How to become (and stay) fully HR GDPR compliant

Introduction

Data is a huge part of our daily lives. Every day, we all use, move, store and absorb data in different ways. In HR, you handle a lot of valuable and confidential business data, including payroll data, performance metrics, and strategic plans.

Then there’s all the data about employees, former employees, contractors and job applicants, which can include sensitive data and information, such as health information, medical records, salary levels, and much more. That’s a lot of data to manage.

Your ability to use data to identify key insights and tell stories that drive action on the right things at the right time is one of the most valuable contributions a strategic HR partner can make. This is why HR is becoming trusted and strategic business advisors within organisations.

Yet, all of this data can put HR departments in a bit of a vulnerable position – it’s critical for business growth and looking after your people. It’s also your responsibility to ensure that the data is safe, secure, and compliant with local laws and regulations. And while this may seem like the IT department’s problem, every HR professional must know their data privacy responsibilities.

But fear not, we’ve created this simple and easy-to-read guide to help you navigate some of the basics of GDPR and data security, why you need to be aware of these requirements as an HR professional, and some tips on how to make sure your human resources management system (HRMS) is compliant, keeps your people data safe, and makes life as easy as possible for you.

In this guide we look at:

• The differences between data privacy and data security
• Why is data protection and security important?
• Tips on how to be HR GDPR compliant
• What you should expect from your HR tools like Sympa to take these headaches away.

The difference between data privacy and data security

Data can be a bit of a dry topic, but data privacy and data security are massively important. So what’s the difference between them?

Data privacy governs the ways we process the personal data of employees. Data protection sets out the rules for how we process them, what requirements there are, and what obligations we have as processors and controllers. Basically, data security builds the walls around the data, protecting it against unauthorised entry and unauthorised processing.

Data security is often just something that happens in the background. When everything is good, you don’t really see it, you just trust it. But when something bad happens, then there are great risks to your organisation’s people, data, and reputation.

Why is data protection and security important?

In addition to its many other hats, HR has a role in protecting employee data from negligence and security threats. Failure to do so can lead to hefty fines for being non-GDPR compliant as well as breaking people’s trust in your brand that you’ve spent years fostering. It can take years to build but just one minute to break.

The reputational damage from a data breach and the potential knock-on effects can be irreparable. News of the breach can be published in the public domain and be spread widely. Whilst a monetary penalty is potentially manageable, the negative effects of bad publicity could mean that consumers no longer trust an organisation, which can be fatal to business in the long term.

So it’s possible to be GDPR compliant and still be at risk from data security threats.

What is my HR department responsible for?

GDPR and handling data means different entities are obligated to do certain things. And these things are considered depending on your role. So to help you out, we’ve broken down these roles below: 

• Controller: Anyone that defines the purposes and means of collecting and processing personal data. In general, the primary organisation that collects your personal data is known as the “controller”.
• Processor: The entity which performs various data operations (organising, storing, structuring, altering, transmitting, etc.) on behalf of the controller is known as the “processor”.
• Recipient: This refers to someone or something, whether internal or external, that personal data of data subjects is exposed to.
• Third-party: Any other party with authority to process the personal data under the controller’s or the processor’s direct permission.

With this in mind, let’s dig deeper into some of the aspects organisations are responsible for under GDPR law. According to the legislation, organisations must have systems and security controls designed to protect data and prevent information leaks or other unauthorised use of data. And with greater numbers of people working from home, many using their own devices on different networks, the risk has never been so high.

GDPR also requires organisations using third parties, such as recruitment agencies or payroll providers, that process job candidate or employee data will be responsible for ensuring the third party is GDPR compliant, and they must have appropriate agreements in place.

You also need to be able to prove your due diligence when selecting third-party providers and services. If there’s a data security incident, then you need to demonstrate documentation that shows you tried to use a product that is GDPR compliant.

If HR data security training were just a matter of inform- ing employees about best practices, then IT could prepare a slideshow and be done with it. But ultimately, data security is a constantly evolving threat that requires constant monitoring and updating.

Tips on how to be HR GDPR compliant

For HR to be compliant, the basic features needed from systems and processes are connectivity, configurable APIs and flexible user rights management. The best human resources management systems are software applications that manage human resource functions: such as payroll, recruitment, benefits, training, attendance and, crucially, data management. They also boast multi-layered security features and encryption to protect your organisation’s data.

Many legacy payroll or HR systems are not built to handle changing demands for HR data or even data transfers between different systems. Lack of versatility often results in organisations and individuals creating new files (like spreadsheets) or acquiring several systems for managing personal information. Lack of connectivity results in outdated data in several places. In these cases, providing an individual with a record of all critical people data is strenuous, if not impossible.

Another advantage of HR systems is their ability to centralise the data to control it better. Especially for multi-country companies, that’s a big deal. Not only can organisations get a more comprehensive view of their workforce, but it lowers compliance risks as well (not to mention making HR teams more productive).

Legacy technology is no longer a valid argument in today’s world.

Why you need protection by design, security by default

HR data security and data protection are non-negotiables for the peace of mind of your HR team, your employees, and your company. However, when even the smallest teams may be spread across the globe, compliance can be daunting. You can even be 100% GDPR compliant and still not be secure enough against cyber security threats.

Did you know that according to Sophos, 54 per cent of companies say their IT departments are not sophisticated enough to handle advanced cyberattacks? Or that only five  per cent of companies’ folders are properly protected, on average?

So if your purpose is to protect your data and avoid losses to your company’s reputation and business, we’ve got good news for you. At Sympa, we are specialists in innovative and compliant technology that frees up HR teams, allowing them to concentrate on more targeted, engaging or strategic tasks.

When it comes to privacy, security, GDPR, and legislation compliance, Sympa’s ISO27001/2-certified solution – the world’s best-known standard for information security management systems– has all the protection you need already baked in and stays protected 24/7 by a team of security experts. We have over 15 years of experience in helping clients around the world analyse their business processes, streamline their processes (for employees and candidates) and help them on the journey of business transformation whilst incorporating a new technological solution. Once we understand your technological needs, our experience, knowledge and expertise will enable us to advise you on the right path to finding the right technology solution for your business.

Ensure future compliance

Ensure your HR function is secure today – and remains locally and globally compliant as your team grows. Sym- pa uses a team of security experts to monitor and protect your data, ensuring you remain 100% secure, 24/7, 365.

• Stay compliant with automated GDPR data removal tools.
• Customisable GDPR data removal intervals to meet local and global compliance.
• Modify access levels by yourself whenever needed.
• Manage system administration work easily when organi- sational changes occur.

Consult our GDPR checklist for HR advice

The first step then is to start identifying all the locations where data is stored. This might be easier said than done, and that’s why we’ve created a handy GDPR checklist for HR with simple step-by-step questions. Secondly, ensure that your Processors are compliant with GDPR. Start tracking down your suppliers and engage in conversations regarding the new regulations. Making sure that they are ISO certified is one indication that they are prepared.