GDPR requirements for leave records in Germany mandate strict data protection, limited retention periods, and specific employee rights regarding their leave data.

Key Takeaways

  • Leave data is personal data under GDPR
  • Retention period limited to necessity
  • Employees have access and deletion rights
  • Specific legal basis required for processing
  • Documentation of processing activities mandatory

GDPR Requirements for Leave Data

Data Protection Principles

  • Lawfulness: Valid legal basis required
  • Purpose limitation: Specific purposes only
  • Data minimisation: Only necessary data
  • Accuracy: Must be kept accurate
  • Storage limitation: No longer than necessary
  • Integrity: Appropriate security measures
  • Section 26 BDSG: Employment relationship necessity
  • Section 6(1)(b) GDPR: Contract performance
  • Section 6(1)(c) GDPR: Legal obligation
  • Specific consent rarely appropriate in employment

Employee Rights

  • Right of access (Article 15 GDPR)
  • Right to rectification (Article 16 GDPR)
  • Right to erasure (Article 17 GDPR)
  • Right to restrict processing (Article 18 GDPR)
  • Right to data portability (Article 20 GDPR)

Data to Collect

Leave Request Data

  • Employee identification (name, ID)
  • Leave type (annual, sick, parental)
  • Dates requested (start and end)
  • Duration (number of days)
  • Reason (if legally required)

Leave Approval Data

  • Approval decision (approved/denied)
  • Approver identification
  • Date of decision
  • Any conditions attached
  • Alternative dates suggested

Leave Taken Data

  • Actual dates taken
  • Duration of leave
  • Balances before and after
  • Any carryover details
  • Payment information

Retention Periods

General Rules

  • No specific legal period for leave records
  • Necessity principle applies
  • Tax and social security requirements
  • Collective agreement provisions
  • Company policy considerations
  • Leave records: Current year + 3 years
  • Leave balances: Current year + 3 years
  • Approval decisions: Current year + 1 year
  • Medical certificates: 6 months after return
  • Parental leave: Duration + 3 years

Special Cases

  • Sickness records: 6 months after return
  • Maternity leave: Duration + 3 years
  • Works council: As per BetrVG requirements
  • Tax authorities: 10 years for financial records
  • Court cases: Until final decision

Employee Rights

Right of Access

  • Who: All employees
  • What: All leave data held
  • When: Within one month of request
  • Format: Structured, commonly used format
  • Cost: Free of charge (generally)

Right to Erasure

  • When: No longer necessary for purpose
  • Exceptions: Legal obligations, court cases
  • Process: Document erasure decision
  • Verification: Confirm erasure completed

Right to Rectification

  • When: Data is inaccurate
  • Process: Update and notify
  • Documentation: Record correction
  • Third parties: Notify if shared

Compliance Checklist

  • Legal basis documented
  • Purpose specified
  • Data minimisation applied
  • Retention periods defined
  • Employee rights process established
  • Security measures implemented
  • Documentation maintained
  • Staff training completed
You can take advantage of the free 14 days trial and explore Leave Balance.