GDPR Guide and Checklist
HR sits on payroll details, health records, disciplinary notes, and diversity data, processed across the whole employee lifecycle. This free guide shows you how to keep all of it GDPR-compliant, from a candidate’s first CV to the day records are finally deleted.
GDPR has been in force since 2018, and regulators now treat employee data as a priority target. Fines across Europe total EUR 7.1 billion, with 162 enforcement actions aimed specifically at HR data and an average HR violation costing EUR 2.3 million. The cases are recognisable: H&M paid EUR 35 million for secret employee dossiers, and Uber was fined EUR 290 million for moving driver data abroad without adequate safeguards. A single Subject Access Request from one employee can expose years of quiet non-compliance.
What’s inside:
A complete, practical GDPR playbook for HR and payroll
A clear breakdown of what counts as employee personal data, including the special category data that carries stricter Article 9 rules
Your obligations mapped across the full data lifecycle, from recruitment through active employment to offboarding and beyond
The seven core GDPR principles translated into concrete HR actions on lawful basis, ROPAs, privacy notices, minimisation, retention, employee rights, and vendor DPAs
Five common HR mistakes, each paired with the real fine it caused, so you can see where the risk actually lands
Step-by-step breach response built around the 72-hour notification deadline
Fields marked * are mandatory.
By providing personal data and submitting the form, you acknowledge that you have read the data processing rules described below. The controller of your personal data, depending on the details of your inquiry or the country indicated in the form, may be BPiON Poland sp. z. o. o., BPION Services Kft., BPiON Romania SRL, BPION Slovakia s.r.o. or BPION Czech s.r.o. Your personal data will be processed in order to respond to your inquiry, to conclude and execute a contract or to send you marketing content. Full information about the processing of your personal data can be found in our Privacy Policy.
At any time you have the right to access your personal data, correct it, delete it, limit its processing or object to its processing, and the right to lodge a complaint to a supervisory authority, as well as the right to withdraw consent to the processing of your personal data at any time without affecting the legality of the processing carried out on the basis of consent before its withdrawal
**By checking the marketing consent box, you consent to receiving commercial information, especially newsletters, from BPiON. Each communication we send to you will include an option to unsubscribe.
Who it’s for
Written for the people accountable for the data
HR directors, people managers, and C-suite leaders will find it a working reference they can act on straight away. If you own payroll, vendor contracts, or employee monitoring decisions, the checklist turns a vague sense of risk into a concrete list of gaps to close.
Grounded in real enforcement and daily practice
The guide draws on published GDPR case law, ICO principles, and current statutory retention rules across BPiON’s markets. It reflects how we process employee data every day for companies in Poland, Hungary, and Romania, where compliance is simply how the work is done. Use it as a dependable starting point, and confirm anything with legal consequences against current local rules before you act.
This material is provided for general information only. It offers a practical overview and does not cover every situation, and it is not a substitute for tailored professional advice. Regulations change frequently and their application depends on your specific circumstances, so the content may not be complete or fully current at the time you read it. Before acting on anything with legal, tax, or financial consequences, confirm the current requirements with a qualified BPiON specialist. BPiON accepts no liability for decisions made solely on the basis of this material.
