Commentary to Article 88

Specific provisions on the protection of personal data in employment

Article 88 GDPR allows Member States to introduce more specific provisions to ensure the protection of rights and freedoms when processing personnel’s personal data in connection with employment, in particular for the purposes of:

• Recruitment
• Execution of the employment contract, including performance of obligations laid down in legislation or collective agreements
• Work management, planning and organisation
• Equality and diversity in the workplace
• Health and safety at work
• Protection of the employer's or customer's property
• Individual or collective exercise of rights and enjoyment of employment-related benefits
• Termination of the employment relationship

This legislation requires that the said provisions contain appropriate and specific measures to ensure that the dignity, legitimate interests and fundamental rights of the data subject are respected, in particular in terms of transparency of processing, transfer of personal data within a group of undertakings or a group of entrepreneurs carrying out joint economic activities, and monitoring systems in the workplace.

Has Poland introduced such legislation?

Poland has introduced several relevant provisions, concerning, for example:

• The scope of personal data that employers are entitled to request from job applicants or employees;
• Processing employees' biometric data;
• Processing personal data in relation to an employee's sobriety check;
• Processing personal data in connection with remote working;
• Processing personal data of individuals eligible for the WSBF;
• Monitoring used at the workplace (CCTV and other types) in accordance with the Labour Code, namely:
  • Employers must inform their personnel about the introduction of monitoring in a manner adopted at the given workplace. This must be done no later than two weeks before the start of monitoring.
  • The objectives, scope and manner of monitoring will be set out in a collective agreement, the work regulations or a notice if the employer is not covered by a collective agreement or is not required to establish work regulations.
  • Before an employee is permitted to commence their duties, the employer is obliged to furnish them with written information regarding the objectives, scope and manner of monitoring,
  • Employers are required to store video recordings for a period of no more than three months from the date of recording. In the event that the video recordings are deemed to be evidence in proceedings conducted under the law, or if the employer becomes aware that they may be used as evidence in such proceedings, this period shall be extended until the proceedings are legally concluded.
  • Employers may install video surveillance equipment in the workplace or the surrounding area, provided that it is deemed necessary to ensure the safety of employees, protect property or regulate production. The installation may also be necessary to safeguard confidential information that could be compromised if made public. Please note that the Labour Code stipulates the types of premises that are permitted for monitoring by employers.
  • Employers are permitted to introduce monitoring procedures for personnel’s email and other forms of communication only when it is necessary to ensure the organisation of work enabling full use of working time and the proper use of work tools made available to personnel.

Work on amending the Act on Higher Education and Science is underway

Work is underway on a draft amendment to the. The draft is currently at the consultation stage. The draft bill provides, among other things, that at the request of an employer who has reasonable doubts as to the accuracy of the data contained in a diploma, the relevant higher education institution shall confirm that the data in the diploma of completion of studies corresponds to the data contained in its records of the course of studies. According to the latest draft, the Act is scheduled to come into effect on 1 January 2026.

Read more

We write on an ongoing basis about personal data processing in the context of HR on HRlaw.pl. We have already covered the following issues:

Can an employer process an employee's private contact data?

Care leave - documentation required from the employer

Exit interviews and regulations on the processing of personal data

Remote work vs. personal data processing

Is the employer entitled to request employee disability information?

When will employers use employees' fingerprints?

Annual review of personal data processed for the purposes of the Workplace Social Benefits Fund