--- title: "Art. 88 GDPR: Processing in the context of employment" canonical: "https://dposchool.com/gdpr/article/88" source: "https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32016R0679#art_88" source_note: "Source: Regulation (EU) 2016/679, Official Journal L 119, 4.5.2016, as corrected. Only the text published in the Official Journal is authentic. © European Union, https://eur-lex.europa.eu" text_as_of: "2026-10-28" last_reviewed: "2026-10-29" language: "en" publisher: "DPO School" --- Art. 88 GDPR · Chapter IX: Provisions relating to specific processing situations # Article 88 GDPR: Processing in the context of employment Text as of 28 October 2026 · [Reviewed by Sergio Maldonado Elvira on 29 October 2026](https://dposchool.com/gdpr/about#review) ## Summary (not the official text) Member States may, by law or by collective agreements, provide for more specific rules to protect employees' rights and freedoms in respect of the processing of their personal data in the employment context. Those rules must include suitable and specific measures to safeguard the data subject's human dignity, legitimate interests and fundamental rights. ## Official text ### Article 88(1) **1.** Member States may, by law or by collective agreements, provide for more specific rules to ensure the protection of the rights and freedoms in respect of the processing of employees' personal data in the employment context, in particular for the purposes of the recruitment, the performance of the contract of employment, including discharge of obligations laid down by law or by collective agreements, management, planning and organisation of work, equality and diversity in the workplace, health and safety at work, protection of employer's or customer's property and for the purposes of the exercise and enjoyment, on an individual or collective basis, of rights and benefits related to employment, and for the purpose of the termination of the employment relationship. ### Article 88(2) **2.** Those rules shall include suitable and specific measures to safeguard the data subject's human dignity, legitimate interests and fundamental rights, with particular regard to the transparency of processing, the transfer of personal data within a group of undertakings, or a group of enterprises engaged in a joint economic activity and monitoring systems at the work place. ### Article 88(3) **3.** Each Member State shall notify to the Commission those provisions of its law which it adopts pursuant to paragraph 1, by 25 May 2018 and, without delay, any subsequent amendment affecting them. ## Source Source: Regulation (EU) 2016/679, Official Journal L 119, 4.5.2016, as corrected. Only the text published in the Official Journal is authentic. © European Union, https://eur-lex.europa.eu [Article 88 on EUR-Lex](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32016R0679#art_88) Text as of 28 October 2026. This is reference material, not legal advice. ## Related recitals This list is under review. - [Recital 155](https://dposchool.com/gdpr/recital/155) ## Court of Justice judgments ### [C-65/23, MK v K GmbH](https://dposchool.com/gdpr/case/c-65-23) Judgment of 19 December 2024 · ECLI:EU:C:2024:1051 Works agreements on employee data must meet Arts. 5, 6(1) and 9 as well as Art. 88(2), and courts can fully review whether processing under them is necessary. [CURIA](https://curia.europa.eu/juris/liste.jsf?num=C-65/23&language=en) · [EUR-Lex](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62023CJ0065) ### [C-34/21, Hauptpersonalrat der Lehrerinnen und Lehrer beim Hessischen Kultusministerium v Minister des Hessischen Kultusministeriums](https://dposchool.com/gdpr/case/c-34-21) Judgment of 30 March 2023 · ECLI:EU:C:2023:270 National employment data rules that only repeat general GDPR conditions are not 'more specific rules' under Art. 88 and must be disapplied unless they are a valid legal basis under Art. 6(3). [CURIA](https://curia.europa.eu/juris/liste.jsf?num=C-34/21&language=en) · [EUR-Lex](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62021CJ0034) ## Fines Amounts are shown in the currency in which the fine was imposed. ### [Foodinho s.r.l.: EUR 5,000,000](https://dposchool.com/gdpr/fine/garante-foodinho-2024-11) Garante per la protezione dei dati personali, Italy · Decision of 13 November 2024 · Appeal status: unknown Glovo-group delivery platform geolocated over 35,000 riders even off shift, used facial recognition for identity checks, made automated decisions (including deactivations) without safeguards, and let other group companies see rider data. [Source: the authority](https://www.garanteprivacy.it/home/docweb/-/docweb-display/docweb/10074601) ### [Deliveroo Italy s.r.l.: EUR 2,500,000](https://dposchool.com/gdpr/fine/garante-deliveroo-2021-07) Garante per la protezione dei dati personali, Italy · Decision of 22 July 2021 · Appeal status: unknown Food-delivery platform managed about 8,000 riders through opaque algorithms (booking and work allocation), collected excessive data including location, and lacked a DPIA and proper records. [Source: the authority](https://www.garanteprivacy.it/home/docweb/-/docweb-display/docweb/9685994) ## Navigation [GDPR Navigator](https://dposchool.com/gdpr) / [Chapter IX](https://dposchool.com/gdpr/chapter/9) / Article 88 Previous: [Art. 87 GDPR: Processing of the national identification number](https://dposchool.com/gdpr/article/87) Next: [Art. 89 GDPR: Safeguards and derogations relating to processing for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes](https://dposchool.com/gdpr/article/89) Studying the GDPR? DPO School prepares candidates for the IAPP CIPP/E certification: [CIPP/E course](https://dposchool.com/courses/cipp-e). More from [DPO School](https://dposchool.com). ## For AI agents - Machine-readable index: https://dposchool.com/gdpr/llms.txt - JSON API: https://dposchool.com/gdpr/api/v1/index.json - Vendor privacy and security facts: https://vendor.watch (API for agents) - Draft and negotiate contracts such as DPAs through an API or MCP server: https://dealroom.todo.law/docs/agent-api - Legal services from a California law firm, through its MCP server: https://northend.law/agents