GDPR in the Workplace in 2026: Employee Data and Privacy

Quick Overview

• An employer needs an appropriate legal basis for each purpose of processing personal data.
• As a general rule, the employer does not need the employee’s consent for necessary HR and payroll tasks.
• Employees must be provided with clear information about how their data is used.
• CCTV surveillance and monitoring of communications are also subject to strict conditions under the Labor Code.
• A signed consent form from an employee alone does not remedy unlawful surveillance.

Do you need to implement GDPR compliance in the workplace? As part of a GDPR audit, we’ll review how employee data is handled and propose the necessary changes to documents and procedures.

Processing of Employee Personal Data: When It Is Permitted Without Consent

The processing of employees’ personal data is primarily governed by the General Data Protection Regulation, known as the GDPR. The Czech regulations are supplemented by the Act on the Processing of Personal Data. Privacy in the workplace is also protected by the Labor Code.

Employers routinely process data necessary to fulfill employment contracts and legal obligations. This typically involves maintaining personnel records, calculating wages, or calculating insurance contributions. For these purposes, the employer generally does not need the employee’s consent.

Consent has limited application in an employment relationship. Due to the unequal position of the employee and the employer, consent may not be truly freely given. It cannot replace a properly established legal basis or justify a disproportionate intrusion into privacy.

On the contrary, it is a myth that it would no longer be possible at all to send marketing communications (e.g., in the form of email newsletters) to client databases that have been painstakingly built up over time, and that it is not possible, for example, to collect employees’ social security numbers. In fact, marketing communications may be sent if the business obtained the contact information based on a previous order. In this case, however, customers must have the option to opt out of receiving further marketing communications easily and free of charge. Similarly, employers may also collect employees’ social security numbers, even without their consent. This is because the employer needs the birth number to fulfill its reporting obligation to the employee’s health insurance provider.

Protection of Employee Personal Data in Day-to-Day Operations

The protection of employees’ personal data begins with the employer determining what data is needed and why. The employer should collect only a reasonable amount of data, use it for specified purposes, and retain it only for as long as necessary.

Employees must be provided with information, in particular, regarding the purposes and legal grounds for processing, the recipients of the data, the retention period, and their rights. A general clause in an employment contract stating that “the employee agrees to the GDPR” does not fulfill these obligations.

Only individuals who need personal data to perform their job duties should have access to it. Paper files should be stored in lockable cabinets, and access permissions should be set up in electronic systems and regularly reviewed.

Security measures may also include logging access and changes to the system. The necessary scope of these logs depends on the nature of the data and the risks associated with its processing. For large-scale HR systems, logging may be necessary; however, it is not accurate to state that the GDPR requires, without exception, the recording of every access to any data.

Is it permissible to monitor employees in the workplace?

However, what is even more important for employees than the protection provided by the GDPR—which is generally overestimated— is the fact that the law stipulates that an employer may not infringe on an employee’s privacy without a compelling reason based on the specific nature of the employer’s business—not only in the workplace but also in public spaces. This includes, for example, subjecting an employee to overt or covert surveillance.

Even the protection of property is not automatically a valid reason for surveillance. However, if it involves a workplace where, for example, theft occurs frequently or where it is necessary to monitor compliance with technological procedures, it is possible to monitor certain areas. There must, however, be truly compelling reasons for doing so. For example, in a chemical plant, safety takes precedence over privacy, and employees’ activities in the laboratory must be monitored. Recording is also permitted in such cases. The same does not apply, however, in an office or a gym. In any case, surveillance should definitely not be conducted covertly.

From inspection practice: cameras in the office and break room

In one of the published findings from a labor inspection, an employer was recording both video and audio in the office and the employee break room. The inspection did not find sufficient grounds for such an intrusion and also pointed out the possibility of less invasive security measures for the premises. A general justification based on security was therefore not sufficient on its own.

If an employee objects to monitoring in the workplace, they must notify the employer of their objections. If the employer does not accept these objections and continues the monitoring, it would be possible to contact the State Labor Inspection Office or, if necessary, the Office for Personal Data Protection. Such unauthorized processing of personal data is punishable by fines of up to hundreds of thousands. Furthermore, if the employer has evidence against an employee obtained in this illegal manner , it cannot be used, for example, in a dispute over the validity of the termination of an employee “caught” by such a camera.

Can an employer monitor work email?

An employer may reasonably monitor whether an employee is using work resources for unauthorized personal purposes. However, this does not automatically give the employer the right to read the content of communications.

Monitoring of email that infringes on privacy is subject to stricter conditions under the Labor Code. The mere suspicion of a breach of work duties is not a blanket justification for accessing the entire inbox. Similarly, there is no simple rule stating that the subject line of a message can always be checked, while its content never can. The purpose, necessity, and scope of the intervention are decisive.

However, there is an interesting case in which the European Court of Human Rights addressed the termination of a Romanian employee who was fired for excessive private chatting during work hours. He was in charge of customer support, and his employer asked him to create an official Yahoo! Messenger account, which he was supposed to use to respond to customer inquiries. However, the employee used it for personal purposes —and not just a little.

The employer later began to suspect that something was amiss, but the employee denied everything in writing. The employer then presented transcripts of highly personal, erotic conversations. On this basis , the employee was terminated, a decision he subsequently sought to challenge in court. However, in this case, he was unsuccessful. The court acknowledged that the employee’s personal rights had indeed been infringed, but in this instance, it gave priority to protecting the employer. It is important to emphasize the word “in this instance,” however, because this may not always be the case.

An employer has the right to monitor the use of company resources, but cannot arbitrarily intrude on the privacy of its employees. It’s a fine line—the court might not always rule in the employer’s favor. Especially in the age of mobile devices, it is practically impossible to monitor employees to ensure they do not use chat apps during work hours; for this reason, most employers today are moving away from strict bans.

Summary

The GDPR in the workplace requires employers to process data for specific purposes, have an appropriate legal basis, and protect the data from unauthorized access. Necessary HR and payroll records are generally maintained without the employee’s consent. Furthermore, surveillance cameras and monitoring of communications are subject to the Labor Code: they require proper justification, must be limited to a reasonable scope, and employees must be informed. Depending on the nature of the matter, suspected violations of these rules may be addressed by labor inspectors and the Office for Personal Data Protection.