Privacy laws for employee data in the Netherlands under GDPR

Employee data processing covers more than payroll: collecting, storing, using or sharing information that identifies a worker all count. Under the GDPR, employee numbers and identifiable audio or video recordings are personal data, and processing needs one of the regulation’s six legal grounds. The employer is generally the controller and must explain what data it uses and why.

That can seem straightforward until routine employment records sit alongside monitoring, health information, or cross-border transfers. Apply GDPR principles to each purpose: collect only necessary data, use it fairly and transparently, and protect it appropriately.

This guide explains what employee data processing includes, when a Data Protection Officer is required, what powers the Dutch Data Protection Authority has, and how international transfers are governed. It also sets out the core principles that help employers handle employee information lawfully in the Netherlands.

By Joost Hubregtse, Payroll Director.

Joost Hubregtse is Payroll Director at ICSPayroll, the Dutch payroll and EOR specialist of Intercompany Solutions. A career payroll specialist and former Head of Payroll, he oversees wage tax filings, 30% ruling applications, and employment compliance for international employers.

Reviewed by Joost Hubregtse, Payroll Director, on 6 November 2026.

What is processing of personal data?

Under the European GDPR, processing means any operation performed on personal data. It includes collecting, recording, organising, storing, changing, retrieving, using, sharing, restricting or deleting information. A Dutch employer processes data when it adds an employee’s address to a personnel file, calculates salary, or reviews identifiable footage from workplace cameras. Employee numbers also count when they identify a person. The regulation applies to organisations handling personal data, including employers, whether records are digital or paper-based.

In an employment relationship, the employer is usually the data controller and the employee is the data subject. The controller decides why and how personal data is processed. Before using information, the employer must identify a legal basis and tell staff what data it uses and why. A contract can support processing needed to meet employment obligations, such as paying an agreed salary. It does not justify collecting unrelated information or reusing records for another purpose without assessing whether that use is compatible.

The GDPR provides six legal bases for processing. The right basis depends on the purpose, not simply the employer’s preference:

• Contract: processing necessary to perform the employee’s contract, such as administering salary.
• Legal obligation: processing required by law, including payroll information needed for statutory tax duties.
• Legitimate interests: processing supported by a documented balance between the employer’s interest and employee rights.
• Consent: valid only when freely given. An employment power imbalance can make genuine choice difficult.
• Vital interests: processing necessary to protect someone’s life or physical integrity.
• Public task: processing necessary for a task carried out in the public interest or under official authority.

Controllers must also keep records of processing activities under Article 30 GDPR. A useful record connects each purpose with the data involved, the people who receive it, retention periods, and security measures. For example, a payroll entry should identify the salary-administration purpose, relevant employee details, authorised recipients, and applicable retention arrangements. These records help show how the employer meets its obligations and make it easier to identify unnecessary processing. They should reflect actual practice, rather than describe an ideal process that does not occur.

The Dutch Police Data Act, known as the Wpg, is distinct from ordinary employer processing under the GDPR. It regulates police data processing by the Dutch National Police and specified services and authorities. An employer’s routine personnel records do not become police data simply because they mention an incident. Information connected with criminal offences has separate GDPR protections, so its purpose and legal conditions require careful attention before processing.

Finally, a personal data breach creates a reporting duty. Businesses responsible for a personal data breach in the Netherlands must notify the Dutch Data Protection Authority within 72 hours, according to Autoriteit Persoonsgegevens. A breach can include unauthorised access, loss, or disclosure of employee records. Accurate processing records help identify what information was affected and support a timely response.

Data Protection Officer requirements

The general data protection regulation requires a Data Protection Officer (DPO) in defined situations, not simply because an organisation employs people. Under Article 37 GDPR, a DPO is required for public authorities and organisations whose core activities involve large-scale monitoring or large-scale processing of special-category data. For an employer, the key assessment is whether these activities form part of its core operations and reach a large scale. Routine personnel administration alone is not one of the stated triggers.

Monitoring may involve systematically observing people, while special-category data includes sensitive information such as employee health data. An organisation should assess the actual nature and scope of its core activities. A workplace system that extensively monitors staff may raise a different question about appointing a DPO than ordinary access logging. Similarly, handling sensitive employee information as a core activity requires attention to whether it is done on a large scale. The requirement depends on these criteria, not on a job title or a general interest in data protection.

A data protection impact assessment (DPIA) is a separate requirement. Under Article 35 GDPR, an organisation must carry out a DPIA when planned processing is likely to result in high risk to people’s rights and freedoms. For example, an employer planning extensive staff monitoring should assess the risks before the processing begins. The assessment examines the planned use and its likely impact, then identifies safeguards that can reduce the risk. A DPIA does not automatically mean a DPO is mandatory. However, both requirements can apply to the same processing where their respective tests are met.

Employee privacy also sits within broader European human-rights protections. Article 8 of the European Convention on Human Rights protects the right to respect for private life, which can be relevant when employers monitor staff. The GDPR focuses on personal data processing; the Convention addresses privacy more broadly. Article 8 of the EU Charter of Fundamental Rights also contributes to personal data protection. The Council of Europe’s Data Protection Convention dates from 1981 and is also called Convention 108. Together, these instruments provide context for assessing workplace privacy and data protection.

Employees in the Netherlands can submit privacy complaints to the Dutch Data Protection Authority, the Autoriteit Persoonsgegevens. A valid complaint can result in a fine for the organisation. The Dutch Implementation Act also sets a confidentiality duty for DPOs: under Article 38(5), a DPO must keep confidential information learned through a data-subject complaint or request unless that person agrees to disclosure. This matters when an employee approaches the DPO privately. Clear internal handling helps preserve confidentiality while the organisation addresses the concern.

For employers, the practical distinction is clear: assess DPO requirements against core activities, and assess each high-risk processing plan for a DPIA. Documenting the reasoning helps explain why a DPO or impact assessment is required, or why the relevant criteria do not apply.

What can the Dutch Data Protection Authority do?

The Autoriteit Persoonsgegevens (AP) is the Netherlands’ data protection authority. It monitors compliance with the GDPR, the Law Enforcement Directive and other laws governing personal data. For employment matters, this can include reviewing how an organisation handles staff records, monitors workers, or responds to data-subject rights. The AP can assess whether processing has a lawful purpose and whether safeguards fit the risks. Its role concerns more than fines: supervision can also require an organisation to change its practices.

The GDPR applies directly in the Netherlands, while the Dutch GDPR Implementation Act, known as the UAVG, sets national rules where the regulation allows. The UAVG contains Dutch provisions on matters such as national supervision and the operation of specific GDPR rules. Employers need to consider both the GDPR’s shared European requirements and relevant Dutch provisions, rather than treating the UAVG as a replacement for the regulation.

The AP may investigate suspected non-compliance and use corrective powers under the GDPR. Depending on the issue, measures can include an order to bring processing into compliance, a restriction on processing, or a ban on a particular use of employee data. Under Article 58(6) GDPR, the Dutch Implementation Act also gives the AP powers to issue administrative enforcement orders and penalty orders. For example, an organisation continuing a use that breaches data protection rules may face an order requiring action, with a penalty order supporting compliance.

Financial exposure can be substantial. The Dutch Data Protection Authority may impose GDPR fines of up to 4% of annual worldwide turnover or EUR 20 million, whichever is higher, according to Autoriteit Persoonsgegevens. The applicable response depends on the infringement and its circumstances. The AP may examine the organisation’s processing, the safeguards in place, and whether it acted on earlier concerns. A processing register and clear evidence of decisions can help explain how a workplace practice was designed and managed.

Consent is not a universal solution to employment privacy concerns. The AP may consider whether consent was genuinely freely given and whether another legal basis better suits the purpose. Employers should be able to explain why they use each category of employee information, who can access it, and how their measures reduce risk. Clear internal records make this reasoning easier to demonstrate during supervision.

An organisation that receives an AP decision can object within six weeks and then appeal to the administrative court. These steps concern administrative decisions; they do not automatically suspend every compliance obligation. The practical priority for employers is to address the underlying processing issue, preserve relevant records, and follow the formal review process if they dispute the decision.

International data transfers

Dutch employers must tell employees what personal data they use and why. When an employee requests access to their personal data, the employer must respond within one month. These duties also matter when information is sent abroad: employees should understand who receives it and for what purpose.

A transfer from the Netherlands to another country is allowed only if that country offers sufficient protection or an appropriate safeguard is in place. Article 44 GDPR sets conditions for transfers to third countries. Before sending payroll records to an overseas group company or service provider, identify the destination, recipient, information involved, and purpose. Then establish which protection or safeguard applies to that transfer. A contract alone does not remove the need to meet the GDPR’s transfer conditions.

Consider the full data-processing chain. An employer might store staff files in one country, while a payroll team and an overseas parent company access them elsewhere. Map each recipient and the information shared, such as salary details or contact information. Limit transfers to data needed for the stated purpose. Record the destination and safeguards in the organisation’s processing documentation, then review the arrangement if the recipient, purpose, or destination changes.

When an external supplier processes employee information on the employer’s behalf, Article 28 GDPR requires a processor agreement. That agreement should reflect the supplier’s role and the employer’s instructions. It does not replace the transfer assessment where the supplier or its systems are in another country. Keep the agreement, transfer assessment, and employee-facing explanation aligned. For example, a notice about payroll administration should identify relevant recipients and explain the purpose of sharing records.

Email and internet policies are another part of transparent workplace data processing. Dutch employers must inform staff about the company’s email and internet policy. A guideline or code of conduct can set rules for using workplace internet and social media. It can explain permitted use during working hours, what the employer monitors, and why monitoring serves a defined workplace purpose. Employees need this information before the rules affect their use of company systems.

Employers may check whether staff follow workplace internet and social media rules, but monitoring private internet use must respect employees’ fundamental right to privacy. If investigation equipment is used to monitor compliance, employees must be informed in advance. If monitoring reveals a breach of workplace rules, the employee must also be informed. State the reason and scope of monitoring in the policy, and ensure actual practice matches that explanation.

For each transfer or monitoring arrangement, keep the purpose, recipients, safeguards, and staff notice consistent. Clear records help explain why information moves across borders or why workplace systems are monitored, while supporting employees’ access and transparency rights.

GDPR principles for employee data

The GDPR’s principles set the standard for how Dutch organisations handle employee information. They apply throughout its lifecycle, from collecting an applicant’s details to deleting a former employee’s records. Compliance requires more than storing a privacy policy. Each use needs a clear purpose, limited data, appropriate access, and a reasoned retention period. These principles define privacy laws for employee data in the Netherlands under the GDPR and apply across EU Member States.

• Lawfulness, fairness and transparency: identify a valid legal basis, treat employees fairly, and explain processing clearly.
• Purpose limitation: collect information for specified purposes. Don’t reuse recruitment notes for performance monitoring without assessing the new use.
• Data minimisation: request only details needed for the task. A manager arranging a schedule generally needs availability, not unrelated personal history.
• Accuracy: keep records correct and update them when circumstances change, such as an employee’s contact details.
• Storage limitation: retain personnel records only as long as their purpose or a legal duty requires.
• Integrity and confidentiality: protect records against unauthorised access, loss, or disclosure with safeguards suited to the processing risk.
• Accountability: document decisions and safeguards to demonstrate compliance with the other principles.

Health information needs additional care. It is special-category personal data under Article 9 GDPR and may be processed only under strict conditions. Employers should distinguish necessary work-related information from details about an employee’s diagnosis. Information about criminal convictions and offences falls under Article 10 GDPR and has specific protections. Restrict access to people who need the information for their duties, and avoid collecting sensitive details without a lawful basis and applicable conditions.

Workplace monitoring tests several principles at once. Before reviewing email logs or internet use, define the purpose, limit the information examined, and consider whether the method is proportionate. A broad review of private communications may collect more than the stated purpose requires. Explain the monitoring policy, restrict access to results, and retain findings only as long as needed. These steps put transparency, data minimisation, and confidentiality into practice.

Security should reflect the nature and risks of processing. Article 32 GDPR requires appropriate technical and organisational measures. Access controls, role-based permissions, and secure handling procedures can reduce exposure of personnel records. Privacy by design builds protection into a system from its design stage. Privacy by default configures it to use privacy-friendly settings unless a justified need requires otherwise. Applying privacy laws for employee data in the Netherlands under the GDPR means making these safeguards part of ordinary operational decisions.

For a Dutch employment setup, explore Dutch hiring support alongside these privacy principles.

ICSPayroll

ICSPayroll supports international employers managing employment and payroll in the Netherlands, where employee information is part of routine administration. Its Employer of Record (EOR) and Dutch Payroll services help organise local employment and payroll responsibilities. These services can be useful when a business hires in the Netherlands and needs a structured approach to employee records alongside its wider GDPR obligations.

For companies building a Dutch workforce, an EOR can support local employment without requiring the company to employ staff directly. Employers with an existing local entity can use Dutch Payroll for payroll administration. Neither service replaces the organisation’s responsibility to decide why it processes personal data and to protect that data appropriately.

Contact ICSPayroll to discuss your Dutch employment or payroll requirements.

Make privacy part of your employment operations

Employee privacy works best when it informs everyday decisions, rather than being treated as a separate policy exercise. As roles, systems, and responsibilities change, assign clear ownership for reviewing how workforce information is used. This keeps your privacy practices aligned with how your Dutch operations work.

For international employers, applying privacy laws for employee data in the Netherlands under the GDPR also means coordinating employment administration with responsible data practices. ICSPayroll supports Dutch hiring through Employer of Record (EOR), Dutch Payroll Administration, and 30% Ruling Application services. The right support depends on your organisation’s operational needs, while responsibility for lawful data processing remains with the relevant controller.

Discuss your Dutch employment and payroll requirements with ICSPayroll. A clear operational plan can help your organisation move forward with greater confidence.

Frequently Asked Questions

Can the employer monitor, access, review the employee’s electronic communications?

Yes, but monitoring must serve a defined workplace purpose and respect employee privacy. For example, an employer may review work email to investigate a documented security concern, while broadly inspecting private messages may be disproportionate. Dutch employers must tell staff about email and internet policies and inform them in advance if investigation equipment is used. The policy should explain the reason and scope of monitoring.

Does an employee have the right to access all data the employer holds about them?

Employees have the right to access their personal data, but this does not automatically mean they can access every company document. A request might cover personal information in payroll records, performance notes, or correspondence. The employer should identify information relating to the employee and respond through its established request process. A clear inventory of personnel systems helps locate relevant data without confusing personal information with general business records.

Does the GDPR apply directly in the Netherlands?

Yes. The GDPR is a European Union regulation that applies directly in the Netherlands and other EU Member States. It became directly applicable on May 25, 2018, according to the European Union. Dutch organisations therefore apply its requirements to personal data processing, alongside national rules in the Dutch Implementation Act. For an employer, this means employee records fall within the same European framework as other personal data handled by the organisation.

How long can an employer retain employee data after the employment relationship ends?

Retention depends on the record’s purpose and any applicable legal duty. Dutch employers typically retain personnel files for up to two years after employment ends. Payroll and fiscal records have a separate statutory retention period of seven years. These periods are not one blanket deadline: distinguish personnel documentation from records needed for tax obligations, then remove or anonymise information when no purpose or legal requirement remains.

How quickly must an organisation answer a request for access?

An organisation must respond to an employee’s access request within one month. The request concerns personal data the organisation holds about that employee, such as information in personnel or payroll systems. A practical process should record when the request arrived, identify the systems and teams holding relevant data, and coordinate the response before the deadline. Centralised request handling helps prevent records being missed across departments.

What are the consequences of an employer breaching the AVG?

A breach can lead to corrective action or a fine from the Autoriteit Persoonsgegevens. The authority may impose GDPR fines of up to 4% of annual worldwide turnover or EUR 20 million, whichever is higher. An employee who suffers damage from an infringement may also claim compensation in civil court under Article 82 GDPR. The outcome depends on the infringement, its effects, and the organisation’s response.

What does ‘processing’ involve?

Processing covers operations performed on personal data, not only collecting it. For example, entering a new employee’s bank details, storing a signed contract, changing an address, sharing salary information with an authorised payroll processor, or deleting an old record are all forms of processing. The label applies whether the employer uses a digital platform or paper files. A useful test is whether an action handles information that identifies an employee.

What does an organisation need to have in place?

An organisation needs a defined purpose and legal basis for each use of employee data, clear information for staff, and a record of processing activities. It should also have appropriate security measures, processor agreements when suppliers handle data, and processes for access requests and breaches. For example, a payroll workflow should specify who can access salary records, why they need access, and how the organisation handles those records.

Article by

Joost Hubregtse

Joost Hubregtse is Director of ICS Staffing & Payroll B.V., the wholly owned subsidiary of Intercompany Solutions behind ICS Payroll. He is responsible for Employer of Record and Dutch payroll services: employment contracts, wage tax and social security filings, holiday allowance, pension, sick leave and CAO compliance, with onboarding possible within 48 hours.