How do you handle personal data requests from former or prospective employees?

1 Know your obligations

Depending on where you operate and where your employees are located, you may have different legal obligations to respond to employee personal data requests. For example, under the GDPR, you have to provide the requested information within one month, unless the request is complex or excessive. Under the CCPA, you have to respond within 45 days, with a possible extension of another 45 days. You also have to inform employees about their rights and how to exercise them in your privacy notice or employee handbook. Make sure you are familiar with the applicable laws and regulations and update your policies and procedures accordingly.

2 Verify the identity

Before you disclose any personal data to a requester, you have to verify their identity and authority. This is to prevent unauthorized access, fraud, or identity theft. You can ask the requester to provide proof of identity, such as a copy of their passport or driver's license, or to answer some security questions that only they would know. You can also ask them to specify the type and scope of data they are requesting, such as their employment records, performance reviews, or payroll information. If you have any doubts or concerns about the identity or legitimacy of the requester, you can ask for more information or decline the request.

3 Locate and review the data

Once you have verified the identity and authority of the requester, you have to locate and review the data that they are requesting. This may involve searching through various databases, systems, files, or archives, depending on how you store and manage your employee data. You may also have to consult with other departments or third parties that may have access to or process the data, such as human resources, payroll, or IT. You have to review the data to make sure it is accurate, relevant, and complete, and to identify any data that may be exempt from disclosure, such as confidential information, trade secrets, or personal data of other employees.

4 Provide or modify the data

After you have located and reviewed the data, you have to provide or modify the data according to the request. You can provide the data in a format that is easy to understand and access, such as a PDF, spreadsheet, or email. You can also provide a summary or explanation of the data if necessary. If the requester asks to correct or update their data, you have to make the changes and confirm them with the requester. If the requester asks to delete their data, you have to erase or anonymize the data and inform the requester of the consequences, such as losing access to certain services or benefits.

5 Document and monitor the process

Finally, you have to document and monitor the process of handling employee personal data requests. You have to keep a record of the requests, the responses, and the actions taken, as well as the reasons and evidence for any decisions. You also have to monitor the timeliness, quality, and compliance of the process and report any issues or incidents to the relevant authorities or stakeholders. You can use tools, such as software, templates, or checklists, to help you streamline and automate the process and ensure consistency and accuracy.