HR data protection standards define precisely how companies must manage, retain, and secure employees' personal data in 2026. The CNIL 2026 framework is the reference for HR teams, DPOs, and data controllers. This guide covers legal retention periods, valid legal bases, security requirements, and applicable sanctions. Every HR or legal professional must master these rules to protect employees and avoid fines of up to €250,000.
1. What Are HR Data Retention Periods Under the CNIL 2026 Framework?
Since April 2026, the CNIL distinguishes two categories of retention periods: mandatory periods set by law and recommended periods that serve as good-practice benchmarks. This distinction is fundamental. A mandatory period applies without room for discretion, while a recommended period can be adapted to the company's context.
Here are the main periods to remember:
| Data type | Retention period | Nature |
|---|---|---|
| Employee file after departure | 5 years | Recommended |
| Payslip | 50 years | Mandatory |
| Badge logs | 3 months | Recommended |
| Video surveillance | 1 month | Mandatory |
| Unsuccessful applications | 2 years (5 years for evidential purposes) | Mixed |
Unsuccessful job applications deserve particular attention. They must be deleted at the end of the process but may be archived for 5 years for evidential purposes against potential discrimination, in accordance with Article L. 1134-5 of the French Labour Code. This rule often surprises HR teams who assume everything can be erased immediately.
Pro tip: Set automatic alerts in your HRIS for each data category. A retention period has legal value only if it is technically enforced, not merely documented.
Automatic purging and logical separation or physical separation in intermediate archiving are essential for compliance to be real. A tracking spreadsheet is not enough.
2. What Legal Bases Govern HR Data Processing?
The GDPR requires a specific legal basis for each data processing activity. In HR, three legal bases dominate:
- Performance of the employment contract: covers payroll, leave, performance reviews, and training management.
- Legal obligation: applies to social declarations, mandatory registers, and regulatory medical checks.
- Legitimate interest: used for premises security, internal fraud prevention, or dispute management.
Employee consent is largely ineffective in HR matters. The reason is simple: the contractual imbalance between employer and employee means consent is not freely given and is therefore legally invalid. An employee who refuses to sign cannot be penalized, which empties consent of its substance.
There are exceptions. Using a photo for an internal directory or badge may rely on consent, provided refusal has no professional consequences. This nuance must be documented in the processing register.
Pro tip: For each HR processing activity, ask: "If the employee refuses, can they be penalized?" If the answer is yes, consent is not the right legal basis. Choose contract performance or legal obligation instead.
Consent is never the preferred basis for HR data processing. Companies must identify the most appropriate legal basis for each data type.
3. How to Strengthen HR Data Management System Security?
HR system security rests on three technical pillars: encryption, access management, and access traceability. These three elements are inseparable.
Best practices to implement:
- Encryption at rest and in transit: all data stored in the HRIS and exchanged by email must be encrypted to recognized standards (AES-256 for storage, TLS 1.3 for exchanges).
- Fine-grained access control: each employee accesses only the data strictly necessary for their role. A payroll manager should not view disciplinary files.
- Comprehensive access traceability: every consultation, modification, or data export must be timestamped and logged.
- Vendor certifications: outsourced HR tools must hold ISO 27001, SOC 2 certifications, or HDS hosting for health data.
In 2026, strong emphasis is placed on access and action traceability as evidence in audits or incidents. Keeping precise records of access to sensitive data in the HRIS, with timestamps and justification, is crucial to secure proof during an inspection or dispute.
Access traceability is no longer optional. It is an evidential requirement the CNIL verifies during inspections. An HRIS without access logging exposes the company directly to a formal notice.
4. What Are the Risks and Sanctions for Non-Compliance?
The CNIL is intensifying inspections of HR departments in 2026. Sanctions can reach €250,000 for identified breaches. This amount applies to mid-sized companies. For large companies, GDPR fines can reach 4% of global annual turnover.
The main identified risks are:
- Incomplete or outdated processing register: more than 20 to 30 HR processing activities must be mapped and legally justified. An outdated register is an offense found in any inspection.
- Retention periods not respected: keeping data beyond legal limits is a direct GDPR breach.
- No documented legal basis: each processing activity must state its legal basis. Missing documentation is sanctionable even if the processing itself is legitimate.
- Unreported security breaches: any data breach must be reported to the CNIL within 72 hours.
The impact goes beyond financial penalties. An HR data breach destroys employee trust. It creates real social risk: higher turnover, deteriorating internal climate, negative media coverage. Compliance is a trust lever with employees, not just a regulatory obligation.
5. How to Apply the CNIL 2026 Framework in Your HR Practices?
Compliance follows a four-step logic. Each step conditions the next.
- Map all HR processing activities: list each activity (recruitment, payroll, training, reviews, access control, video surveillance) and assign a legal basis and retention period. Professionals must map HR processing and record legal bases in the register.
- Configure automated deletion in the HRIS: a documented retention period that is not technically enforced has no legal value. Set automatic purge rules for each data category.
- Implement intermediate archiving: some data cannot be deleted immediately for evidential reasons. Create logical or physical separation between the active database and intermediate archive, with restricted access.
- Train HR teams: HR managers must know the applicable retention periods for their scope. Annual training on deletion procedures and data subject requests is essential.
Pro tip: The CNIL framework is soft law. It facilitates compliance but does not replace a context-specific analysis for each company. A recommended period can be adapted if you document the reasoning.
Demonstrating compliance requires written policies, up-to-date registers, documented training, and technical traceability. These four elements form the evidence file the CNIL requests during an inspection.
Key Takeaways
Compliance with HR data protection standards in 2026 requires complete processing mapping, automated retention periods, documented legal bases, and technical access traceability.
| Point | Details |
|---|---|
| CNIL 2026 framework | Distinguishes mandatory and recommended retention periods for each HR data type. |
| Legal bases in HR | Consent is invalid in HR. Prefer contract performance or legal obligation. |
| Technical security | Encryption, access controls, and access logging are evidential requirements verified by the CNIL. |
| Financial sanctions | Breaches can lead to fines of up to €250,000 for mid-sized companies. |
| Compliance rollout | Map processing, automate deletion, archive separately, and train teams annually. |
What HR Compliance Taught Me About Real Risk Management
After years supporting HR teams on GDPR compliance projects, I have seen one recurring mistake: treating data protection as a one-off project rather than an ongoing discipline. Companies mobilize significant resources during an audit or formal notice, then relax vigilance as soon as pressure eases.
What the CNIL 2026 framework changes concretely is the requirement for continuous proof. The CNIL no longer asks only "do you have a policy?" but "can you demonstrate that you apply it technically, today?" This shift is healthy. It forces organizations to embed compliance in their tools, not only in their documents.
HR data protection has become a strategic issue that goes beyond legal affairs. It affects internal trust and operational continuity. An employee who knows their data is poorly managed no longer trusts their employer. Most leadership teams underestimate the link between compliance and workplace climate.
The risk I see rising in 2026 concerns AI tool use by HR teams. Employees use generative AI to process employee files, write performance reviews, or analyze applications. These uncontrolled uses constitute Shadow AI. They expose sensitive personal data to non-compliant processing without the DPO being informed. This is the next focus of CNIL inspections.
— Jacques
Safe-doc: Pseudonymize HR Data Before Sending It to AI
HR teams use AI tools daily to analyze CVs, draft interview notes, or prepare training plans. These uses expose sensitive personal data if no protection is in place.
Safe-doc solves this by automatically pseudonymizing HR documents before they are processed by an AI tool. Names, social security numbers, addresses, and other identifying data are replaced with pseudonyms. The AI works on a secured document. Safe-doc never stores original files, ensuring GDPR compliance by design. For HR teams that want to use AI without exposing their data, the Safe-doc solution for HR is designed to integrate into existing workflows. DPOs can also review the compliance and audit page to assess alignment with the CNIL 2026 framework.
Frequently Asked Questions
What is the CNIL 2026 framework for HR data?
The CNIL 2026 framework is soft-law guidance published in April 2026 that sets HR data retention periods, distinguishing mandatory and recommended durations. It covers employee files, payslips, badge logs, and video surveillance.
What is the retention period for a payslip?
The retention period for a payslip is 50 years. This period is mandatory and applies to all employers without room for adaptation.
Why is employee consent invalid as an HR legal basis?
Consent is invalid in HR because the contractual imbalance between employer and employee means it is not freely given under the GDPR. The legal bases to prefer are performance of the employment contract and legal obligation.
What sanctions apply for non-compliance with HR standards in 2026?
The CNIL can impose fines of up to €250,000 for mid-sized companies. Large companies face sanctions of up to 4% of global annual turnover.
How does Shadow AI threaten HR data compliance?
Shadow AI refers to uncontrolled use of AI tools by employees to process personal data. These uses expose sensitive HR data without a legal basis or security measures, constituting a GDPR violation that can be sanctioned during a CNIL inspection.