Hiring foreigners in Poland in the context of GDPR

Personal data protection and privacy are fundamental human rights of every individual regardless of their country of origin. That is why the data controllers’ data processing obligations imposed by the GDPR extend also to foreigners whenever their data are processed in the EU. Foreigners, like all EU citizens, have the same rights guaranteed by the GDPR to control the processing of their personal data.

If Polish employers want to hire a foreigner, they have additional obligations, especially to regularise their work and stay in Poland. This involves personal data processing. 

Already at the hiring stage of a foreign worker, the employer is obliged to request additional data from job candidates and employees, apart from those mentioned in the Labour Code [1a]. According to the Act on Consequences of Hiring Foreigners Who Illegally Stay in Poland [2a], the employer must (before the foreigner begins to work) ask the foreigner for basic details (full name, date of birth and contact details) and a valid document authorising his or her stay in Poland. This document may be e.g. passport, visa, residence permit or any other document issued by Polish authorities, which allow foreigners to stay in Poland. 

An employer who wants to hire a foreigner has to check the documentation of his or her legal stay in Poland before the foreigner begins to work. After the employee begins to work, the employer must keep the document of the foreigner’s legal stay in Poland in the employee files. A tourist visa, for instance, is not such a document.

The right to process data of a foreigner’s legal stay in Poland arises from the Labour Code [1b] which allows employers to request other personal data necessary to exercise this right or fulfil a legal obligation, that is, the obligation to check the legal stay in Poland. Consequently, the personal data concerning the legal stay in Poland will be processed on the basis of the GDPR [3]. The request for and the processing of the data concerning the legal stay will be legitimate because it is necessary to fulfil the obligation of the data controller (employer) as the hirer of the foreigner.

Employers must take care to document the personal data processing in their internal files (e.g. the record of processing activities, risk analysis), and the data processing must be secured by means of adequate technical and organisational measures. 

The document copy may need to be requested and kept not only by the employer but also other hirers of the foreigner (e.g. clients) [2]. 

Those who hire workers without checking their right to stay and legally work in Poland may face harsh sanctions such as denial of work permit for foreigners in the future.