gdpr
Does GDPR apply to internal employees data?
<p>Currently, our team has a number of internal tools that aid the testing and deployment of our products. These are used solely by internal employees, and record actions taken (such as when a file has been viewed).</p>

<p>The recorded data contains identifiable information, such as their Windows username - which <strong>can</strong> be used to identify a specific individual.</p>

<p>We also process this data, to provide statistics on individual's work, to managers who are also internal.</p>

<p><strong>Does this data, also need to comply with GDPR - or does GDPR only apply to data from the public?</strong></p>

<p>Yes, it also applies.</p>

<p>However, an employment implies they agree to having employment related data stored and processed (e.g., to be paid). When there are performance related bonuses in the contract, this will likely (but IANAL) imply they agree to performance data being collected and stored appropriately.</p>

<p>Furthermore I would assume most of such data processing (such as knowing who is responsible for a certain change, who created a file, modified it etc.) falls into "<strong>legitimate interests</strong>" of the employer, as this information may be necessary for operations.</p>

<p>I'd assume (still IANAL) that much of the consequence wrt. GDPR is the <strong>right to have your data erased</strong>. So a company should be prepared to remove such data when an employee leaves the company, e.g., by clearing the responsible person fields upon request. At least for data where there is no legal requirement to have such data provenance.</p>

<p>But: <strong>consult your lawyer for a proper legal opinion</strong>!</p>

<p>Yes, GDPR applies to employee data.  There are a few special provisions for employee data, but the fact that a person is an employee does not by itself mean that someone is not a "data subject" as defined in Article 4, item 1.</p>

<p>In fact, one of the special provisions for employees is that member states may make "more specific" rules for the processing of employee data, under Article 88, including "for the purpose[] of ... the performance of the contract of employment[.]"</p>

<p>Your company's lawyer may therefore want to look at what national law has to say about the data recorded by your internal tools.</p>
