Advising on people while employing them: the wall that has to hold
An HR consultancy holds two categories of personal data that must never mix: its own employees' records, and data about its clients' employees and candidates. The obligations differ, the lawful bases differ, and in a dispute the firm has to demonstrate which was which.
Designing that separation into the system is far cheaper than retrofitting it. In practice it means a client's data sits in its own space with its own retention clock, the internal HR record is never joined to a client dataset, and any export states which population it covers. The consultants who move between the two see only what each engagement entitles them to.
- Client data isolated per engagement, with its own retention clock
- Internal employee records never joined to client datasets
- Every export labelled with the population it covers
- Access granted per engagement, revoked when it closes