Data protection for HR in Ireland
Reviewed by Mellow Editorial Team, HR & payroll content team
Employers in Ireland are legally required to comply with the General Data Protection Regulation (GDPR) and the Data Protection Acts 2018 when handling employee personal data. Failing to do so can result in enforcement action from the Data Protection Commission (DPC), significant fines, and reputational damage.
Why employee data is different
HR holds some of the most sensitive personal data in any organisation: PPS numbers, bank details, salary records, medical certificates, disciplinary notes, performance reviews. Much of this falls into categories the GDPR treats with extra caution — particularly health data, which is classified as special category data and attracts stricter rules.
The employment relationship also creates an imbalance of power. Because employees rarely feel free to refuse consent from their employer without consequences, consent is generally an unreliable legal basis for processing employee data. Instead, most HR processing relies on:
- Legal obligation — for example, processing payroll data to meet your Revenue reporting requirements
- Contractual necessity — data needed to administer the employment contract itself
- Legitimate interests — where your interest is genuine, necessary, and not overridden by the employee's rights
For special category data (health, trade union membership, biometric data), you need both a standard lawful basis and a separate condition under Article 9 of the GDPR. In an employment context, Schedule 2 of the Data Protection Act 2018 provides specific grounds, including processing for employment law obligations.
What you must tell employees
Transparency is not optional. Under the GDPR, employees are data subjects with full rights, and they must be informed about how their data is used. A privacy notice — sometimes called a staff privacy notice or employee data notice — should cover:
- What data you collect and why
- The lawful basis for each type of processing
- How long you retain it
- Whether you share it with third parties (payroll providers, pension providers, insurers, Revenue)
- Employees' rights: access, rectification, erasure (where applicable), restriction, and the right to lodge a complaint with the DPC
This notice should be provided at the start of employment, not buried in a contract. If your processing changes materially, you need to update it.
Access requests and retention
Employees can submit a Subject Access Request (SAR) at any time, asking for a copy of all personal data you hold about them. You have one month to respond, with a possible two-month extension for complex requests — but you must acknowledge the request and notify the person of any extension within the first month.
Retention periods require deliberate decisions. The general principle is that you should not keep data longer than necessary. In practice, HR data has varying retention needs:
- Payroll and tax records: Revenue requires employers to retain records for at least six years
- Unsuccessful job applications: typically no longer than six to twelve months
- Personnel files for former employees: commonly retained for the duration of any potential claims period under employment law
- Disciplinary records: retention depends on the nature of the matter and your own documented policy
Document your retention schedule. If you cannot explain why you are holding data and for how long, you probably should not be holding it.
Transfers, processors and third parties
If you use a payroll provider, HR software platform, or any cloud-based HR system, you are likely transferring personal data to a data processor. Under the GDPR, you must have a written Data Processing Agreement (DPA) in place with every processor before they handle employee data on your behalf. This agreement must set out the scope, nature and purpose of the processing, and confirm the processor will only act on your documented instructions.
If your provider stores or processes data outside the European Economic Area — common with US-headquartered software companies — you need to verify that an adequate transfer mechanism is in place, such as Standard Contractual Clauses (SCCs). This is not a formality; the DPC has taken enforcement action in Ireland on exactly this issue.
For how Mellow runs payroll across six countries on one platform, appropriate transfer mechanisms and DPAs are a baseline requirement, not an afterthought.
Practical steps to get in order
If you have not reviewed your HR data practices recently, start here:
1. Map your data. Know what employee data you hold, where it lives, who has access, and why.
2. Document your lawful bases. For every category of data, record which legal basis you rely on.
3. Issue or update your staff privacy notice. It should reflect your actual practices, not a generic template.
4. Audit your processors. Confirm DPAs are signed with every third-party vendor handling employee data.
5. Set a retention schedule. Review what you are holding and delete what you no longer need.
6. Train your HR team. Staff who handle personal data should understand the basics of GDPR and how to handle a SAR.
The DPC publishes guidance specifically for employers, and it is worth reading their material on employee monitoring, sick leave processing, and workplace investigations — all areas where Irish employers frequently run into difficulties.
---
Run HR and payroll in Ireland with Mellow
Mellow brings HR, payroll and 12 AI agents into one platform — built to handle Ireland properly, with payroll included, from £4 per employee per month. The AI agents don't just answer questions; they generate contracts, run cost estimates and draft letters for you.
[Start a free trial →](/register)