Questions, answered · HR directors
How should HR handle employees' immigration data under GDPR?
Updated
Collect only what the permit needs, store it in the EU with access limited to the people on the case, keep it only as long as the law requires, and sign a data processing agreement with every tool that holds it. Passports and identity numbers deserve extra protection.
In detail
- Minimise: no copies in email threads or shared drives.
- Role-based access per case.
- Retention rules and deletion when the case ends.
- A DPA and a public subprocessor list from every vendor.
How Settio helps
Settio is hosted in Europe, encrypts identity numbers again in code, reads passports without AI and publishes its DPA and subprocessors.
Start free trial
Read more
Related questions
- Who submits the work permit application in Sweden, the employer or the employee?
- How do I keep track of all our employees' work permits and expiry dates?
- Can someone work in Sweden on a business trip without a work permit?
- How do I build a compliant international relocation programme?
- What are the penalties for employers who get work permits wrong in Sweden?
- What is kompetensutvisning and how do we prevent it?
Informational only. This guide is not legal advice. Always verify requirements with official government sources before acting. Facts checked 10 October 2026. About this information