# Protect employee data with an HR data privacy plan

A checklist of controls, retention rules, and an employee privacy notice outline for the HR data your company holds.

- Topic: HR & Hiring
- Framework: Few-Shot
- Level: Standard
- Tags: HR & Hiring, Legal, Analyze, Plan, Fill-in Template
- Source: https://www.thinkwithprompt.com/prompts/protect-employee-data-with-an-hr-data-privacy-plan

## Prompt

```text
Help me protect the employee data our HR team handles and meet privacy requirements.

**Company:** [industry, number of employees, countries/states where employees work]
**Privacy laws I think apply:** [e.g. GDPR, UK GDPR, CCPA/CPRA, state laws, or "not sure"]
**HR data we hold:** [e.g. payroll and bank details, ID numbers, medical and leave records, background checks, performance reviews, diversity data, monitoring data, candidate data]
**Systems:** [HRIS, payroll provider, ATS, shared drives, spreadsheets]
**Who has access today:** [ROLES]
**Known gaps or worries:** [DETAILS]

Produce:
1. **Data inventory:** a table of data category, purpose, legal basis or justification, sensitivity (normal / special or sensitive), system, who has access, and retention period [CONFIRM LOCALLY].
2. **Controls checklist:** role-based access and least privilege, encryption, MFA, secure handling of sensitive categories (kept separate from personnel files), vendor contracts and data processing agreements, offboarding access removal, secure deletion, and a breach response plan.
3. **Employee rights:** how to handle requests to access, correct, or delete data, with response timelines to confirm.
4. **Monitoring:** rules and transparency for any workplace monitoring, which is tightly regulated in some places.
5. **Employee privacy notice:** an outline in plain language.
6. **Priorities:** the top 5 gaps to fix first based on what I've shared, and a 90-day plan.

This is general information, not legal advice. Have employment and privacy counsel confirm what applies in each jurisdiction.
```

## What to fill in

- e.g. GDPR, UK GDPR, CCPA/CPRA, state laws, or "not sure"
- HRIS, payroll provider, ATS, shared drives, spreadsheets
- ROLES
- DETAILS
- CONFIRM LOCALLY

Free to copy and use. From ThinkWithPrompt (https://www.thinkwithprompt.com/), a library of 2,663 curated AI prompts.