GDPR Considerations for Collaboration Platforms

Information only — not legal advice.

Collaboration tools can hold personal data in contact lists, messages, photographs, meeting minutes, activity logs and attachments. Business information can also be personal data when it relates to an identifiable person. GDPR responsibilities depend on the processing activity, not on the name of the application.

This is general guidance for organizations within the GDPR's scope. Employment rules, statutory retention and particular cases may require advice from the organization's privacy lead or legal adviser. The examples below are fictional.

Start with purpose and responsibility

For each use, record what information is needed, why it is needed, who receives it and when it is reviewed or deleted. The company usually acts as controller when it determines the purpose and essential means. A service provider may act as processor when following its instructions; a provider can also be a separate controller for other activities. Examine the actual roles and the processing contract. EDPB: controller and processor responsibilities.

Choose a valid legal basis for each purpose. Consent is one of several possible bases and is often unsuitable in employment because of the imbalance of power. Contract necessity, legal obligations and legitimate interests each have conditions; none authorizes unlimited collection. Special-category data, such as health information, needs an additional applicable condition. EDPB: lawful processing.

Example 1: a shared project contact list

Do: include the work contact details and roles needed for coordination. Limit the audience and tell people how their details will be used.

Don't: add home addresses, identity-document scans or personal telephone numbers simply because the form has spare columns. A supplier needs the relevant contact, not the entire employee directory.

At project closeout, decide which details remain necessary in retained records and which active contact lists should be removed. The European Commission's GDPR principles explain purpose limitation, minimisation, accuracy, security and accountability.

Example 2: absence discussed in a meeting

Do: write “Resource availability to be confirmed by the team lead” when that is sufficient for the decision. Keep necessary medical information in the restricted process designed for it.

Don't: put an employee's diagnosis in widely distributed minutes, or assume that mentioning it verbally authorizes broad publication. Review attachments and earlier revisions as well as the visible paragraph.

Example 3: sending a package to a contractor

Do: prepare a scoped package, check the recipient, remove unrelated personal information and test the actual sharing permissions. Use an expiry where appropriate and record who owns the external relationship.

Don't: share the parent folder containing HR, bids and other projects. A file called “public copy” can still contain hidden sheets, comments or revision history.

Before adopting a provider, assess its security, subprocessors, deletion/return arrangements and assistance with requests and incidents. Check international transfers, including relevant overseas access; an EU storage location alone does not settle every transfer question. EDPB: international transfers.

Example 4: recording a meeting or using an AI assistant

Do: assess whether recording or transcription is necessary, identify a lawful basis, explain the purpose and audience, and set access and retention. Review the tool's terms and the data it receives before use.

Don't: quietly record every meeting or paste personnel files into an unapproved external tool. A generic “we use technology” notice may not explain the actual processing. A DPIA is required where processing is likely to result in high risk; assess this before introducing a risky use. Irish Data Protection Commission: impact assessments.

Example 5: an employee leaves or asks for their data

Remove unnecessary access promptly, transfer ownership of work and handle devices and shared links. Retention requires a documented purpose and applicable legal obligations, not “keep everything forever.” Do not assume every record must be deleted on departure.

Route an access or deletion request to the responsible person. Locate relevant messages, exports and archives, protect other people's data and document the response. Normally respond within one month; complex or numerous requests can justify an extension of up to two further months, with timely notice and reasons. Erasure has exceptions. EDPB: individuals' rights.

Example 6: a payroll attachment goes to the wrong group

Report it internally immediately. Restrict further access, preserve useful evidence and record what was exposed, to whom and for how long. Do not erase the incident trail or assume recalling an email proves nobody read it.

The controller must assess risk to people. Notify the supervisory authority without undue delay and, where feasible, within 72 hours of awareness unless the breach is unlikely to create a risk to individuals' rights and freedoms. Where high risk is likely, affected people generally also need notification without undue delay, subject to the legal exceptions. Processors notify the controller without undue delay. Document all personal-data breaches, including a reasoned decision not to notify. EDPB: data breaches.

A short company routine

• Before sharing: check purpose, audience, necessary fields and attachments.
• During use: review access, maintain accuracy and provide an easy route for questions or incidents.
• At review or closeout: apply the retention decision, remove unnecessary access and record completion.
• When circumstances change: reassess the supplier, processing purpose and risks.

The legal text is available through EUR-Lex: GDPR. Continue with ISO/IEC 27001 in Plain Language and Project Workspace Setup.

Important information

This article provides general information and does not constitute legal advice or replace a qualified professional's assessment of your circumstances. Laws, official guidance, standards and product features can change. Check current primary sources and the requirements applicable to your jurisdiction, contract and project before making decisions. Examples illustrate the discussion; they are not official rulings or instructions for a particular case. For legal decisions, consult a qualified lawyer; for technical or other specialist matters, consult the responsible professional.