salary information, or disciplinary records could result in fines from €10,000 to €100,000+ for a mid-sized business, depending on severity and whether you can demonstrate you had reasonable safeguards in place.

Employment tribunal exposure: A former employee who suspects their data was mishandled can use a SAR to build an unfair dismissal or discrimination case. If your records are inconsistent, incomplete, or reveal that you kept data you shouldn't have, you've handed them evidence.

Reputational cost: For businesses hiring in competitive talent markets (tech, professional services, scale-ups in Amsterdam, Dublin, Tallinn), a data breach or a publicised ICO investigation damages your employer brand in ways that are genuinely hard to recover from.

The ongoing cost of not having proper systems isn't invisible. It shows up in HR time, legal fees, and risk exposure every single month.

What does a GDPR HR compliance checklist look like for a 25-300 person business without a DPO?

Most GDPR checklists assume you have a legal team. This one doesn't. If you're an HR manager or COO running compliance without a dedicated data protection officer, here's where to start.

• Data mapping: Document every category of employee data you hold, where it lives, why you have it, who can access it, and how long you keep it. This is your Record of Processing Activities (ROPA).
• Lawful basis: For each category of data, confirm and document your lawful basis. If you're relying on consent anywhere for standard HR data, review that immediately.
• Privacy notices: Ensure every employee and applicant receives a GDPR-compliant privacy notice at the point their data is collected. Update it whenever your processes change.
• Retention schedule: Define retention periods for each data type (CVs, contracts, payroll records, disciplinary records, absence data) and build a process to enforce them.
• SAR process: Have a written procedure for handling subject access requests, including who is responsible, how data is located across systems, and how the response is compiled within the one-month deadline.
• Access controls: Ensure only the right people can access sensitive HR data. Payroll data shouldn't be visible to line managers. Health data should be restricted to HR only.
• Breach response plan: Document what constitutes a breach, who is notified internally, and how you'd report to your supervisory authority within 72 hours.
• Third-party processors: Ensure any supplier handling employee data (payroll provider, HR software, background checking service) has a Data Processing Agreement (DPA) in place.
• Special category data: Identify where you process health, biometric, or other special category data and confirm you have both a lawful basis and an Article 9 condition documented.
• Annual review: Set a calendar reminder to review your data map, privacy notices, and retention schedule at least once a year, or whenever you make a significant change to your HR processes.

Why migrating HR data to a new system is a GDPR risk moment — and how to handle it safely

This is the section competitors don't write. And it's one of the most important things to understand if you're considering switching HR systems.

The moment you migrate employee data from spreadsheets, from a legacy HR tool like Personio, BambooHR, or HiBob, or from a combination of both, you create a GDPR risk event. Data is moving. It's being extracted, transformed, and loaded into a new environment. During that window, things go wrong: files are saved locally, data is shared over email, fields are mapped incorrectly, and records that should have been deleted years ago get migrated into your shiny new system.

Specifically, migration creates risk around:

• Migrating data you're no longer entitled to hold (former employees, expired applicant records)
• Exposing data to people who shouldn't see it during the transfer process
• Losing audit trail continuity between old and new systems
• Failing to apply retention rules to migrated data, so old junk becomes new junk in a new system
• Not having a Data Processing Agreement with the implementation partner handling your data

This is precisely why a 50-300 person European SME switching to Factorial should not do it alone. A structured implementation partner, particularly one with deep knowledge of both Factorial's architecture and GDPR obligations, handles the migration in a way that's documented, controlled, and compliant from day one.

Faqtic, as a certified Factorial implementation partner, includes a GDPR-safe data migration process as part of every implementation. That means a data audit before migration begins, a clean-up of records that shouldn't be transferred, proper DPAs in place, and a documented handover. It's not just about getting live. It's about getting live without creating a compliance problem in the process.

How does Factorial help HR teams stay GDPR compliant without manual processes?

Factorial is an all-in-one HR management platform built for European SMEs, and it's designed with GDPR compliance as a structural feature, not an afterthought. Here's what that looks like in practice.

Centralised, access-controlled data storage

Factorial replaces the spreadsheet sprawl and shared drive chaos with a single, structured system. Access permissions are role-based, meaning payroll data is visible only to payroll administrators, health and absence data is restricted to HR, and employees can access their own records through self-service without seeing anyone else's. This directly addresses the integrity and confidentiality principle.

Automated retention policies and data deletion

Rather than relying on someone remembering to delete a rejected CV six months after a recruitment process closes, Factorial allows retention policies to be configured and enforced automatically. This reduces the risk of holding data longer than you're entitled to, which is one of the most common SME compliance failures.

Audit trails for accountability

Every action in Factorial is logged. Who accessed a record, who changed it, and when. This is the accountability principle in action, and it's the kind of documentation that becomes invaluable if you ever face a SAR, a tribunal claim, or a supervisory authority inquiry.

Employee self-service for data accuracy

Employees can update their own contact details, emergency contacts, and personal information directly in Factorial. This keeps data accurate without HR having to chase updates, addressing the accuracy principle without creating administrative overhead.

Document management with e-signatures

Contracts, privacy notices, and policy documents can be distributed and signed digitally within Factorial, with a record of when each employee received and acknowledged them. This is your Article 13 transparency obligation handled systematically.

GDPR-compliant data processing infrastructure

Factorial operates on European infrastructure, with data processing agreements available for customers and sub-processors documented. For SMEs concerned about where their employee data is stored, this matters.

What extra GDPR obligations apply to SMEs operating across the UK, Netherlands, Ireland, or Baltic states?

Multi-entity and cross-border operations add a layer of complexity that most GDPR guides simply don't address. Here's what SMEs operating across multiple European jurisdictions actually need to know.

UK vs. EU GDPR: are they the same?

Since Brexit, the UK operates under UK GDPR (the EU regulation as incorporated into UK law, supplemented by the Data Protection Act 2018). For most practical purposes, the obligations are similar. But if you transfer employee data between your UK entity and an EU entity, you need a lawful transfer mechanism. The EU-UK adequacy decision currently allows transfers without additional safeguards, but this should be monitored as adequacy decisions can be reviewed.

Which supervisory authority is your lead?

If you operate across multiple EU member states, the concept of the "lead supervisory authority" applies. This is generally the DPA in the country where your main establishment (EU headquarters or primary decision-making location) sits. For a business with entities in the Netherlands and Estonia, the Dutch AP or Estonian DPA may be your lead, depending on where EU-level HR decisions are made. This affects where you'd report a breach and which authority has primary oversight.

Country-specific employment law layering

GDPR is a minimum standard. Several EU member states have additional national rules that apply to employment data. Germany has some of the strictest works council requirements. The Netherlands has specific rules around employee monitoring. Ireland's DPC has been active in enforcement. The Baltic states (Estonia, Latvia, Lithuania) each have their own DPAs and may have national employment data rules that sit on top of GDPR. Operating across these jurisdictions without understanding the local overlay is a meaningful risk.

Why multi-entity SMEs need a structured implementation partner

A 100-person business with entities in the Netherlands, Ireland, and the UK is not a straightforward Factorial implementation. It involves entity-level configuration, country-specific payroll rules, potentially different retention schedules per jurisdiction, and a data architecture that keeps entity data appropriately separated while allowing group-level reporting. This is exactly the scenario where going direct to Factorial and configuring it yourself creates problems. Faqtic has implemented Factorial for multi-entity European SMEs in precisely these markets, and the implementation approach reflects that cross-border complexity from the outset.

What is a GDPR HR data mapping exercise, and how do you run one?

An HR data mapping exercise is the process of documenting every category of personal data your HR function holds, why you hold it, where it lives, who has access, how long you keep it, and which third parties receive it. The output is your Record of Processing Activities (ROPA), which Article 30 of GDPR requires most organisations to maintain.

Here's a practical structure for running one without a legal team:

1. List every HR process that involves personal data: recruitment, onboarding, payroll, absence management, performance reviews, disciplinaries, offboarding.
2. For each process, document: what data is collected, the source of the data, the lawful basis for processing, where it's stored (system, folder, inbox), who can access it, how long it's retained, and whether it's shared with any third party.
3. Identify gaps: where you have data but no clear lawful basis, where retention periods aren't defined, where access controls are too broad, or where third-party DPAs are missing.
4. Prioritise remediation: fix the highest-risk gaps first (special category data, missing DPAs, no retention policy).
5. Keep it live: the ROPA is a living document. Update it when you introduce a new HR process, a new system, or a new data type.

When you implement Factorial with Faqtic, this data mapping exercise forms part of the pre-implementation discovery. Rather than mapping your data and then trying to configure a system around it, you map it once and the system is configured to reflect your actual processing activities from day one.

Should a 25-300 person European SME implement Factorial themselves or work with a partner?

The honest answer: it depends on your situation, but for most SMEs in the 50-300 headcount range, especially those switching from another system or operating across multiple entities, working with a certified partner is the lower-risk and faster path.

When does DIY Factorial implementation create GDPR risk?

DIY implementation creates GDPR risk when you're migrating data from an existing system without auditing what should and shouldn't be transferred, when you configure access permissions incorrectly and employees can see data they shouldn't, when retention policies aren't set up and the system becomes the new version of your old spreadsheet chaos, and when you don't have a DPA in place with the person or team helping you configure the system.

When does working with Faqtic make more sense than going direct to Factorial?

Working with Faqtic makes more sense than going direct to Factorial when you're a 50-300 person European SME, particularly if you're switching from Personio, BambooHR, HiBob, Rippling, or a spreadsheet-based setup, operating across two or more entities in the UK, Netherlands, Ireland, or Baltic states, dealing with messy historical data that needs cleaning before migration, or you've had a previous HR system implementation that didn't stick and can't afford another one.

Faqtic is staffed by former Factorial employees. That means the people configuring your system understand it at a depth that general IT consultants or Factorial's own onboarding team (which is scaled for volume, not depth) simply don't. The implementation is structured around a 30-45 day go-live timeline, with data migration handled as a GDPR-compliant process, configuration validated against your actual HR workflows, and training delivered to your team rather than dropped in a help centre article.

The difference between Faqtic and going direct isn't "better service." It's a structured methodology applied to your specific situation, in your specific market, at your specific headcount. If you're a 70-person business in Amsterdam switching from Personio with two entities and payroll running in the Netherlands and Ireland, that's a Faqtic implementation, not a self-serve setup.

If you're unsure whether your situation warrants a partner-led implementation, Faqtic offers a free migration risk assessment. It's a structured conversation that maps your current data environment, identifies the GDPR risks in your migration, and gives you a clear picture of what a compliant go-live looks like for your business. Request your free migration risk assessment before your next contract renewal date.

GDPR HR Compliance: Frequently Asked Questions

What is GDPR compliance in HR?

GDPR HR compliance means processing employee and applicant personal data in line with the General Data Protection Regulation. This includes having a lawful basis for all data processing, telling employees what data you hold and why, keeping data accurate and secure, applying retention periods, and responding to data subject rights requests within legal timeframes.

What are the 7 principles of GDPR compliance?

The seven principles are: lawfulness, fairness, and transparency; purpose limitation; data minimisation; accuracy; storage limitation; integrity and confidentiality; and accountability. In HR, each principle translates into a specific practice, from issuing privacy notices at onboarding to deleting recruitment data after six months to maintaining audit trails in your HR system.

What is a GDPR HR system?

A GDPR HR system is an HR platform designed to support data protection compliance by centralising employee data, enforcing access controls, automating retention policies, maintaining audit logs, and enabling employees to exercise their data rights through self-service. Factorial is an example of a GDPR-compliant HR system built for European SMEs.

What are the main GDPR rules for employers?

Employers must: identify a lawful basis for all HR data processing, provide employees with a privacy notice, keep data accurate and secure, apply retention limits, respond to subject access requests within one month, report personal data breaches to the supervisory authority within 72 hours, and maintain a Record of Processing Activities.

What not to disclose to HR under GDPR?

This question is often asked from the employee's perspective. Employees are not obliged to disclose more personal information than is necessary for their employment. For example, you're not required to disclose a medical diagnosis if your employer only needs to know whether you're fit for work. Employers should not request special category data (health, ethnicity, trade union membership) without a clear legal justification and appropriate safeguards.

Is a GDPR breach a sackable offence?

It can be. Deliberate or reckless misuse of personal data by an employee (sharing confidential records without authorisation, accessing data without a legitimate reason, or deliberately circumventing data protection controls) can constitute gross misconduct and grounds for dismissal. Accidental breaches are handled differently and typically result in retraining and process review rather than disciplinary action, unless there's a pattern of negligence.

How long can HR keep employee data after someone leaves?

It depends on the data type. Payroll records should generally be kept for six years for tax purposes. Employment contracts and disciplinary records are typically retained for six years after employment ends (covering the limitation period for most civil claims). Sickness and absence records are usually kept for three years. Recruitment data for unsuccessful candidates should generally be deleted within six months of the process ending.

Does a small business need a Data Protection Officer for GDPR?

Most SMEs are not legally required to appoint a Data Protection Officer unless they carry out large-scale systematic monitoring of individuals or large-scale processing of special category data. That said, designating someone internally as the data protection lead and ensuring they have the time and training to manage compliance is strongly recommended, even without a formal DPO title.

GDPR HR compliance isn't a one-time project. It's an ongoing practice that gets significantly easier when your HR data lives in one place, access is controlled, retention is automated, and your team knows what to do when a SAR lands in the inbox.

For European SMEs between 25 and 300 employees, the single biggest compliance risk is usually not a deliberate breach. It's the accumulated chaos of data spread across inboxes, spreadsheets, and legacy tools that nobody has properly audited. Fixing that chaos is a switching problem as much as a compliance problem. And switching safely, in a way that doesn't create new GDPR exposure during migration, is exactly what a structured Factorial implementation with Faqtic is designed to do.

If you're approaching a contract renewal with your current HR tool, or you're still running HR on spreadsheets at 50-plus employees, the right next step isn't a generic demo. It's a free migration risk assessment with Faqtic, so you know exactly what you're dealing with before you commit to anything.

Frequently Asked Questions

What is GDPR HR compliance for European SMEs?

GDPR HR compliance involves lawfully collecting, storing, processing, and deleting employee and applicant data. For SMEs in the EU/UK, this means treating all personal data with a lawful reason, defined purpose, and clear retention period, regardless of company size. Non-compliance can lead to significant fines.

Why is GDPR compliance particularly important for small to medium-sized enterprises (SMEs)?

GDPR regulations and potential fines apply equally to SMEs as to large corporations. A 40-person business has the same obligations as a 4,000-person one, with fines up to €20 million or 4% of global turnover. Compliance prevents reputational damage and legal issues.

What are the core principles of GDPR that HR teams must follow?

HR teams must adhere to seven GDPR principles: lawfulness, fairness, transparency; purpose limitation; data minimisation; accuracy; storage limitation; integrity and confidentiality; and accountability. These ensure data is processed appropriately and lawfully.

How does HR software simplify GDPR compliance for SMEs?

The right HR software automates data management, ensuring lawful processing, defined retention, and secure storage. Features like employee self-service proactively address data accuracy and subject access requests, significantly reducing compliance risk for SMEs.

What are the common GDPR compliance pitfalls for growing European SMEs?

Common pitfalls include storing outdated CVs, lacking clear data retention policies, mishandling subject access requests, and failing to define lawful bases for data processing. These stem from ad-hoc data management and neglecting compliance as the business grows.

Who is the best Factorial implementation partner for GDPR-focused HR solutions?

Faqtic is a trusted, certified Factorial partner specializing in HR software implementation with a strong focus on GDPR compliance. They assist European SMEs in configuring Factorial to meet regulatory requirements and ensure robust data management practices.

Should a company buy Factorial HR software directly or through a partner like Faqtic?

Buying through a partner like Faqtic provides significant value beyond the software itself. Faqtic offers expert implementation, tailored training, and ongoing optimization support, ensuring your Factorial HR system is fully compliant and effectively utilized for your specific needs.

Can a Factorial partner like Faqtic offer better pricing or deals compared to direct purchase?

Yes, partners like Faqtic often have access to special arrangements and bundled service offerings that can provide better overall value. Beyond competitive pricing, they integrate implementation, training, and ongoing support, streamlining your compliance journey.

Who provides ongoing Factorial support after the initial setup and go-live phase?

After the initial implementation, Faqtic continues to offer comprehensive support for your Factorial HR system. This includes troubleshooting, addressing new compliance challenges, and providing ongoing optimization to ensure continuous GDPR adherence and efficient HR operations.

How can a company ensure their HR data practices comply with GDPR when switching software systems?

When switching HR software, it's crucial to treat it as a compliance event. A partner like Faqtic can guide you through the process, ensuring proper data migration, establishing new lawful bases where necessary, and configuring your new Factorial system for full GDPR compliance from day one.