I am making a web-based project management tool that stores employee salaries.

What are the implications with GDPR to store this info?

Do we need consent from them?

  • 1
    Are the employees in question employees of the software company, or are they employees of the company's clients or customers?
    – phoog
    Commented Aug 19, 2018 at 15:03
  • They are employees of the company I work for (I am part on the in-house dev team)
    – Hemm K
    Commented Aug 21, 2018 at 15:12

3 Answers 3


What are the implications with GDPR to store this info?

They are many. GDPR is broad and complex. The other answers cover this pretty well.

There are probably also privacy implications that may not be covered by GDPR. In addition to GDPR, you also need to consider whether the use of employee data in this application is governed by national legislation in each country where the company operates.

As others have noted, you may want to consult a lawyer.

Do we need consent from them?

This is rather easier to answer. The GDPR requires (under Article 6) that data processing be lawful. There are several conditions that satisfy this requirement, of which only one is consent of the data subject:

Article 6

Lawfulness of processing

  1. Processing shall be lawful only if and to the extent that at least one of the following applies:

(a) the data subject has given consent to the processing of his or her personal data for one or more specific purposes;


The last one probably covers the requirements of an employer who wants to use employees' salary information to make business decisions:


(f) processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data....

So the answer to whether you require consent depends on the purpose of the tool. But for the most part it is hard to imagine any "interest or fundamental right or freedom" of an employee that would override the employer's "legitimate interest" in using salary information for planning.

For a more rigorous determination of this question, again, you should talk to a lawyer, who will take into account not only the text of the regulation but also any relevant judicial findings. The lawyer will also need a more detailed description of the application, its purpose, and the data that it processes.


Just remember that my information must not be shown to anyone who doesn't have a good reason to see it, so your software mustn't do this while working as designed, and you must make sure that your software can't be hacked to do this.

Consent doesn't really come into it. I'm in a business relationship with the employer, therefore the employer needs to know some data about me, whether I consent or not. For data that the employer doesn't need to know, they generally shouldn't ask for my consent but just not store that information.

  • An employer could have uses for its employees' information that are not required by the employer/employee relationship, and consent would be required in such cases. Do you know what PM is? Perhaps it is an example of such a use. In fact, it's not even obvious from the question that the employer is the one storing the employees' salaries. The employees might be employed by clients of the data controller. They might be employed by unrelated parties. The question is very unclear.
    – phoog
    Commented Aug 18, 2018 at 15:31

If the employees are EU residents, or if the company handles data of EU residents, or if the company is located in the EU, the GDPR applies. It covers much more than just getting consent, and in fact consent may not be necessary.

  • You have to document your data processing and to show those documents to the authorities on demand. You may have to designate a Privacy Officer in your company and ensure that this employee has the necessary information for the job.
  • If you use third parties for data processing, you have to verify that they are GDPR-compliant and make contracts to ensure it stays that way.
  • You may have to report certain incidents.
  • You must use data only for legal purposes. Explicit consent is one way to get the permission to use data, there are others.
  • You must be prepared to answer questions about the data you hold, and to delete data on demand, unless there is a legal reason to keep it. (For instance, one cannot simply tell a webshop to "delete an account" if some of the data must be kept for tax purposes.)

I am not a lawyer and I cannot provide legal advice, but to me it seems that you do need a lawyer to answer your questions.


You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .