Know what you hold
- Identity and contact data
- Financial data — bank account, salary, tax declarations
- Health data — insurance, medical certificates, accommodations
- Biometric templates used for attendance
- Performance, disciplinary and grievance records
Five controls that matter most
- Collect only what a defined process needs
- Restrict access by role, and review the access list every quarter
- Encrypt data at rest and in transit, including backups
- Log every view and export of a sensitive field
- Delete on a retention schedule rather than keeping everything forever
Biometric data deserves extra care
Store templates, not images, keep them encrypted, restrict who can enrol or delete, and tell employees clearly what is captured and why. Provide an alternative marking method where biometric capture is not possible.
Incident response in four steps
- Contain — revoke the access or isolate the system
- Assess — what data, whose data, how many records
- Notify — affected people and any authority the law requires
- Correct — fix the control that failed and record the change
How EmplAI supports this
Records are encrypted with strong cryptography at rest and in transit, sensitive fields are masked unless the viewer's role permits, every access is logged, and retention rules can be applied per document type.
This resource is shared for general guidance. Rules, rates and due dates change and vary by state and establishment — confirm the current position with your advisor before acting on it.
Back to the resource library