[null, {"document_url": "https://blog.clickboarding.com/gdpr-and-onboarding-are-you-ready", "unformatted_src": "https://blog.clickboarding.com/hubfs/matthew-henry-87142-unsplash%20%281%29-028011-edited.jpg", "src": "https://blog.clickboarding.com/hubfs/matthew-henry-87142-unsplash%20%281%29-028011-edited.jpg", "formatted_filename": "matthew henry unsplash edited"}, null, {"document_url": "https://blog.clickboarding.com/gdpr-and-onboarding-are-you-ready", "unformatted_src": "https://blog.clickboarding.com/hs-fs/hubfs/Drew%20K.png?width=100&height=100&name=Drew%20K.png", "src": "https://blog.clickboarding.com/hs-fs/hubfs/Drew%20K.png?width=100&height=100&name=Drew%20K.png", "formatted_filename": "Drew K", "alt_text": "Drew Kapla", "rendered_width": 100, "rendered_height": 100}, null, null]
GDPR and Onboarding - Are You Ready?

by Drew Kapla Apr 06, 2018 Compliance 0 Comments 
If I were to over-simplify, the General Data Protection Regulation (GDPR) is legislation that regulates data protection and privacy for individuals within the European Union (EU.) The goal here is to give people power over their own personal data while unifying the EU regulatory environment for international business.

As a business, if you have recruiters/ hiring managers/ candidates/ applicants/ employees associated with the EU - or if you export any personal data outside the EU - you will be impacted and must comply with the new regulations. The question is - are you ready?

If your answer is "no!?!?" then you're in the right spot. I'll walk you through what you need to know in terms of onboarding and...

PLEASE NOTE: There are a lot of grey areas within GDPR and the following advice is for informational purposes only. So, if you believe that GDPR could be pertinent to your organization and want legal advice - reach out to your legal team.

Privacy and Consent

When people say "privacy" in terms of GDPR and onboarding, they're really saying that you’re required to inform new hires about what you’re doing with their data. The best way to do that is through a privacy policy written in clear, plain language. If your legal team enjoys reading it, then you haven’t done a good enough job. Keep it short, simple, and to the point.

Your privacy policy - at a minimum - must cover:

This is where consent comes in. After reading that privacy policy, new hires will need to decide if they still want to go through with the process.  If they consent to having their personal data collected and processed, then they'll begin onboarding.  It’s also important to note that the new hire can withdraw their consent at any time. The processor (i.e. the onboarding provider) MUST respect the new hire's decision and put the hire on hold. At that point, the new hire can come back to you and continue with onboarding, or ask to be removed from the system.

Data Access and Correction

The big question we've been getting lately is: "What level of access should we grant hires when it comes to their personal data?"

Short answer: complete access. It’s their data, and they get to access it - and adjust it - anytime they want to.

The great part about the Click Boarding platform is that the same portal they use to enter this data is the same portal they use to get access to view that data. If they notice that something's wrong, we let them update it via a new process. Want to see how? Click here.

Data Export

What happens if the hire wants to export their information? What does that process look like?

At this moment, if a new hire in the EU wants a copy of their data, then the onboarding provider or employer can - and often will - make them pay for it. It usually costs about $15, and that's more than enough for most people to say "Nope! Pass."

After May 25th, the new regulation states that processors (the onboarding provider) and/or controllers (the employer) must provide copies of this data to the new hire free of charge when they request it.

At Click Boarding we go about this one of two ways:

Data Deletion

You may have heard the term “right to be forgotten” tied to GDPR. But what does it mean? Essentially, the data owner has the right to request data deletion. This is a very real thing that your provider has to account for. At Click Boarding, we built the platform with the idea that that’s not our data. It belongs to the hire. It's been a part of our culture since the very beginning - and it will continue to be a part of our culture as we move forward.

In terms of GDPR and onboarding, the right for the owner of the data to request its deletion must be honored “without undue delay." So, either you or your provider has to accommodate ASAP.

With one exception.

Country specific forms have become an area of contention when it comes to data deletion and the GDPR. For example: In the United States, all new employees must provide employment verification (Form I-9) prior to starting that job. With it being a federal mandate, we can’t delete that document without putting our clients into a hard spot if they get audited. After confirming with legal, Click Boarding has decided NOT to delete the Form I-9 until a clearer interpretation of the regulation is released. If you aren't already a Click Boarding client, I strongly suggest checking with your current provider to see what their process is sooner rather than later.

Other Things to Consider

When it comes to GDPR and onboarding:

Have more questions about how Click Boarding is handling GDPR? Drop us a line!
 Written by Drew Kapla

Drew oversees Click Boarding’s technology vision to meet the ever-changing market needs. He is responsible for the software platform development and delivery as well as the company’s security and technology infrastructures.


Electronic Form I-9 / E-Verify Database…. Beware of the Hidden Liability
11 timely insights by compliance and onboarding experts
