Personal data
Employers process a lot of personal data of their employees. We also refer to this as personnel data.
On this page
Employers store personnel data in a personnel file.
Sometimes employers need or want to transfer personnel data to other organisations or persons within or outside their organisation. You are not allowed to do this without a good reason. This is subject to certain rules, because employees have given their data in confidence.
Some processing of personnel data can be very intrusive, which is why taking privacy in the workplace into account is very important. The works council plays a major role in this.
Quick answers
For citizens
8 questions and answers
How long can my employer retain my personnel file?
Your personnel file contains different types of data. Your employer may retain some data longer than other data.
Sometimes, your employer must keep certain data for a set period of time. In that case, it will be stated in the law. If this is not the case, your employer is generally allowed to retain data for 2 years after you have left the company.
If the data are no longer needed before that date, your employer must remove the data immediately. See also: Retention personnel file.
Can my employer transfer my personnel data to the police?
Your employer can only provide the police with your data if the police:
- explicitly and specifically asks for this; and
- indicates under which statutory regulations your employer must provide data, such as by order of the examining magistrate in criminal cases.
Can my employer transfer my personnel data to a bailiff?
Yes. If the judge determined that your wages will be attached, your employer is obliged to provide certain information about you to a bailiff.
If a bailiff asks for information, your employer can ask for the cause list number and the date of the judgment (of the wage attachment) before your employer provides the requested information.
6) Can my employer transfer my personnel data to a lawyer or legal aid representative?
This is allowed in the event of an employment dispute or dismissal.
7) Can my employer register and make public my secondary activities?
If you work for the government, your employer has the option to register your secondary activities and make them public. This is stated in the Central and Local Government Personnel Act. Organisations outside the government can also implement such a policy. They do need the consent of the works council for this.
However, your employer may not oblige you to report all your paid and unpaid secondary activities. This must be limited to the necessary positions and relevant secondary activities. It is also not necessary to disclose all information provided, such as the income from secondary activities.
8) How do I find out whether my employer has transferred my data?
Your employer must inform you about transferring your data. If you suspect this did not happen, you can request access to your personnel file. The right of access also includes your employer informing you who may have received your personnel data.
Can I access my data at an organisation, or have them rectified or removed?
Yes, you can. If an organisation uses your personal data, you have a number of rights. This will ensure that you keep a grip on your personal data. These are the most important privacy rights:
- You have a right of access to your personal data.
- Does it turn out that data of you are incorrect? Or that certain data are missing? Then you can ask for rectification of your data (adjustment or addition).
- In some cases, you can also ask for erasure of data.
Do you want to know what other rights you have? Check out Privacy rights under the GDPR.
What can I do if I have a question or complaint about the use of my personal data?
Always submit your questions or complaints to the organisation that uses your personal data first. Do you have a complaint and are you and the organisation unable to work it out together? Then you can lodge a complaint with the Dutch Data Protection Authority (DPA).
For organisations
1 question and answer
Do I have to apply for a permit for sharing criminal data of my staff within my group of companies?
No, but only if you meet these two conditions:
- You are only permitted to share criminal data on staff that is employed within your group.
- You must have asked the works council for consent before sharing the criminal data. This follows from Article 27, paragraph 1 under k of the Dutch Works Councils Act.
