If a company wishes to allow access to their system (e.g a new manager to view HR records, salary etc) before their employment start date, does this break any privacy, GDPR laws etc?

Lets say they sign off the contract and they are given access but before any background checks are conducted. As long as they are signed off, then is it acceptable? What if they are deemed not hire worthy before they start but have since seen some records? Are there any implications?

  • The issue is that the data is accessed for professional purposes. Which means that the new hire works for the company. Making the new hire work before his start date could run afoul of labour laws. And it could be a real mess if the new hire accesses the data but then never starts working for the company ("So you say that Mr. X did not work a single day here, yet he did access HR data for two weeks????")
    – SJuan76
    Jul 30, 2019 at 21:05
  • @SJuan76 would this apply if they have signed a contract which covers data privacy/IT policy? etc
    – User101
    Jul 31, 2019 at 12:04

1 Answer 1


The GDPR requires data controllers to use appropriate organizational measures to protect the data. It is the controller's job to decide which measures are appropriate, taking into account possible risks.

For an employment context, I'd think the important part is that anyone accessing this data is bound to discretion regarding the data they will see. Whether this is ensured by an employment contract or another legal mechanism is not important.

There is one subtlety though: employees of the controller act on behalf of the controller, and aren't a third party. In contrast, non-employees are third parties. They are either controllers of their own, or they are processors that serve the controller. If a controller takes on a processor, this requires a contract with certain items.

So while I think that an data controller can decide to give an employee access to some data under whatever circumstances the controller deems appropriate, they cannot give a not-yet employee such access. They would rather have to establish a subprocessing relationship with that person.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .