How do we write a privacy notice for our employees?

Asking employees to sign a "consent to process personal data" instead of giving them a notice is usually a mistake. Consent has to be freely given, and an employee depends on the employer, so consent is rarely a valid basis at work. Why, and where consent does still work, is explained in the dat.lt article on employee consent (link at the bottom of this page).

Employee data is normally processed to perform the employment contract, to meet legal obligations of the employer, or for the employer's legitimate interest. The notice is not a request for permission. It is information that the GDPR makes mandatory.

1. List every process that involves employee data

Start from your record of processing activities, if you have one. There are usually several employee rows, for example:

• employment contracts and HR administration;
• payroll, tax and social insurance;
• working-time records;
• work tools: email, IT accounts, phones;
• video surveillance on the premises;
• vehicle GPS, if you have it;
• occupational health checks and workplace accidents;
• employee photos on the website or internal channels.

No record yet? A one-page list is a good start. The same list later becomes the employee part of your record.

2. Fill in six fields for each process

If you rely on legitimate interest, the notice must also name the interest itself, for example "protection of property" or "fleet management". That is required by Article 13(1)(d) GDPR.

3. Write the notice following Article 13 GDPR

Article 13(1) and (2) GDPR list what the notice must contain. In practice that gives this structure:

1. Who the controller is – company name, registration number, address, contact details.
2. A contact for data protection questions – whom the employee writes to (the contact in point (b) is given if such a person has been appointed).
3. A table of processes – the fields from step 2, one row per process.
4. The employee's rights – access, rectification, erasure, restriction, objection, data portability.
   - If any process is based on consent (e.g. photos) – the right to withdraw consent at any time (Article 13(2)(c) GDPR).
5. The right to complain to the State Data Protection Inspectorate.
6. Whether providing data is mandatory and what happens if the employee does not provide it. For example, without a bank account number you cannot pay the salary.
7. Automated decisions, if there are any. A small company usually has none.

Write plainly. Article 12(1) GDPR requires a concise, intelligible form and clear, plain language. A one-page table is clearer than ten pages of legal text.

4. Hand it over so that you can prove it

Article 13(1) GDPR says the information is given at the time the data is obtained – when you first collect the employee's data, often before the contract is signed.

How to hand it over:

• The general notice – with the first documents the employee fills in (no later than the employment contract), or through an internal system that shows the employee opened it. A signature is not a legal requirement here, but it helps you prove you informed them. Article 24(1) GDPR requires the controller to be able to demonstrate compliance.
• Monitoring – for video or audio recording at the workplace and for monitoring employees' behaviour, location or movement, Lithuania has a stricter rule. Article 5(4) of the Law on the Legal Protection of Personal Data (ADTAĮ): employees are informed against signature or in another way that proves they were informed, with all the information in Article 13(1) and (2) GDPR. So cameras and GPS need proof that each employee was informed – a sign alone is not enough.

Monitoring starts only after employees are informed. An employer with on average 20 or more employees must also inform and consult the works council before approving monitoring rules and an employee data retention policy (Article 206(1) of the Labour Code, points 5 and 7). If there is neither a works council nor an employee trustee performing its functions, the information goes to a trade union operating at employer level, if there is one (Article 206(4) of the Labour Code). If the cameras are already on and staff have not been informed, that period did not comply with Article 5(4) of the Law on the Legal Protection of Personal Data; inform them now and record the date – it shows when you came into line, but does not cure the earlier period.

5. Update it when something changes

The notice is not a one-off document. Update it when:

• a new process appears, for example you install GPS;
• the provider you pass data to changes, if the notice names providers individually (categories of recipients are enough, Article 13(1)(e) GDPR);
• a retention period changes.

If you want to use data for a new purpose, it must be compatible with the original purpose, or be based on the person's consent or on a law that is a necessary and proportionate measure for the objectives in Article 23(1) (Article 6(4) GDPR). Consent rarely fits at work. Article 13(3) GDPR requires you to inform employees about the new purpose before you start. Informing them does not by itself make the new purpose lawful.

Sometimes data comes from elsewhere, for example a reference from a former employer. Article 5(3) of the Law on the Legal Protection of Personal Data (ADTAĮ) allows collecting a candidate's data on qualifications, professional abilities and business qualities from a former employer only after informing the candidate, and from the current employer only with the candidate's consent. When data is not collected from the person, the content of the information is set by Article 14 GDPR.

The fields of an employee notice are the same as the fields of a record of processing activities, so the easiest start is the record. With the tool (in Lithuanian) you can find out free of charge, in a few questions, whether you must keep a record and which of your processes carry risk. A record can also be ordered as a one-off procedure: €95 excl. VAT.

Does the employee have to sign the notice?
In general the GDPR does not require a signature, but you have to be able to prove you informed them. For video, audio, behaviour or location monitoring, Lithuanian law requires informing against signature or in another provable way (Article 5(4) of the Law on the Legal Protection of Personal Data).

Can the notice be part of the work rules?
Yes, if it is clearly separated and easy to find. A notice scattered across 40 pages of rules is not concise and intelligible as Article 12(1) GDPR requires.

Do we have to inform employees who already work here?
Yes, if they have not received this information yet. Article 13(4) GDPR removes the duty only insofar as the employee already has the information.

Do we need a separate notice for job candidates?
It is worth having one. A candidate's data, purposes and retention differ from an employee's. If the candidate sends the CV, inform them then; if it comes through a recruitment agency, the Article 14 GDPR timing applies.

• Who in the company may see employee data? (in Lithuanian)
• How long to keep employee data? (in Lithuanian)
• May we film our premises and grounds? (in Lithuanian)
• Employee photos on the website and social media

The law and the risk: Why an employee's consent to data processing is almost never valid – dat.lt

• Content of the information – Article 13(1) and (2) GDPR; naming the legitimate interest – Article 13(1)(d); a new purpose – Article 13(3); exemption where the person already has the information – Article 13(4).
• Data not obtained from the person – Article 14 GDPR.
• Concise, plain form – Article 12(1) GDPR.
• Duty to demonstrate compliance – Article 24(1) GDPR.
• Workplace monitoring: informing against signature or in another provable way – Article 5(4) of the Law on the Legal Protection of Personal Data (ADTAĮ).
• Candidate data from a former or current employer – Article 5(3) of the Law on the Legal Protection of Personal Data (ADTAĮ).
• The employer's duty to respect employees' privacy and data protection – Article 27(1) of the Labour Code.
• Informing the works council on monitoring rules and data retention policy – Article 206(1) of the Labour Code, points 5 and 7.
• Right to withdraw consent – Article 13(2)(c) GDPR; categories of recipients – Article 13(1)(e); compatibility of a new purpose – Article 6(4).

GDPR read from the official consolidated English text (02016R0679, 04.05.2016). ADTAĮ – Register of Legal Acts, consolidated version from 2026-06-30. Labour Code – e-tar.lt consolidated version from 2026-06-07. Laws quoted are Lithuanian; English wording of Lithuanian provisions is our translation. This text is general information and is not individual legal advice.