The first day of a new employee is also the time when your organization is most exposed. To secure data when new recruits are onboarded, three actions are non-negotiable from day one: activate MFA, apply the principle of least privilege via RBAC, and provide GDPR information in compliance with article 13. Everything else stems from these three pillars.
Priority actions to launch immediately:
- MFA and RBAC from day 1: create a user account with rights limited to what is strictly necessary for the position, MFA activated before first access.
- Data minimization (Art. 5(1)c GDPR): only collect the information essential to taking up the position; prohibit any field relating to health, religion or social security number unless explicitly required by law.
- Regulatory documentation: record the processing in the activity register (Art. 30) and trigger a data protection impact assessment (DPIA) if the processing presents a high risk (Art. 35).
- Pseudonymization of sensitive HR documents: CVs, certificates, evaluations - pseudonymize before storing or sharing to protect personally identifiable information (PII) in the event of unauthorized access. Safe-doc is designed precisely for this use case.
Table of contents
- Your operational action plan: before arrival, D-day, 30 and 90 days
- What are your concrete GDPR obligations for recruitment and onboarding?
- How to manage access securely from day one?
- Secure workstations and mobiles upon arrival, including teleworking
- Pseudonymization of HR documents: how it works and why it is different from anonymization
- Train new recruits in security without drowning them in information
- Logging, auditing and incident response during onboarding
- Ready-to-use templates and checklists for HR and IT
- Key Points
- Onboarding, a window of vulnerability too often underestimated
- Safe-doc: pseudonymize your sensitive HR documents from onboarding
- Useful sources and references to learn more
Your operational action plan: before arrival, D-day, 30 and 90 days
A structured timeline avoids costly oversights. The table below divides tasks between HR and IT with expected evidence of execution.
| Step | Key tasks | Responsible | Proof of Execution |
|---|---|---|---|
| Before arrival | Check the ATS (minimization of collected data), create the RBAC profile according to the role, open the processing register | HR + IT | Updated registry, documented RBAC profile |
| D-Day | Create the limited user account, secure enrollment (without temporary password by email), MFA activated, signature confidentiality agreement, delivery of information Art. 13 | IT + HR | Account creation log, signed GDPR receipt |
| 30 days | Review of access rights, cybersecurity training (phishing, passwords), MDM verification and disk encryption | IT | Access review report, training completion rate |
| 90 days | Internal compliance audit, purging or archiving of selection data (max. 2 years according to the CNIL), AIPD control if applicable | DPO + HR + IT | Signed audit report, purge logs |
Provisioning Automation significantly reduces the exposure window for new accounts and reduces human errors during onboarding. Linking this workflow to your HRIS or ATS eliminates the delays between the hiring decision and the actual creation of access.
What are your concrete GDPR obligations for recruitment and onboarding?
Minimization and prohibited fields
principle of minimization (Art. 5(1)c GDPR) prohibits the collection of data not strictly necessary during recruitment. In practice, this means banning from HR forms any field relating to state of health, religion, political opinions, detailed family situation or social security number unless legally necessary. A compliant application form is limited to name, professional contact details, qualifications and experience relevant to the position.
Register of activities and AIPD
Holding the register of processing activities (Art. 30) is mandatory for all HR processing: recruitment, integration, access management. Each entry must document the purpose, data categories, recipients and retention periods. AIPD (impact analysis) becomes mandatory as soon as processing presents a high risk for individuals' rights: large-scale profiling, automated psychometric tests, processing of biometric data for access control.
Retention periods and candidate rights
The CNIL recommends keeping unsuccessful applications for a maximum of 2 years after the last contact. Separating selection data (CV, interview notes) from the contractual HR file and automating their deletion after the legal period avoids undue retention likely to result in sanctions. Information to candidates on the purpose and retention period must be provided upon collection, in accordance with Art. 13.
Pro tip: Create two separate storage spaces in your HRIS: a “selection” space with automatic purge after 2 years, and a “contractual file” space with retention period adapted to the legal obligation. This physical separation makes the CNIL audit immediately readable.
How to manage access securely from day one?
RBAC, least privilege and role templates
Applying role-based access control (RBAC) means creating access profiles by business function rather than assigning individual rights on a case-by-case basis. A “junior sales” profile does not need access to payroll data; an “operational HR” profile does not have to consult network configurations. These templates reduce the attack surface and simplify audits.
- Least privilege: only assign the rights necessary to exercise the role, reviewable within 30 days.
- Centralized SSO: centralize authentication via a single authentication solution to limit the proliferation of identifiers.
- MFA required: Require multi-factor authentication on first access, without exception, including for service accounts.
- Automated provisioning: connect the account creation workflow to the ATS or HRIS to automatically trigger the creation and revocation of access according to the employee's status.
- Logging: record each creation, modification or revocation of access with timestamp and operator identifier.
Pro tip: For remote onboarding, include an identity verification step with liveness detection when creating the account. This measure reduces the risk of identity theft, an attack vector amplified by teleworking.
monthly reconciliation of accounts - verifying that each active account corresponds to an existing employee with the correct role profile - is the simplest measure to detect access abuses before they become an incident.
Secure workstations and mobiles upon arrival, including when teleworking
The terminal is the first point of contact between the new recruit and your data. An uncontrolled station cancels all upstream access measures.
Minimum measures for D-day:
- Hardened standard image with separate local accounts (administrator separate from the current user).
- Full disk encryption activated before handing over the station.
- MDM solution (mobile terminal management) applied to all devices accessing corporate resources, including personal mobiles in a BYOD context.
- VPN or network access with strong authentication for teleworking, without sharing identifiers.
- Security fixes (patching) checked before commissioning; EDR deployed if available.
For BYOD scenarios, the rule is isolation: professional data must be partitioned in an encrypted container, with a remote wipe policy that can be activated in the event of loss or departure. Application access must be controlled independently of the terminal operating system.
Pro tip: Never hand over a workstation without having verified that the MDM is properly enrolled and that disk encryption is active. A simple automatic startup verification script, sending a report back to IT, is enough to document compliance for the 90-day audit.
Pseudonymization of HR documents: how it works and why it is different from anonymization
Pseudonymization vs. anonymization: the distinction that matters
The pseudonymization replaces direct identifiers (name, social security number, address) with pseudonyms, while maintaining secure mapping allowing controlled restoration. Anonymization permanently removes any link with the person: irreversible by design. For common HR processing - CV analysis, internal mobility assessment, use of AI tools - pseudonymization is the appropriate measure: it protects PII while preserving the possibility of restoring the original data if necessary.
Pseudonymization is among the technical measures recommended by GDPR doctrine to limit the exposure of personal data in the event of unauthorized access.
Recommended workflow
- Identification of sensitive fields: last name, first name, date of birth, contact details, social security number, possible health data.
- Pseudonymization at source: before any centralized storage or sharing with a third-party tool (AI included).
- Secure mapping: keep the correspondence file in a restricted access space, separate from the pseudonymized document.
- Auditability: trace each pseudonymization and restoration operation to meet the requirements of Art. 5(1)f GDPR.
Concrete HR use cases
| Document | Risk without pseudonymization | Profit with pseudonymization |
|---|---|---|
| CV and cover letters | Exposure of PII during AI analysis or inter-service sharing | AI analysis possible without exposing the identity of the candidate |
| Certificates and diplomas | Identity data accessible to any HRIS user | Verification possible without access to raw data |
| Evaluations and interview notes | Risk of bias and unauthorized access | Anonymized review for HR calibration |
| Internal mobility data rooms | Complete profiles accessible to non-concerned managers | Limited access to decision-relevant data |
Safe-doc in the HR document process
Safe-doc processes documents in real time without storing them, automatically detects more than 90 types of sensitive data (PII and confidential information), and exports a reversible mapping for controlled restoration. Its stateless architecture guarantees that no document passes through a third-party server. REST API and MCP integrations allow it to be inserted directly into an ATS flow or an existing HR file, without changing the teams' work habits.
Train new recruits in security without drowning them in information
Safety training fails when it arrives in the form of a 40-page PDF on the big day. The format that works: interactive micro-modules of 10 to 20 minutes, targeted on the concrete risks of the position.
D-Day: A single module covering the four essential messages - why data minimization, BYOD, password management and MFA, and how to report a suspicious incident. No more.
At 30 days: a reminder with phishing simulation. The score of this simulation is the most reliable indicator of the actual assimilation of good practices. Complete with a point on GDPR obligations specific to the role (HR, IT, end user) with appropriate language: operational for IT, regulatory summary for HR, practical demonstrations for end users.
The CNIL emphasizes that transparency on monitoring tools avoids distrust among new employees. Clearly explaining what is logged and why builds trust rather than undermines it.
Pro tip: Measure three indicators in 30 days: module completion rate, average phishing simulation score, and percentage of users with active MFA. These three figures are enough to manage your awareness program and document your approach for a CNIL audit.
Logging, audits and incident response during onboarding
What to log
The EDPB reminds that security is based on confidentiality, integrity and availability, and that accessible documentation is a condition for effective risk management. Concretely, the events to log during the onboarding period are:
- Creation and modification of user accounts.
- Assignments and revocations of access rights.
- Access to sensitive HR files and document exports.
- Failed access attempts and access outside of usual time slots.
- System administration actions (privilege escalation, configuration changes).
The logs must be immutable: stored in a write-only space, accessible only to the CISO or the DPO.
Alerts and incident response
Configure alerts on abnormal behavior: massive access to HR files outside of working hours, repeated authentication attempts, unusual export of document volumes. In the event of an incident involving the data of new recruits, the procedure is: immediate isolation of compromised access, revocation of the accounts concerned, restoration from the pseudonymized mapping if available, then notification to the CNIL within 72 hours if the risk for individuals is proven.
The CNIL's GDPR practical guide recommends involving management and appointing a CISO or DPO to formalize security objectives at the organizational level. A formal 90-day audit, with signed report, ends the intensive onboarding period.
Ready-to-use templates and checklists for HR and IT
Fields to include vs. fields to prohibit in forms
| Allowed fields | Fields to be prohibited |
|---|---|
| Name, first name, professional contact details | State of health, disability (except voluntary RQTH declaration) |
| Relevant degrees and certifications | Religion, political opinions, union membership |
| Professional experience related to the position | Social security number (unless legally required) |
| Availability and start date | Detailed family situation, number of children |
| Bank details (only after hiring) | Photo (except for professions where it is legally required) |
GDPR information template (Art. 13) to be submitted on D-Day
The document must mention: the data controller (company name, contact details), the purposes of the processing (HR management, payroll, access to systems), the legal basis (execution of the contract, legal obligation), the retention periods by category of data, the recipients (internal services, payroll providers), and the rights of the person (access, rectification, erasure, portability) with the contact details of the DPO if designated.
IT checklist for the big day
| Action | Status | Responsible |
|---|---|---|
| Standard post image applied | ☐ | IT |
| Disk encryption enabled and verified | ☐ | IT |
| Enlisted MDM | ☐ | IT |
| User account created with RBAC profile | ☐ | IT |
| MFA enabled and tested | ☐ | IT |
| Logs activated and SIEM feedback verified | ☐ | IT |
| Confidentiality agreements signed | ☐ | HR |
| GDPR information Art. 13 discount | ☐ | HR |
The CNIL and the EDPB recommend clear documentation of procedures and training of data controllers to guarantee the effective application of security measures. Automating the purging of selection data and documenting the duration in the processing register are the two actions most often forgotten during audits.
Key points
Securing data when onboarding new recruits requires combining MFA, RBAC, GDPR minimization and documentary pseudonymization from day one, with a formal audit at 90 days.
| Point | Details |
|---|---|
| MFA and least privilege from day 1 | Activate MFA and create a limited RBAC account before first accessing the system. |
| Minimization and register of treatments | Prohibit unnecessary sensitive fields and document each HR processing in the Art register. 30. |
| Pseudonymization before storage or sharing | Pseudonymize resumes, certificates, and reviews to protect PII during AI scans or cross-department reviews. |
| Provisioning Automation | Connect the ATS/HRIS access workflow to eliminate delays and human errors in onboarding and offboarding. |
| Safe-doc for sensitive HR documents | Safe-doc pseudonymization in real time without storage, with reversible mapping and auditability compliant with GDPR Art. 4(5). |
Onboarding, a window of vulnerability too often underestimated
Onboarding concentrates, in a few days, all the conditions for a security incident: access created urgently, sensitive documents exchanged by e-mail, training sent due to lack of time, and HR and IT teams who rarely coordinate early enough. GDPR compliance is often treated as an administrative formality when, at heart, it is an operational risk management framework.
What is most often missing is not knowledge of the rules, but structured cooperation between HR and IT from the process design phase. “Privacy by design” is not an abstract concept: it means deciding, before the first recruit arrives, which fields to collect, where to store the documents, who accesses them and how to purge them. The pseudonymization of sensitive HR documents is part of this logic: it protects data at the source, before the risk materializes, and it allows the use of AI tools without exposing the PII of candidates or employees.
Training, automation and pseudonymization are not three separate projects. They form a coherent system where each measure reinforces the others. A quick audit of your current onboarding process, starting from the D-Day checklist, generally reveals two or three priority flaws to correct before the next wave of recruitment.
Safe-doc: pseudonymize your sensitive HR documents from onboarding
HR and IT teams who process CVs, assessments or internal mobility data rooms with AI tools expose themselves to a concrete risk: candidate PII passes through uncontrolled platforms. Safe-doc solves this problem without changing work habits.
The platform automatically detects more than 90 types of sensitive data, pseudonymizes it in real time without storing any documents, and generates a reversible mapping for controlled restoration. Its zero storage architecture directly meets the requirements of GDPR Art. 4(5) and the expectations of a CISO during an audit. REST API and MCP integrations allow Safe-doc to be inserted into an existing ATS flow or HR file in just a few hours.
A concrete pilot to launch quickly: pseudonymize incoming CVs and internal mobility files before any AI analysis. Immediate result: GDPR compliance on the use of AI, documented auditability, and zero exposure of PII. Visit page dedicated to HR uses to start a pilot assessment or request a document mapping audit.
Useful sources and references to learn more
To verify and apply the obligations described in this article, here are the official resources and practical reference guides:
GDPR compliance and HR obligations:
- CNIL reference framework - Human resources management: the reference document for HR processing in France, covering recruitment, integration, career management and processing register.
- GDPR practical guide - Security of personal data (CNIL, version 2024): recommended technical measures (MFA, pseudonymization, encryption) and CISO/DPO roles.
- CNIL sheet - Protect your employees’ data: practical summary on transparency and trust at work.
- EDPB Guide - Securing personal data (SME): confidentiality/integrity/availability framework and risk documentation.
- GDPR recruitment - practical guide: minimization, retention periods and information for candidates.
Technical security and access life cycle:
- Rethinking IT onboarding - IT-Connect: remote identity verification, liveness detection and secure provisioning.
Pseudonymization and use of AI on HR documents:
- Pseudonymization vs. anonymization - Safe-doc: technical and legal distinctions, documentary use cases.
- Anonymize HR data - Safe-doc: methods and automation for internal HR processing.
This article presents general information of a practical nature. For any specific situation, consult your DPO, your CISO or a legal advisor specialized in personal data law, and check the texts in force with the CNIL.