Personnel data

Employers process a lot of personal data of their employees. We also refer to this as personnel data.

On this page

  1. General information

Employers store personnel data in a personnel file.

Sometimes employers need or want to transfer personnel data to other organisations or persons within or outside their organisation. You are not allowed to do this without a good reason. This is subject to certain rules, because employees have given their data in confidence.

Some processing of personnel data can be very intrusive, which is why taking privacy in the workplace into account is very important. The works council plays a major role in this.

Quick answers

For citizens

10 questions and answers

What data can and cannot be included in my personnel file?

Your employer may keep all data in your personnel file that are necessary to perform the employment contract with you.

Such as your contact details, salary, a copy of your identity document, your citizen service number and reports of your assessment and performance reviews.

Your employer is usually not allowed to include data about your health, criminal data and data about your origin (ethnicity) in your personnel file. See also: Personnel file.

Who can access my personnel file?

Not everyone is allowed to just access your personnel file. Only people who need your data to do their work are allowed to do this. They include your direct manager or employees of the human resources department.

How long can my employer retain my personnel file?

Your personnel file contains different types of data. Your employer may retain some data longer than other data.

Sometimes, your employer must keep certain data for a set period of time. In that case, it will be stated in the law. If this is not the case, your employer is generally allowed to retain data for 2 years after you have left the company.

If the data are no longer needed before that date, your employer must remove the data immediately. See also: Retention of personnel file.

Can my employer transfer my personnel data to the police?

Your employer can only provide the police with your data if the police:

  • explicitly and specifically asks for this; and
  • indicates under which statutory regulations your employer must provide data, such as by order of the examining magistrate in criminal cases.

Can my employer transfer my personnel data to a bailiff?

Yes. If the judge determined that your wages will be attached, your employer is obliged to provide certain information about you to a bailiff.

If a bailiff asks for information, your employer can ask for the cause list number and the date of the judgment (of the wage attachment) before your employer provides the requested information.

Can my employer register and make public my secondary activities?

If you work for the government, your employer has the option to register your secondary activities and make them public. This is stated in the Central and Local Government Personnel Act. Organisations outside the government can also implement such a policy. They do need the consent of the works council for this.

However, your employer may not oblige you to report all your paid and unpaid secondary activities. This must be limited to the necessary positions and relevant secondary activities. It is also not necessary to disclose all information provided, such as the income from secondary activities.

How do I find out whether my employer has transferred my data?

Your employer must inform you about transferring your data. If you suspect this did not happen, you can request access to your personnel file. The right of access also includes your employer informing you who may have received your personnel data.

Can I access my data at an organisation, or have them rectified or removed?

Yes, you can. If an organisation uses your personal data, you have a number of rights. This will ensure that you keep a grip on your personal data. These are the most important privacy rights:

Do you want to know what other rights you have? Check out Privacy rights under the GDPR.

What can I do if I have a question or complaint about the use of my personal data?

Always submit your questions or complaints to the organisation that uses your personal data first. Do you have a complaint and are you and the organisation unable to work it out together? Then you can lodge a complaint with the Dutch Data Protection Authority (DPA).

For organisations

1 question and answer

Do I have to apply for a permit for sharing criminal data of my staff within my group of companies?

No, but only if you meet these two conditions:

  1. You are only permitted to share criminal data on staff that is employed within your group.
  2. You must have asked the works council for consent before sharing the criminal data. This follows from Article 27, paragraph 1 under k of the Dutch Works Councils Act.

Related themes and topics

Employment and benefits

Works council

Taking privacy in the workplace into account is very important. The works council plays a major role in this.
Go to subject
Employment and benefits

Monitoring employees

Employers may feel the need to monitor their employees. For example, when people work from home. Monitoring personnel is not always prohibited.
Go to subject
Employment and benefits

Sick employees

There are strict rules for recording and sharing information about sick employees.
Go to subject
Employment and benefits

Employment agency

An employment agency must adhere to the same privacy rules as other employers. Special rules do apply to the phase in which people register with an employment agency.
Go to subject