01

Identify the employee data your HR team holds

You can't protect data you haven't mapped. Employee information is often scattered across HR platforms, payroll systems, email, spreadsheets, physical files, and external vendors — including data on applicants and former employees, not just current staff.

Mapping these data flows is what surfaces privacy risk in the first place. Document how information is collected, stored, processed, and deleted at every stage of the employee lifecycle.

• Create an inventory of employee information
• Identify where each category of data is stored
• Classify information according to its sensitivity
• Identify which systems, departments, and providers handle it
• Include applicant data alongside current and former employees

02

Collect only what you actually need

More data isn't better HR — it's more risk. Every field on a form should have a clear business or legal justification. "It might be useful someday" is not a reason to collect something.

This principle — data minimization — matters most during recruitment, where background checks and application forms tend to accumulate more personal information than the role actually requires.

• Review information requested during recruitment
• Remove unnecessary fields from HR forms
• Check whether sensitive information is genuinely required
• Document the purpose for collecting key data categories
• Review whether existing records still need to be retained

03

Tell employees how their data is used

Employees shouldn't have to guess what happens to their information. A clear privacy notice should cover what's collected, why, how it's used, where it's stored, who might receive it, and how long it's kept.

For Sri Lankan organizations, these notices should be checked against current PDPA requirements and any applicable DPA guidance.

• Provide employees with appropriate privacy information
• Explain the purposes for collecting personal data
• Explain how information may be used or shared
• Identify relevant rights and processes for privacy requests
• Review privacy notices when HR processes or requirements change

04

Control access to HR records

Not everyone needs access to every HR record. Role-based access and least-privilege principles limit exposure to the people who genuinely need it for their job — nobody else.

Access reviews shouldn't be a one-time setup. Role changes, department moves, and offboarding all create opportunities for someone to keep access they no longer need.

• Define who can access different categories of HR information
• Use role-based permissions where possible
• Remove unnecessary access when responsibilities change
• Review access rights regularly
• Revoke accounts and permissions when employees leave

05

Protect digital and physical records

Access control is one layer. HR also needs to think about how data is protected at rest and in transit — encryption, access controls, audit trails, and monitoring, scaled to how sensitive the information is.

Physical records need the same discipline: employee documents shouldn't sit on desks or in unlocked cabinets where the wrong person can see them.

• Secure physical employee files
• Protect digital HR systems with appropriate security controls
• Encrypt sensitive information where appropriate
• Monitor important access and administrative activity
• Secure information when transferred between systems or parties

06

Review third-party HR providers

Payroll providers, recruitment platforms, background-check services, benefits administrators, and cloud vendors all process employee data on your behalf — which means every one of them is a privacy risk you inherit.

Vendor contracts should spell out data-protection requirements explicitly, not assume they're implied. For Sri Lankan organizations, third-party processing and any cross-border transfers should be assessed against applicable PDPA requirements.

• Identify every external provider that handles employee information
• Understand what information each provider receives
• Review contractual data-protection requirements
• Conduct appropriate vendor due diligence
• Establish procedures for reporting privacy or security incidents

07

Establish data retention and disposal rules

Keeping employee data forever isn't caution — it's risk with no upside. HR needs defined retention periods, aligned with legal requirements, company policy, and actual business need, plus a secure way to dispose of data once it's no longer needed.

• Define retention periods for different categories of HR information
• Identify records subject to specific legal retention requirements
• Establish secure disposal procedures
• Review former employee records periodically
• Build deletion or archival processes into HR systems

08

Prepare for a data privacy incident

Even strong controls don't prevent every incident — a lost device, a compromised account, an accidental disclosure. What separates a manageable incident from a damaging one is usually how prepared the response was, not whether the incident happened at all.

Sri Lanka's DPA is the relevant regulator here — consult the current PDPA, amendments, and DPA guidance when determining specific obligations after an incident.

• Establish an incident-response procedure
• Define responsibilities between HR, IT, legal, and management
• Establish internal escalation channels
• Document how incidents are investigated
• Identify applicable notification and reporting requirements
• Keep records of incidents and corrective actions

09

Train HR teams and managers

Technology can't compensate for a team that doesn't understand how to handle sensitive information. Every person who touches personnel data — not just HR specialists — needs training, covering document handling, access permissions, phishing awareness, appropriate data sharing, and what to do when something looks wrong.

• Provide privacy training to HR employees
• Train managers who handle employee information
• Explain appropriate data-sharing practices
• Include security awareness and phishing education
• Refresh training periodically
• Update training when policies or requirements change

10

Audit your HR data practices regularly

A privacy policy that's published and forgotten stops protecting anyone. Regular audits catch what documentation alone misses: outdated records, excess access permissions, unsecured data, weak vendor controls, and the gap between what's written down and what actually happens.

• Review HR data flows periodically
• Reassess privacy and security risks
• Review user-access permissions
• Check vendor compliance
• Test incident-response procedures
• Review retention and deletion practices
• Update policies when requirements change