GDPR for Remote Hiring
Last reviewed November 2026
Definition
GDPR for Remote Hiring — GDPR for remote hiring is the application of EU Regulation 2016/679 to candidate and staff data when a business outside the EU engages EU-resident workers or uses EU-based providers. Territorial scope, lawful basis and transfers are the main questions.
GDPR for remote hiring means applying the EU General Data Protection Regulation (Regulation (EU) 2016/679) to the personal data of candidates and staff when a business outside the EU engages people who live in the EU, or when it uses an EU-based entity or provider. The Regulation does not mention remote hiring; what matters is Article 3 on territorial scope, the lawful basis for each use of employee data, and the rules on transfers.
When the GDPR applies to a non-EU employer
Article 3(1) applies the Regulation to processing in the context of the activities of an establishment of a controller or processor in the Union. Article 3(2) applies it to controllers and processors not established in the Union where processing of data subjects who are in the Union relates to offering goods or services to them or monitoring their behaviour in the Union. Hiring an EU resident is not listed in Article 3(2) as a trigger by itself. Whether recruiting or monitoring staff in the Union falls under 3(2)(b) is a legal question for an adviser. A local entity in an EU country may amount to an establishment under Article 3(1); take advice on your facts. An employer of record is a separate question to raise with the provider.
Lawful bases for employee data
Article 6(1) says processing is lawful only if at least one basis applies: consent; necessity for a contract with the data subject or steps before entering one; compliance with a legal obligation; vital interests; a public-interest task; or legitimate interests, unless overridden by the person’s rights and freedoms. In an employment setting the contract, legal-obligation and legitimate-interests bases are the bases that apply to employment data. RemoteStaffingWiki’s guidance is to record the basis for payroll, background checks, equipment tracking and monitoring separately.
Criminal-offence data and background checks
Article 10 allows processing of data about criminal convictions and offences only under the control of official authority or when authorised by Union or Member State law with appropriate safeguards. A comprehensive register of criminal convictions may be kept only under official authority. This is why checks that are routine in the US can be restricted in the EU; see international background checks for remote hires.
National employment rules: Article 88
Article 88 lets Member States provide, by law or collective agreement, more specific rules for employees’ data in the employment context, including recruitment, performance of the contract, management and organisation of work, health and safety and termination. Those rules must include suitable measures for transparency, intra-group transfers and workplace monitoring systems. Country rules therefore differ; read the relevant guide, such as Portugal, Poland, Romania or Bulgaria.
Transfers to a non-EU employer
Chapter V governs transfers of personal data to a third country. The European Commission says an adequacy decision lets data flow without further safeguards, and lists recognised countries including the United Kingdom (renewed December 2025), Japan, the Republic of Korea, Brazil, and the United States for commercial organisations participating in the EU-US Data Privacy Framework. Otherwise the Commission’s standard contractual clauses (Decision 2021/914) are one ground for transfer. See data processing agreement for the contract side.
UK GDPR
The UK has its own version, the UK GDPR, with the ICO as regulator. The UK GDPR keeps the joint-controller (Article 26) and processor (Article 28) duties. The Commission has treated the UK as adequate and renewed that in December 2025. Check the UK text separately rather than assuming it matches the EU text line by line.
Impact assessments
Article 35 requires a data protection impact assessment before processing that is likely to result in a high risk. Article 35(3) names three cases: systematic and extensive automated evaluation that produces legal or comparable effects on the person, large-scale processing of special categories or Article 10 data, and large-scale systematic monitoring of a public area. Supervisory authorities publish further lists under Article 35(4). The EDPB’s 2018 opinion on one such list notes that WP29 guidelines say processing meeting two of their criteria will in most cases need a DPIA. Employee monitoring tools are a remote-hiring example to check.
Penalties
Article 83 sets two tiers. Infringements of, among others, the controller and processor obligations in Articles 25 to 39 can bring fines up to EUR 10 million or 2% of worldwide annual turnover, whichever is higher. Infringements of the basic processing principles and lawful bases (Articles 5, 6, 7, 9), data-subject rights, and transfer rules (Articles 44 to 49) can bring fines up to EUR 20 million or 4%, whichever is higher.
| Step | Reference |
|---|---|
| Decide whether you or a provider are the controller for each data type | Articles 4 and 28 |
| Record the lawful basis for payroll, checks and monitoring | Article 6 |
| Confirm which criminal-record checks national law allows | Article 10; Article 88 national rules |
| Sign a processor contract with any provider | Article 28(3) |
| Choose a transfer ground for data moving outside the EU | Chapter V |
| Screen monitoring tools for a DPIA | Article 35 |
| Read the country guide and the pay transparency rules | Article 88; EU pay transparency |
For the pay side, see EU pay transparency in 2026.
Sources
- Regulation (EU) 2016/679 (GDPR), Articles 3, 6, 10, 28, 35, 83 and 88 (Publications Office)
- European Commission, Adequacy decisions
- European Commission, Standard Contractual Clauses (SCC)
- EDPB, Opinion 24/2018 on the draft list of the Danish supervisory authority regarding DPIA
- ICO, What are controllers and processors?
References checked on 1 November 2026
Related Terms
A data processing agreement (DPA) is the written contract between a controller and a processor that sets out how the processor may handle personal data on the controller’s behalf. Article 28(3) of the GDPR lists what it must contain.
Employer of RecordAn employer of record (EOR) acts as the employer for workers supporting a client business, administering employment and agreed services through a specified entity.
Local EntityA local entity is a legal body, such as a subsidiary or branch, that a foreign business registers in the country where it hires so the entity itself employs the staff. It is the alternative to using an employer of record.