Employee Data Privacy: A GDPR Guide for Deskless Teams

Protecting employees' personal data is a legal obligation for every employer in the European Union. Under the General Data Protection Regulation (GDPR), HR teams are responsible for every piece of employee information they collect, from a phone number to a medical certificate.

For companies with deskless workers, people who don't sit at a desk, don't have a corporate email address and rarely log into company systems, employee data privacy comes with specific challenges. These workers usually rely on their personal phones to stay in touch with the company, which makes it easy for data to end up in places the company doesn't control.

This guide explains what the GDPR requires from employers across the EU, where deskless teams create extra risk, and the practical steps HR can take.

What counts as employee personal data?

Under the GDPR, personal data is any information that identifies an employee directly or indirectly. In an HR context, this typically includes:

• Identification data: name, ID or passport number, date of birth, photo.
• Contact data: address, personal phone number, personal email.
• Employment data: role, department, work location, schedules, performance reviews.
• Financial data: bank details, salary, payslips.
• Special category data: health information such as sick notes, trade union membership or biometric data. This data has stricter protection and can only be processed in specific circumstances.

Which legal basis applies to employee data?

Every processing activity needs a legal basis under Article 6 of the GDPR. For employers, the most common ones are:

• Performance of the employment contract: processing needed to pay salaries, manage schedules or assign tasks.
• Legal obligation: processing required by labour, tax or social security law.
• Legitimate interests: processing that is necessary for the company and proportionate to the impact on the employee, such as basic security measures.

Consent is rarely a valid basis in employment. European data protection authorities consider that, because of the power imbalance between employer and employee, consent is unlikely to be freely given. Relying on it for core HR processes is a common compliance mistake.

National rules still matter

Article 88 of the GDPR allows each member state to adopt more specific rules for the employment context. In several countries, such as Germany or the Netherlands, works councils must be consulted before the company introduces tools that can be used to monitor employees. Before rolling out any new HR or communication tool, check the rules that apply in each country where you have staff.

The GDPR principles applied to HR

1. Lawfulness and transparency: tell employees what data you collect, why and for how long, in plain language.
2. Purpose limitation: use data only for the purpose it was collected for.
3. Data minimisation: collect only what you actually need. Read more in our article on why HR shouldn't store employees' personal phone numbers.
4. Accuracy: keep data up to date and let employees correct it.
5. Storage limitation: delete data when it is no longer needed. The GDPR doesn't set fixed periods; they depend on the purpose and on national retention laws.
6. Security: protect data against loss, leaks and unauthorised access.
7. Accountability: be able to prove compliance, for example with a record of processing activities.

Employees' rights over their data

Employees have the same GDPR rights as any other data subject. They can:

• Access the data the company holds about them.
• Correct inaccurate data.
• Request deletion when the data is no longer necessary.
• Restrict or object to certain processing.
• Receive their data in a portable format in some cases.

Employers must respond to these requests without undue delay, and in principle within one month.

Why deskless teams create extra privacy risks

Three situations tend to go wrong with frontline and deskless teams:

• Personal devices: most of these workers use their own phones, which IT cannot see or manage.
• No privacy training: workers often don't know what the GDPR is or what the company's data policies say.
• Consumer messaging apps: when companies default to WhatsApp or similar tools, personal data such as phone numbers and work information circulates with no traceability and no way to recover it. We explain the consequences in the GDPR fine you don't see.

Personal phones and BYOD

When employees use their own phones for work, the employer should only manage work data and work apps, never the personal content of the device. Keep a clear separation: a dedicated work app, access that can be removed when someone leaves, and no need for colleagues or managers to know each other's personal phone numbers.

Employee monitoring

Monitoring employees, for example through location tracking or activity logs, is only acceptable when it is necessary, proportionate and announced in advance. Systematic monitoring usually requires a data protection impact assessment (DPIA) before it starts, and in many countries it also involves the works council.

Data breaches and fines

If employee data is leaked or lost, the company must notify its data protection authority within 72 hours of becoming aware of the breach, unless the breach is unlikely to put people at risk. Serious infringements of the GDPR can lead to fines of up to 20 million euros or 4% of global annual turnover, whichever is higher.

Practical checklist for HR

1. Use one platform, not five. Every extra app is another place where data can leak.
2. Limit who sees what. Not every manager needs access to every employee's data.
3. Write plain privacy notices. When you collect data through a form, explain clearly what it is for.
4. Review your legal bases. Don't rely on consent for core HR processes.
5. Clean up old data. Audit what you store at least once a year and delete what you no longer need.
6. Plan offboarding. Remove access to work data on an employee's last day.
7. Train your teams. One practical hour is enough for workers to understand the basics.

How Ommnio handles employee data

To work as an internal communication channel, Ommnio only needs a few basic details per employee, entered by the company: name and surname, department or work area, and role.

Companies can add other information depending on what they want to use the platform for, such as phone number, preferred language, work location, ID number, payslips or medical certificates. None of these are required. They are optional features each company can activate to digitize those processes.

The platform stores data on EU servers, lets you control access permissions by role, and lets you remotely deactivate users who have left the company. Workers don't need to create external accounts or register on multiple systems, which limits how much data is spread around in the first place.

Frequently asked questions

Do employees have a right to privacy at work?

Yes. In the EU, employees keep their right to data protection and privacy at work. Employers can process their data only with a valid legal basis, for a specific purpose and in a proportionate way.

Can my employer see what I do on my personal phone?

As a rule, no. An employer can manage work apps and work data, but accessing the personal content of an employee's own device is very difficult to justify under the GDPR.

Can employers rely on employee consent?

Only in exceptional cases. Because of the imbalance of power in the employment relationship, consent is rarely considered freely given. Most HR processing relies on the contract, a legal obligation or legitimate interests.

How long can an employer keep employee data?

Only as long as it is needed for its purpose. The exact periods depend on national labour, tax and social security laws, so they differ between countries.

Does the GDPR apply in the UK?

After Brexit, the UK applies its own version, the UK GDPR, which follows the same principles. Companies with staff in both the UK and the EU should check both frameworks.