slider01

 

 

 

slider01-1440x501x1
slider01-1440x501x1-1
10 January 2019
Emilie van Kempen |

Right of access to personnel files

Need advice? Please call or e-mail 

+31 (0)70-3819281

info@wisemen.nl

Right of inspection. A new right by GDPR?

We are regularly asked whether an employee has the right to inspect his or her entire personnel file. It is thought that since the introduction of the General Data Protection Regulation (GDPR) an employee has this right. However, the right of access is not new. This also existed under the predecessor of the GDPR; the Dutch Personal Data Protection Act. But what should, in any case, an employee be informed about and how far does the right of access extend?

In any case, an employee must be informed on the basis of the GDPR that his personal data are being processed, what data this concerns and why. The latter will be in order to be able to fulfil the employment contract and to be able to reward an employee. To do this, you simply need name, date of birth and social security of service number. But other personal data can also be processed, for example for the lease car or to follow a specific training course. Furthermore, an employer must also indicate, among other things, with whom he shares this information. For example, a pension fund or other organization(s), whether or not abroad. An employee must also be informed of his rights regarding the GDPR. For example, the right to correction of personal data, or the right to object to a processing or the right to file a complaint with the Dataprotection Authority. This can all be included in an employee manual or personnel guide.

How far does the access right extend?

The right of access also belongs in this (not exhaustive) list of rights. The employer must therefore inform the employee that the employee has the right of access to his/her personal data. But does an employer then have to make the entire personnel file of an employee available to that employee, if requested? The answer is no.
As an employer, you only need to provide factual information. Such as the name and address details, salary slips, the contract for the lease car or assessments that have occurred. Generally speaking, this will involve data that an employee has already received or knows for a long time. Internal notes of managers with their brainwaves or ideas need not be provided. These are not factual data, but serve for internal deliberation. Think of preparing an assessment interview. This information does not have to be provided on the basis of the right of access.

The rights and freedoms of others must also be taken into account when implementing the right of access. This may result in the names of others (or other employees) being deleted. But also that no lists need to be provided of employees who are following an improvement process or of employees who can be declared redundant in the event of a reorganization in the pipeline.

Right of refusal to access

Also know that an employer has the right to refuse a request for access. Namely if a request is manifestly unfounded or excessive, particularly because of its repetitive nature. An employer can then charge a reasonable fee for complying with the right of access or even refuse to comply with the request. It is up to the employer to prove the manifestly unfounded or excessive nature of the request. Within one month of the request, the employer must give reasons for refusing to comply with the request. The employer must also inform the employee about the possibility to submit a complaint to the Dataprotection Authority and to lodge an appeal at court.
The right to access a personnel file does thus not reach into heaven. You have to look at all of the different shades of the matter. The lawyers at Wisemen Advocaten will be happy to help you ask the right questions to the employer and employee in order to be able to respond correctly to a request for access. Please contact us for more information:

Advice!

Do you want to use our knowledge and call us with some regularity? Subscribe to the Virtual Legal Department. 

Interested? Call or email us:

T. +31(0)70-3819281
E. info@wisemen.nl

For the latest information, subscribe to the newsletter now

WiseMen Newsletter!

 

Archief

25 August 2026 (update 10 june 2026) What transparency obligations apply to AI use?
21 August 2026 New rules on the sharing of digital evidence
17 August 2026 Force majeure in IT industry-standard terms and conditions
14 August 2026 What statutory obligations apply to the deployer of high-risk AI systems?
15 June 2026 Can AI-generated output be protected by copyright?
18 May 2026 What are the consequences of the misuse of AI in legal cases? (update)
15 April 2026 Digital Omnibus Proposal: proposed amendments to the General Data Protection Regulation (“GDPR”)
31 March 2026 Case C-97/23 P WhatsApp Ireland v European Data Protection Board
31 March 2026 What transparency obligations apply to AI use?
31 March 2026 The EU European Health Data Space Regulation has entered into force, what now?
12 March 2026 What are the consequences of misuse of AI in court cases?
22 January 2026 DEU Data Act Regulation & Exit - and Continuity Provisions in IT Contracts
17 December 2025 How does my company or organisation develop ethically responsible and reliable AI?
14 May 2025 Accessibility Directive/ European Accessibility Act (EAA).
14 January 2025 What is a critical or important function under the DORA regulation?
23 October 2024 When are personal data health data? EU Court of Justice rules
11 October 2024 Commercial interests as a GDPR legal basis : EU Court of Justice rules
07 March 2024 Doxing is a crime under Dutch Criminal Law as of January 1, 2024. What does that mean?
10 December 2023 The New Platform Liability: from the e-Commerce Directive to the Digital Services Act Regulation (“ DSA ”)
23 November 2023 Part I - AI & Dutch Law: How does AI and copyright law work in the Netherlands?
14 September 2023 Director personally liable for improper dismissal
04 September 2023 Naming law is also privacy law
31 July 2023 New adequacy decision personal data transfers between the US and EU
19 June 2023 What does the Blauw/Nebu case mean for practice?
02 November 2022 What is the Legal Value of NEN 7510 Certification?
24 June 2022 A practical overview of the do's and don'ts of camera use
23 June 2022 Can I scrape data from the Internet?
24 May 2022 When do you need a 'privacy statement'?
07 March 2022 Processor or (joint) controller?
23 December 2021 What is a Data Transfer Impact Assessment ("DTIA")?
14 October 2021 Consent not suffice as grounds?
02 January 2020 I understand that you prefer to sit on your boyfriend's head
03 December 2019 Interview(s) LIVE op AvdR Legalflix
17 September 2019 Can an employer require use of fingerprint scanners?
02 September 2019 Dutch AP provides practical information about processors
19 February 2019 The GDPR and freedom of expression: can everyone be a journalist?
12 February 2019 Is your software license policy in order? Do the software check (pre BSA)
02 January 2019 Pledge on software
25 September 2017 What about the zero-hour employment contract?
20 September 2017 Be careful with descriptive trade names!
29 September 2015 What about the all-in salary payment?
16 April 2014 The added value of an IT lawyer


Emilie van Kempen

Employment law, Liability, disputes and litigation

Contact