GDPR: access requests, retention and erasure

Your organisation is the controller, Kelomo (Tohmoco Oy) is the processor. A data subject’s request is therefore addressed to the employer.

Kelomo does not answer a data subject’s request on your behalf. If the request comes directly to Kelomo, it is directed to the controller and is not answered.

Answer an access request

An access request (GDPR Articles 15 and 20) is handled from the person card. Open the person’s Data protection section and choose Personal data copy (JSON) or Personal data copy (PDF). The package holds all of the person’s data.

The action is available to the administrator only. It also works for an ongoing employment – the request does not have to wait until the employment ends.

The retention windows

Settings → Administration and security → Data lifecycle is the administrator’s page. Its Retention windows section collects every retention window the organisation runs, and each row links to the page where that window is changed. The personal-data windows are changed under Settings → People and HR → HR settings.

A person’s retention windows are counted from the end of the employment. Working-time records are kept for 24 months from the end of the calendar year in which the employment ended (Working Hours Act, section 32).

The workspace’s own values are limited to the statutory minimum: a value shorter than the law does not take effect, even if the setting lets you type the number.

The anonymisation queue

The Anonymisation queue section lists ended employments whose retention window has run out. The administrator chooses Anonymise in the row’s menu, and the data is erased one data category at a time, only after that confirmation.

An erasure request does not override the retention obligation

Working-time bookkeeping may not be destroyed. That is why identity data is pseudonymised: the membership is repointed to a nameless user (for example Ex #3fa9c1), and the working-time rows remain intact. The person is no longer identifiable.

The basis is the Working Hours Act, section 32, together with the time limit for bringing a claim: the Working Hours Act, section 40, gives two years from the end of the calendar year in which the right arose. An employee’s claim must remain verifiable after the employment as well, so the rows cannot be deleted on request.

When the contract ends

When the contract with Kelomo ends, the data is returned or erased within 90 days, taking mandatory retention obligations into account.

The controller’s checklist

These are the controller’s responsibility:

• a privacy notice for the staff
• the legal basis for the processing
• a record of processing activities (Article 30)
• a data protection impact assessment (DPIA) if you enable punching with location

The same list is in the last step of the setup wizard – see Setup for administrators.

If something goes wrong