Hr System Privacy Config

Data Retention

Workday provides Data Purge functionality:

1. Purge Framework: Configure purge rules by data type and retention period
2. Worker History Purge: Systematically remove historical data for terminated workers after the retention period
3. Recruitment Purge: Automatically delete unsuccessful candidate records
4. Archive and Purge: Move data to archive before permanent deletion, allowing recovery within a grace period

Cross-Border Transfers

1. Tenant Configuration: Workday allows configuration of data residency at the tenant level
2. Multi-Region Deployment: Large enterprises may have separate tenants for different regions
3. Integration Security: Workday integrations (HCM, Payroll, Benefits) that transfer data across borders must be assessed under the TIA framework

BambooHR Configuration

Access Levels

BambooHR uses a simpler access model suitable for small to medium enterprises:

1. Access Levels: Pre-defined levels (Employee Self-Service, Manager, HR Admin, Payroll Admin, No Access) plus custom levels
2. Field Visibility: Each access level defines which fields are visible and editable
3. Custom Access Levels: Create privacy-compliant custom levels:
   • DPO Audit: Read-only access to processing records and audit logs, no access to individual employee data
   • Restricted HR: Access to specific employee populations only
   • Benefits Only: Access to benefits fields only

Reporting Restrictions

1. Report Filters: Configure default report filters to prevent inadvertent disclosure (e.g., reports automatically exclude health data fields)
2. Custom Reports: Restrict who can create custom reports (custom reports can bypass field visibility if not properly configured)
3. Data Export: Restrict CSV/Excel export permissions to authorised roles only

Retention Configuration

BambooHR provides:

1. Inactive Employee Management: Configure rules for archiving and deleting terminated employee records
2. Document Purge: Automated deletion of uploaded documents (offer letters, ID copies, certificates) after configured retention period
3. Application Tracking Purge: Delete unsuccessful candidate data after configured period

Privacy Configuration Checklist

Initial Setup

• Map organisational roles to HR system security roles/groups
• Configure field-level access for each role per RBAC matrix
• Restrict health data fields to authorised roles only
• Restrict salary/compensation fields to authorised roles
• Configure manager access to direct reports only (not entire organisation)
• Disable default admin access to personal data content
• Enable audit logging for all data access, modification, and export events

Data Retention

• Configure automated purge rules for each data category
• Set retention triggers (termination date, application decision date, etc.)
• Test purge rules in sandbox environment before production deployment
• Verify that purge rules maintain required audit trails
• Configure anonymisation for data required for aggregate reporting post-retention

Cross-Border Transfers

• Verify data centre location for EEA employee data
• Assess all integrations that transfer data outside the EEA
• Implement SCCs or verify DPF certification for US transfers
• Conduct TIA for transfers to non-adequate countries
• Configure data residency restrictions on APIs and integrations

DSAR Compliance

• Test the system's ability to export a complete copy of an individual's data
• Verify that the export includes all modules (core HR, performance, absence, recruitment)
• Configure DSAR workflow with deadline tracking and escalation
• Test rectification capability: can specific fields be corrected without system integrity issues?
• Test erasure capability: can individual records be deleted while maintaining referential integrity?

Ongoing Monitoring

• Schedule quarterly access reviews — review who has access to what
• Review audit logs monthly for anomalous access patterns
• Test retention automation quarterly — verify that purge rules execute correctly
• Review security configuration after system upgrades (upgrades may reset security settings)
• Conduct annual privacy assessment of HR system configuration

Atlas Manufacturing Group Example

Atlas Manufacturing Group uses SAP SuccessFactors for 2,400 employees across Germany, France, UK, and the Netherlands. The DPO conducted a privacy configuration audit and identified the following issues:

1. Over-broad manager access: Line managers had read access to salary data for all employees in their department, not just direct reports. Remediation: Reconfigured RBP to limit manager access to direct reports only.
2. No automated retention: Terminated employee data was retained indefinitely. Remediation: Implemented DRM purge rules — personal data purged 6 years after termination, with 40-year retention for occupational health records of employees in the chemical production unit.
3. Cross-border transfer gap: The SuccessFactors integration with a US-based benefits provider was transferring employee data without SCCs. Remediation: Verified the benefits provider's DPF certification and implemented supplementary encryption measures.
4. Missing audit logging: Data exports to Excel were not logged. Remediation: Enabled export audit logging and restricted export permissions to HR BP and Payroll roles.
5. Health data visibility: The absence management module displayed the "reason for absence" field (which sometimes contained health information) to line managers. Remediation: Removed reason field visibility for managers; managers see absence dates and type (sick, annual leave, other) only.

Enforcement Precedents

Integration Points

• Employee DSAR Response: HR system must support data export for DSARs (see employee-dsar-response skill).
• Employee Health Data: Health data fields require dedicated access controls (see employee-health-data skill).
• Employee Biometric Data: Biometric integration with timekeeping requires privacy configuration (see employee-biometric-data skill).
• Background Check Privacy: Background check data storage must comply with retention limits (see background-check-privacy skill).
• Remote Work Monitoring: HR system integration with monitoring tools must respect data separation (see remote-work-monitoring skill).