GDPR for HR: exits and deletions.

The 4 legal bases you must know

1. Performance of contract (art. 6.1.b GDPR): payslips, withholding, contracts. While the relationship lasts + statutory periods.
2. Legal obligation (art. 6.1.c): social-security filings, tax forms. Periods set by labour law and tax authority.
3. Legitimate interest (art. 6.1.f): performance history, exit-interview notes. Until limitation runs out.
4. Consent (art. 6.1.a): photo on intranet, optional extra data. Revocable at any time.

Real retention periods (Spain)

• Employment contracts: 10 years from termination (civil limitation, art. 1964 CC).
• Payslips and social-security filings: 10 years (Law 30/2015).
• Tax form 145: 4 years (tax limitation, Law 58/2003).
• Time-recording: 4 years (RDL 8/2019).
• CVs of non-hired candidates: max 2 years (Spanish DPA guidance).
• Performance reviews: until civil limitation (4 years from the last).
• Corporate email: closed on exit day; backup retained 6 months per internal policy.
• Photo on web/LinkedIn: removed within 30 days (consent revoked on exit).

What must happen the day someone leaves

1. Immediate access lockdown (SSO, tools, buildings).
2. Corporate email closure, 30-day forward to manager.
3. Backup of project data to new owner.
4. Personnel file flagged "employee terminated" with date.
5. Auto-retention triggered: system flags every datum with its period.
6. Photo and data removed from internal/external publications within 30 days.
7. Former employee notified of what data is retained and why.

Former-employee rights

• Access: they have the right to know what you have. Deadline: 1 month.
• Rectification: if something's wrong, you fix it. Deadline: 1 month.
• Erasure: only if the legal basis no longer applies. Last year's payslip is not deleted.
• Restriction: during a dispute, the data is frozen.
• Portability: only for data they provided themselves.

Real Spanish DPA fines 2024–2025

Published case (PS/00342/2024): 60-person company fined €32,000 for keeping 14 former employees' emails accessible for 18 months after exit. Case PS/00518/2024: consultancy fined €60,000 for missing the deadline on an access request.