Employee Personal Information Rules: Recruitment, Employment and Departure

Handling employee personal information differs from handling user personal information chiefly in the structure of the relationship. A user can decline to use a product; an employee can rarely decline to be managed. That subordination makes consent structurally less voluntary in employment, which is why Article 13(1)(2) of the Personal Information Protection Law treats processing as necessary for the conclusion or performance of a contract to which the individual is a party, or for human resources management under lawfully adopted rules and collective agreements, as an independent lawful basis. Companies need not rely on consent for everything — but neither may they treat consent as a master key.

1. The logic of the three stages

Recruitment, employment and departure serve different purposes, rest on different lawful bases, and have different boundaries.

The value of the division is that the same category of information may have different boundaries at different stages. Medical information is necessary during recruitment; its continued use after the candidate becomes an employee requires separate analysis.

2. Recruitment: three high-risk points

Background checks. Verifying education, employment history, criminal records and credit standing draws on third-party sources. Written authorisation is required, the scope must be defined, and verification must use lawful channels. Information obtained through irregular channels may be unusable even where the candidate gave broad authorisation, because the source is unlawful.

Medical examination information. A pre-employment examination is a necessary step, but the report is sensitive personal information. The company should obtain only the conclusions relevant to the role rather than retain the full report, and conditions such as hepatitis B status or pregnancy must not be used as hiring criteria.

Retention of CVs. CVs of unsuccessful candidates should be deleted or anonymised within a reasonable period unless separate consent has been obtained to retain them in a talent pool. Keeping them long-term and using them for other purposes exceeds the original notice.

3. Employment: four boundaries for monitoring and algorithms

Boundary one: purpose limitation for device and network monitoring. Monitoring office devices and networks for information security is legitimate, but the scope should be limited to what security requires and must not extend to private communications. In bring-your-own-device arrangements, private data on personal devices should be outside the scope, and technical separation between work and personal areas should be implemented.

Boundary two: notice and proportionality for workplace surveillance. Video surveillance requires visible signage stating the areas covered and the purpose; private areas such as changing rooms and washrooms are excluded. Audio monitoring has a higher threshold and normally requires a fuller justification and clearer notice.

Boundary three: retention of AI tool usage records. Where the company provides AI assistants, code completion or knowledge retrieval tools, employee input may contain client information, source code and personal information. The company must state whether these records are retained, for how long, and whether they are used in performance assessment. Using AI tool records directly for performance evaluation changes the purpose and requires fresh notice.

Boundary four: transparency of algorithmic performance assessment. Scoring employees by algorithm — performance ratings, attrition prediction, behavioural analysis — is automated decision-making. Article 24 requires transparency and fairness, and where a decision has a material effect, an explanation and a means of refusal. A negative assessment produced wholly by an algorithm and incapable of explanation carries elevated risk.

4. Departure: retention periods and non-compete monitoring

Three categories arise after departure: information necessary for exit formalities, archives that must be retained by law, and monitoring of non-compete obligations.

Archive retention periods are set by law and may not be extended at will. Monitoring a non-compete obligation requires information about the former employee’s new employment, which should be limited to the scope of the non-compete agreement and must not extend to private life unrelated to it. Sustained tracking of a former employee’s social media activity through irregular channels exceeds what non-compete monitoring requires.

Work accounts, AI tool records and internal system permissions should be recovered promptly on departure; records containing personal information should be deleted or anonymised except where retention is required by law.

5. Cross-border employee data

Foreign-invested enterprises, cross-border teams and overseas assignments all trigger transfer of employee data. Three points matter.

First, identify the categories and recipients. Transferring staff lists, payroll, performance and attendance data abroad constitutes provision of personal information overseas.

Second, select a compliant channel. Under current rules, employee data may travel under security assessment, standard contract or certification; where an exemption applies, such as necessity for contract performance, the reasoning should be recorded.

Third, notice and separate consent. Providing employee information abroad requires notice of the overseas recipient and separate consent; where an exemption based on HR necessity is relied on, there must be a clear legal basis and a written record.

6. Rules, policies and notice procedure

Relying on HR necessity presupposes that the relevant processing rules have been adopted through lawfully formulated internal rules and communicated to employees. That means three things:

First, the rules must appear in the employee handbook or a dedicated policy, stating purpose, categories, scope of use and retention period;

Second, adoption must follow the democratic procedure and publication requirements, with signed acknowledgements retained;

Third, actual processing must not exceed the scope of the rules; anything beyond requires separate consent.

The most common defect is that the handbook describes attendance management while actual processing extends to analysing behaviour through access control and network logs.

7. Checklist

The core of employee data compliance is not a thicker consent form but a clearer boundary around what management requires. A clear boundary gives the rules a basis; an unclear one cannot be rescued by consent.

Related reading: contract boundaries in AI company employment, employment compliance for AI companies, privacy policies for AI products, personal information protection impact assessment, and the employment compliance and data compliance service pages.

Last updated: 24 September 2026.