Art.88 Processing in the context of employment
Article 88 is addressed to Member States: it lets national law or collective agreements set more specific rules for handling workers' personal data across the employment relationship, from hiring through the running of the contract, work organisation, equality, health and safety, protection of property and the exercise of employment rights, to its end. An employer therefore identifies, for every country in which it employs people, which national employment-context rules made under this article apply, and applies the safeguards those rules must contain for dignity, legitimate interests and fundamental rights: openness about the processing, data passed between companies in the same group, and any system used to monitor people at work. The article is not itself a lawful basis; the Article 6 basis, and an Article 9 condition where special category data is involved, is still needed (CJEU C-34/21 found that a national rule which only restates the general conditions of the Regulation is not a more specific rule under this article).
Source: GDPR, Art.88. The statement above is our statement of the clause, read from the published text and cited so you can check it against the official text, not the instrument verbatim. Open GDPR in the compliance library.
Many articles apply only where their condition is met (a data protection officer under Article 37, an impact assessment under Article 35, a representative under Article 27); the condition is in each statement.
These are the artefacts auditors commonly ask for on this requirement, our guidance rather than text from the standard. Your assessor decides what is sufficient in your context, and asks for samples across the period when a report covers one.
system holds itEvidence a system already holds
none for this control
periodic reviewEvidence produced at each review
- Records of intra-group transfers of HR data with the group arrangement that governs them · HR system / LMS
governing documentDocuments that govern the control
- A per-country register of the national employment data rules and collective agreements the employer relies on, each cited to its provision · Vendor register / contract repository
- Works agreements or collective agreements covering monitoring systems, with their scope, date and signatories · Policy repository / GRC workspace
- Employee privacy notices that name each monitoring system, its purpose and its retention · Policy repository / GRC workspace
- The Article 6 basis (and Article 9 condition where relevant) recorded for each HR processing activity alongside the national rule · HR system / LMS
First move
Common gaps auditors find
- A national employment data provision cited as the lawful basis on its own, with no Article 6 basis recorded
- Monitoring tools introduced in one country under a policy written for another country's law
- No record of which works agreement covers which monitoring system
- HR data shared across group companies with no documented arrangement
Do this for your whole sheet
Paste the rows you run your controls from and get this mapping for every control at once, with the periodic-review ones flagged and a first move per row. No account for the first run.
Build my evidence sheet