# Standards and Regulatory References — HR System Privacy Configuration

## Primary Legislation

### GDPR
- Art. 5(1)(c): Data minimisation — configure systems to collect minimum necessary data.
- Art. 5(1)(e): Storage limitation — automated retention and deletion enforcement.
- Art. 5(1)(f): Integrity and confidentiality — access controls, encryption, audit logging.
- Art. 25: Data protection by design and by default — privacy-preserving default configurations.
- Art. 32: Security of processing — appropriate technical and organisational measures.
- Art. 30: Records of processing — HR system must support ROPA generation.
- Art. 44-49: International transfers — cross-border data flow configuration.

## Industry Standards
- ISO 27001:2022: Information security management — access control (A.9), cryptography (A.10).
- ISO 27701:2019: Privacy information management — PIMS requirements for HR data processing.
- NIST SP 800-53: Security and Privacy Controls — AC (Access Control), AU (Audit), SC (System Communications).

## Platform-Specific Documentation
- SAP SuccessFactors: Role-Based Permissions (RBP), Data Retention Management (DRM), Personal Data Report.
- Workday: Security Groups, Domain Security Policies, Data Purge Framework.
- BambooHR: Access Levels, Custom Access Levels, Inactive Employee Management.

## Enforcement Precedents

| Authority | Reference | Fine | Issue |
|-----------|-----------|------|-------|
| LfDI Hamburg | H&M, 2020 | EUR 35,258,707.95 | HR system used for excessive data collection |
| CNIL | Dedalus Biologie, 2022 | EUR 1,500,000 | Insufficient access controls on health data |
| ICO (UK) | British Airways, 2020 | GBP 20,000,000 | Insufficient technical measures |
| AEPD (Spain) | CaixaBank, 2021 | EUR 6,000,000 | Insufficient granularity in access controls |
| AP (Netherlands) | 2022 Audit | Corrective measures | HR system retained terminated data indefinitely |