Lawful Basis for Employee Data in Ireland: Why Consent Is Rarely the Answer

Many employers in Dublin still ask staff to "sign a consent form" for HR data, assuming that is the safest route under GDPR. The Data Protection Commission (DPC) and the European Data Protection Board (EDPB) point the other way: because of the imbalance between employer and employee, consent is rarely the right lawful basis for employee data. This guide explains how to choose a lawful basis for employee data under GDPR in Ireland, what the guidance says about consent, and how to document your choice. It is general information, not legal advice.

Why you need a lawful basis at all

The DPC's lawful processing page says that to process personal data "you must have a lawful basis to do so", and that the lawful grounds are set out in Article 6 of the GDPR. The six grounds, as listed on the DPC page and in the GDPR text on EUR-Lex, are consent, contract, legal obligation, vital interests, public task and legitimate interests.

The DPC's guidance note on legal bases (version last updated December 2019) adds several points that matter for HR:

• No basis ranks above another. Each processing activity should use the one that best fits.
• The same data may need different bases if it serves more than one purpose.
• Controllers should settle the basis before processing starts, and individuals must be told the purposes and the basis under Articles 13 and 14.
• Controllers should not pick bases selectively to reduce their compliance burden.

Whichever basis you choose should be recorded in your processing records, which our guide to Article 30 records of processing explains.

What GDPR consent requires

The DPC note says consent must be freely given, specific, informed and unambiguous, and given by a statement or clear affirmative action. Silence, pre-ticked boxes and inactivity are not consent. Consent cannot be obtained through the same action as accepting a contract, and separate consent is needed for distinct purposes. Article 7 of the GDPR adds that the controller must be able to demonstrate consent, that the data subject can withdraw it at any time, that withdrawal must be as easy as giving it, and that account is taken of whether performance of a contract is conditional on consent to processing that the contract does not need.

Why consent is rarely the answer for employees

On freely given consent, the DPC note says consent is unlikely to be free where there is a clear imbalance between the individual and the controller, and names an employer as one example. It also records that Recital 155 allows Member State law or collective agreements to set specific rules for employee data.

The EDPB's Guidelines 05/2020 on consent (version 1.1, adopted 4 May 2020) go further. They say the employment relationship creates dependency, so an employee is unlikely to be able to refuse without fear of consequences. They state that the lawful basis "cannot and should not be the consent of the employees" for most workplace processing, and that employees can give free consent "only in exceptional circumstances, when it will have no adverse consequences at all whether or not they give consent". Their example is a film crew recording in an office where staff who decline are moved to equivalent desks without penalty.

The DPC note adds a practical risk: withdrawal. Employees can withdraw consent at any time, and the DPC says that if withdrawal would make processing impractical or impossible, another basis should be considered. That is a reason to choose the right basis at the start rather than building an HR process on consent that can be taken away.

The bases employers more often need

The DPC and EDPB pages do not give a list of HR examples. The mapping below is therefore our suggestion, based on how the DPC describes each basis, and should be checked against your own facts.

Contract

The DPC says this covers processing that is objectively necessary to perform a contract with the individual, or to take steps they requested before entering a contract. It does not need to be listed in the contract but must be reasonably necessary to it. Employee contracts and basic payroll details are the kind of thing employers commonly look at here.

Legal obligation

This covers processing necessary to comply with an obligation under EU or Irish law. The DPC says controllers should identify the specific law they rely on, and that the basis is not appropriate if the controller has discretion over whether to process or a less intrusive way to comply exists.

Legitimate interests

The DPC describes a three-part test: identify a legitimate interest, show the processing is necessary for it, and balance it against the individual's interests, rights and freedoms. It says controllers should document the balancing assessment and review it after a significant change. This basis is often looked at for activities such as workplace security, but monitoring raises further questions, which our guide to employee monitoring and CCTV covers.

Consent

Consent may still be right where the employee has a real choice and nothing happens if they say no, such as an optional staff directory photo. That is our example, in the spirit of the EDPB's "no adverse consequences" test, not a DPC example.

Health and other special category data

The DPC note says special category data needs both an Article 6 basis and an Article 9 condition. Article 9 of the GDPR (EUR-Lex consolidated text) generally prohibits processing health data, trade union membership and other special categories, with exceptions. One exception covers processing necessary for obligations and specific rights of the controller or data subject in employment, social security and social protection law, where authorised by EU or Member State law or a collective agreement with appropriate safeguards. We have not set out the Irish provisions here, so take advice on sickness records and similar data.

Why the basis matters to employee rights

The DPC note says the rights available vary by basis; for example, withdrawal applies where consent is the basis. When staff make access requests, you need to know what basis applied to each category of data; see our guide to data subject access requests in HR.

A practical approach for HR teams

Our suggestions, not legal requirements:

• List the categories of employee data you hold and the purpose of each.
• Choose and record one basis per purpose, with a note of why.
• Remove "I consent" wording from contracts and handbooks unless you can show the employee has a real choice.
• Update your staff privacy notice so it states the purposes and bases.
• Review the list when you introduce new systems or change purposes.

Learnsignal's offices are off Baggot Street in Dublin, and we offer in-person training from there. For current details, see our CPD pages.

Frequently asked questions

Can an employer ever rely on employee consent?

The EDPB says employees can give free consent only in exceptional circumstances, when refusing has no adverse consequences at all. For most workplace processing, it says consent should not be the basis.

Does my staff handbook need to list a lawful basis?

The DPC says individuals must be told the purposes and the legal basis under Articles 13 and 14. A privacy notice for staff is the usual place, though the DPC note does not prescribe the format.

Can I change the lawful basis later?

The DPC note does not describe a general process for switching bases and says controllers should settle the basis before processing starts. If you think a change is needed, take advice.

Do I need a lawful basis for special category data such as health data?

Yes. The DPC note says you need both an Article 6 basis and an Article 9 condition.

The key step is simple: stop defaulting to consent, choose the right basis for each purpose, and write the reasoning down.