Employee Records and GDPR for Managers in Ireland: HR Guide

Employers hold a surprising amount of personal data about their staff, from PPS numbers and bank details to sick leave, performance reviews and disciplinary files. Managers who create or handle those records are part of the employer's GDPR responsibilities. This guide covers what the official pages say about employee records and GDPR for managers in Ireland, including how long certain records must be kept, what the Data Protection Commission (DPC) says about retention and security, and where the pages are silent. It also points to our guide on data subject access requests, which covers staff asking to see their records.

What data employers hold, and who is the controller

The DPC's page "Data Protection in the Workplace: Employer Guidance" (no date shown) is aimed at employers acting as data controllers for personal data about employees, former employees and prospective employees. It says this data can range from basic information such as names, addresses and PPSNs to information on occupational health, sick leave, performance reviews or disciplinary actions. It adds that employers must be mindful of their responsibilities under the GDPR and the Data Protection Act 2018.

That page is only a short introduction. It links to a full guidance note in PDF form which we could not open, so this guide does not summarise that note. Where we describe the rules, we rely on the other pages named below.

The principles managers need to know

The DPC's page "Principles of Data Protection" (no date shown) lists the seven principles under Article 5 of the GDPR. Applied to staff records, they work like this:

• Lawfulness, fairness and transparency: people should be able to see that their data is being processed and how.
• Purpose limitation: data is collected for defined, clear and legitimate purposes and not further processed in a way that conflicts with them.
• Data minimisation: data is limited to what is necessary for the purpose.
• Accuracy: inaccurate data is erased or corrected promptly.
• Storage limitation: identifiable data is kept only as long as necessary. The DPC says controllers should set time limits for erasure or periodic review.
• Integrity and confidentiality: appropriate security.
• Accountability: the controller must be able to demonstrate compliance.

Citizens Information (page "Data protection in the workplace", edited 3 June 2022) makes similar points for employers: be transparent, tell employees what is collected and why, keep an inventory of what you hold, and keep data only as long as needed for the task it was collected for. Citizens Information also says employers must be able to show they have complied with their security obligations.

How long to keep employment records

Here two things need to be kept apart: specific record-keeping duties in employment law, and the general GDPR rule that data should not be kept longer than necessary.

The WRC page "GDPR and Employment Records" (no date shown) says statutes impose a legal obligation on employers to keep certain personal data about employees and set defined retention periods. It lists employee names, addresses, PPSNs, employment details, working hours, breaks, leave and wage records. Its example is three years from the date the record was made, and it adds that the period may vary depending on the statute. The page says these obligations have not been affected by GDPR, and that failing to provide records requested by a WRC Inspector is a criminal offence.

Two other official pages give specifics:

• Citizens Information (page "Keeping records of working time and breaks", edited 10 August 2026) says employers must keep working time records for 3 years, and that this obligation is not affected by the GDPR. The records include the employee's name, address, PPS number and a statement of duties, a copy of the contract, days and hours worked, and leave taken and pay for it.
• The WRC sick leave page (updated 9 April 2025) says employers must keep sick leave records, covering the employment period, dates and times of leave and rate of payment, for four years.

For other records, such as application forms, disciplinary files or health information, the DPC FAQ on retention (no date shown) says the GDPR does not stipulate specific retention periods, and that the actual period depends on the purposes for which the controller processes the data. We did not find a single official page that sets periods for every type of HR record, and a Revenue page on payroll record-keeping we tried to open was not available, so we do not give periods for those records. Check the statute that applies to each record type, or take advice.

Our suggestion: a one-page retention schedule

This is a practical approach, not a legal requirement. List each type of HR record, why you hold it, who can see it, the legal retention rule if you have confirmed one, and the review or deletion date. Where no rule exists, write the reason for the period you chose. That gives you something concrete to show if the DPC or an employee asks, and fits the accountability principle described above.

Health information needs extra care

The DPC's special category data page (no date shown) lists data concerning health among the special categories in Article 9 of the GDPR, and says processing is prohibited except in limited circumstances set out there. That page does not describe the exceptions. Citizens Information (edited 3 June 2022) says that generally sensitive data cannot be processed without explicit consent, and that employers may process it where needed to carry out an employment contract. Because those two statements are brief summaries, take legal advice before building a process around either.

A DPC case study on processing of health data (tagged 2022) concerned a worker on sick leave. The DPC found that sharing details of the doctor's specialism was excessive, because it hinted at the illness, and that consent to one activity did not cover disclosure to others. The lesson for managers is to share only what is necessary. Our suggestion: keep diagnoses out of general HR and payroll files unless there is a clear need, and limit access to a named few.

Security, breaches and staff access

The DPC data security guidance (no date shown) recommends limiting access to what each person needs for their role, reviewing access regularly, avoiding shared logins and keeping a joiners, movers and leavers process. It also covers encryption on portable devices, logging, backups and secure disposal, and says formatting a drive alone is not enough. Paper records should be disposed of securely.

Citizens Information (edited 3 June 2022) states that data breaches must be reported to the DPC within 72 hours of becoming aware of them, and that a breach likely to cause harm must also be reported to the person affected. As that page is dated, confirm the current position on the DPC site before relying on it.

Staff requests to see their records

Citizens Information (edited 3 June 2022) says employers must have procedures to respond to access requests from employees within 1 month, extendable by two further months for complex or numerous requests. Our data subject access requests guide, linked near the top of this page, covers the process in detail. For staff awareness, see our overview of GDPR staff training requirements for employers.

Practical steps for managers in Dublin and elsewhere

The following are our suggestions rather than legal requirements:

• Our suggestion: keep working notes short and factual. Employees can ask to see what is held about them, so write as if the person will read it.
• Our suggestion: use shared HR systems rather than personal email, drives or notebooks for staff information.
• Our suggestion: tell new staff what you collect and why at induction, in plain language.
• Our suggestion: check that payroll and other third-party providers are covered by appropriate agreements, as Citizens Information notes they must be GDPR-compliant.

Learnsignal's offices are off Baggot Street in Dublin, and we offer in-person training from there. For current details, see our CPD pages.

Frequently asked questions

Does GDPR override the duty to keep employment records?

No. The WRC page says the statutory duties to collect and keep employment records, for three years from the date the record was made in its example, have not been affected by GDPR. Citizens Information says the same of working time records.

Does the DPC set how long HR records must be kept?

The DPC FAQ says the GDPR does not stipulate specific retention periods and that the period depends on the purposes of processing. Statutes may set periods for particular records.

Is sick leave information special category data?

The DPC lists data concerning health as a special category under Article 9. Information about the nature of an illness is therefore likely to be health data. Whether a simple absence date is, the pages we opened do not say, so take advice if unsure.

How quickly must an employer respond to a staff access request?

Citizens Information says within 1 month, with an extension of up to two further months for complex or numerous requests.

This guide is general information from the pages named above and is not legal advice. Take advice on a specific case.