HR data privacy glossary

Data protection foundations

The law and the mechanisms that make data movement lawful.

• GDPR (General Data Protection Regulation)The GDPR (General Data Protection Regulation) is the European Union's data protection law, governing how organisations collect, use, store and transfer personal data, including employee data, with fines reaching up to 4% of a company's global annual turnover.
• Data Processing AgreementA Data Processing Agreement (DPA) is a binding contract between a data controller, such as an employer, and a data processor, such as an HR platform or EOR, that sets out how employee personal data may be processed in line with GDPR and similar privacy laws.
• Standard Contractual ClausesStandard Contractual Clauses (SCCs) are pre-approved contract templates issued by the European Commission that give organisations a lawful basis for transferring personal data, including employee records, from the EU to a country that lacks an adequacy decision.
• Cross-Border Data TransferA cross-border data transfer is the movement of personal data from one country to another, such as sending payroll records from a European subsidiary to a United States head office, which triggers privacy-law obligations under regimes like the GDPR, LGPD and PIPL.

Employee data systems and records

Where people data lives and how long it is kept.

• Human Resource Information SystemA Human Resource Information System (HRIS) is the software system where an organisation stores and manages its core people data, such as employee records, job details, pay information and time off, and from which it runs HR reporting and processes.
• Documentation Retention ScheduleDocumentation retention schedule is a policy that sets, for each category of employment record, how long it must be kept, in what format, and under what security controls, driven by the statutory and contractual retention rules that apply in every country an employer operates in.
• Audit TrailAn audit trail is the organised body of documentation, contracts, questionnaires, invoices and written reasoning, that a business keeps to show its worker classification and payroll decisions were made in good faith and can be reconstructed if a tax or labour authority reviews them.
• Employee HandbookAn employee handbook is a formal document that sets out an organisation's employment policies, workplace standards and legal notices for its staff, working at once as a compliance instrument, a day-to-day management reference and evidence that employees received and acknowledged required policy disclosures.
• Employee onboardingEmployee onboarding is the process of legally and operationally setting up a new hire, covering employment contracts, payroll enrolment, statutory benefits, and right-to-work verification.

Governance and accountability

Who owns data privacy and how it is proven.

• Global HR Governance FrameworkA global HR governance framework is the structured set of standards, ownership and decision rules an organisation uses to manage employment consistently across multiple countries, defining which policies are fixed globally and which adapt to regional or local labour law.
• Compliance FrameworkCompliance framework is the structured system an organisation uses to track, interpret and act on employment, tax and data obligations across every country where it employs people, assigning who owns each obligation and how often it is checked, so nothing falls through the gaps.
• Audit ReadinessAudit readiness in global payroll is the state in which a company can produce, within a defined response window, complete and accurate payroll records, tax remittance proof, worker classification documents and currency conversion records for any jurisdiction and any past pay period under review.
• Jurisdiction MatrixA jurisdiction matrix is a structured reference that maps every location where an employer operates to the specific employment-law obligations, such as wage rates, leave entitlements and posting requirements, that apply in each of those jurisdictions.
• Right-to-Work VerificationRight-to-work verification is the mandatory pre-employment step of confirming a prospective worker holds legal permission to work in the country of hire, through a visa, work permit, or proof of citizenship, before the employer or Employer of Record can activate them in payroll.

How these terms relate

Employee data privacy has a foundation and a machinery. GDPR is the foundation: it sets the standard for how personal data may be collected, stored and used, and it applies wherever EU residents' data goes. The machinery makes lawful movement possible. A Data Processing Agreement binds anyone processing that data on your behalf, Standard Contractual Clauses cover transfers to countries without equivalent protection, and cross-border data transfer is the act those tools are built to control. Underneath, an HRIS is where the records actually live, whilst a retention schedule, a clean audit trail and right-to-work checks decide how long data is kept and prove it was handled properly. A governance framework ties it together, assigning ownership so privacy is a standing practice rather than a scramble when a request or breach arrives.

Related glossaries

• Global HR compliance glossary
• Employer of Record glossary
• Global payroll glossary