{"id":2831,"date":"2026-10-20T11:31:36","date_gmt":"2026-10-20T11:31:36","guid":{"rendered":"https:\/\/sawaryn.com\/us\/?p=2831"},"modified":"2026-10-20T11:46:13","modified_gmt":"2026-10-20T11:46:13","slug":"employee-data-sharing-corporate-group-dpa","status":"publish","type":"post","link":"https:\/\/sawaryn.com\/us\/employee-data-sharing-corporate-group-dpa\/","title":{"rendered":"Sharing Employee Data Within a Corporate Group: When a DPA Is Not Enough"},"content":{"rendered":"

Sharing Employee Data Within a Corporate Group: When a DPA Is Not Enough<\/h1>\n

\u201cAdd the parent company to the system\u2014we already have a DPA.\u201d<\/p>\n

For a business operating in Poland, that request may sound routine. But an existing data processing agreement (DPA) does not necessarily authorize the access. If the parent company wants to review pay data to calculate its own margins, monitor costs, or oversee remuneration, it is not acting on the system operator\u2019s instructions. For that activity, it acts as a separate controller. That calls for a different document, a separate assessment of the legal basis, and a narrower view of the data it needs.<\/p>\n

Confusing controllers, processors, and joint controllers is a recurring problem in intra-group GDPR documentation. Decisions of Poland\u2019s data protection authority\u2014the President of the Personal Data Protection Office (PUODO)\u2014document repeated Article 28 GDPR failures, including missing written processing agreements, incomplete descriptions of data categories, and documentation put in place only after an incident<\/a> (UODO: several GDPR infringements result in a fine<\/a>).<\/p>\n

The practical starting point is one question: Whose purpose is the access serving?<\/strong> The answer guides the choice of agreement, the scope of access, transparency notices, retention periods, and system configuration.<\/p>\n

Start with the parties\u2019 actual roles<\/h2>\n

GDPR roles depend on what each entity actually decides and does\u2014not on the title of an agreement or the fact that the entities belong to the same group.<\/p>\n\n\n\n\n\n\n\n
Role<\/th>\nMeaning<\/th>\nExample<\/th>\n<\/tr>\n<\/thead>\n
Controller<\/strong> (Article 4(7) GDPR)<\/td>\nAn entity that determines the purposes and means of processing personal data<\/td>\nA parent company analyzes remuneration data for its own financial monitoring<\/td>\n<\/tr>\n
Processor<\/strong> (Article 4(8) GDPR)<\/td>\nAn entity that processes data on a controller\u2019s instructions<\/td>\nAn external IT provider operates an HR system for a company<\/td>\n<\/tr>\n
Joint controllers<\/strong> (Article 26(1) GDPR)<\/td>\nTwo or more entities that jointly determine the purposes and means of processing<\/td>\nTwo companies run a recruitment process together and jointly set its rules<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

In its decisions, the Polish authority refers to EDPB Guidelines 07\/2020 and notes that an entity need not have physical access to data to be its controller (UODO: which entity should be regarded as the controller<\/a>).<\/p>\n

A DPA<\/strong> is an Article 28 data processing agreement<\/a>. It governs processing by a processor on a controller\u2019s instructions. A controller-to-controller data-sharing agreement<\/strong> addresses disclosure between separate controllers that process the data for their respective purposes.<\/p>\n

Ask \u201cwhose purpose is it?\u201d before granting access<\/h2>\n\n\n\n\n\n\n\n
Why the recipient accesses the data<\/th>\nRecipient\u2019s role<\/th>\nAppropriate document<\/th>\n<\/tr>\n<\/thead>\n
To carry out the system controller\u2019s purpose on that controller\u2019s instructions<\/strong><\/td>\nProcessor<\/td>\nDPA under Article 28 GDPR<\/td>\n<\/tr>\n
For its own purposes<\/strong>, such as oversight, financial monitoring, or cost allocation<\/td>\nSeparate controller<\/td>\nController-to-controller data-sharing agreement<\/td>\n<\/tr>\n
To pursue purposes and means determined jointly<\/strong> by both entities<\/td>\nJoint controllers<\/td>\nArrangement under Article 26 GDPR<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

Shareholder oversight, margin analysis, cost allocation, and review of employment terms are purposes of the parent company when it undertakes them for itself. They are not converted into the system operator\u2019s purposes by a broadly drafted DPA.<\/p>\n

Joint controllership is not an automatic alternative. In Fashion ID<\/em> (C-40\/17, 29 July 2019), the Court of Justice of the European Union confirmed that joint controllership can be limited to a distinct stage of processing; it does not extend to operations whose purposes or means an entity does not determine (EUR-Lex link cited for the judgment<\/a>). Group membership, a shared brand, or use of the same system does not, by itself, make companies joint controllers.<\/p>\n

Why the group\u2019s existing DPA may not cover the system<\/h3>\n

A \u201cmutual\u201d group DPA may describe the data as \u201ccontact and basic details of the parties\u2019 personnel and customers.\u201d A recruitment and personnel-records system may expose much more:<\/p>\n

    \n
  1. Candidates\u2019 CVs, which may include special category data under Article 9 GDPR<\/li>\n
  2. Hourly rates and availability<\/li>\n
  3. Subcontracting information<\/li>\n
  4. LinkedIn profiles and activity history<\/li>\n<\/ol>\n

    Retrieve the signed DPA and compare its stated categories with what a user can actually see. If it covers \u201ccontact details\u201d but the system exposes CVs and rates, its description does not cover that access. And if the recipient uses the data for its own purposes, expanding the DPA\u2019s wording will not resolve the underlying role mismatch.<\/p>\n

    What goes wrong when roles are misclassified<\/h2>\n

    Treating a separate controller as a processor can create several GDPR risks at once. An infringement of Article 6(1) GDPR falls within Article 83(5)(a), which provides for a maximum fine of EUR 20 million or 4% of total worldwide annual turnover<\/strong> (GDPR, Article 83<\/a>).<\/p>\n

    No appropriate legal basis<\/h3>\n

    A DPA does not itself provide the parent company with a legal basis to process data for its own purposes. If access is granted under a DPA but used for the parent\u2019s own oversight or analysis, the Article 6(1) basis must be assessed separately. PUODO has used both reprimands and substantial fines for processing without a legal basis. In 2025, it fined Poland\u2019s postal operator, Poczta Polska, PLN 27 million for such processing (UODO notice<\/a>).<\/p>\n

    Excessive access<\/h3>\n

    Giving the parent a full system view \u201cfor convenience\u201d can breach the data minimization principle in Article 5(1)(c) GDPR. A finance team may need to know who worked for which client and at what rate. It does not follow that it needs a candidate\u2019s address, bank account number, employment history, or entire CV.<\/p>\n

    Unclear retention<\/h3>\n

    \u201cPermanent access\u201d or \u201caccess until revoked\u201d may describe how long an arrangement remains in force. It cannot stand in for a retention period for reports containing personal data. Article 5(1)(e) GDPR requires storage for no longer than necessary for the processing purposes (GDPR, Article 5<\/a>).<\/p>\n

    Notices that do not match practice<\/h3>\n

    If employees or consultants are told that only Company A sees their data, while Company B can also access it, the discrepancy creates a transparency problem and may prompt complaints.<\/p>\n\n\n\n\n\n\n\n\n\n
    Risk<\/th>\nTypical cause<\/th>\nPossible consequence<\/th>\n<\/tr>\n<\/thead>\n
    No appropriate legal basis<\/td>\nRecipient\u2019s role is misclassified<\/td>\nFine of up to EUR 20 million or 4% of turnover<\/td>\n<\/tr>\n
    Failure to minimize data<\/td>\nAccess is broader than the purpose requires<\/td>\nOrder to restrict processing<\/td>\n<\/tr>\n
    Indefinite retention<\/td>\nNo report retention period is set<\/td>\nChallenge by an individual or supervisory authority<\/td>\n<\/tr>\n
    Inaccurate privacy information<\/td>\nNotice and system access differ<\/td>\nComplaints or PUODO proceedings<\/td>\n<\/tr>\n
    Business delay<\/td>\nDocuments and permissions have not been aligned<\/td>\nMargin and cost monitoring cannot proceed as planned<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

    An eight-step plan for intra-group access<\/h2>\n

    1. Determine roles separately for each processing activity<\/h3>\n

    One DPA \u201cfor everything\u201d is not enough. For each proposed use, establish:<\/p>\n

      \n
    1. Who determined the processing purpose?<\/li>\n
    2. Was that purpose decided jointly?<\/li>\n
    3. Who decides the essential means of processing?<\/li>\n
    4. Is one company acting solely on the other\u2019s instructions?<\/li>\n<\/ol>\n

      Teach the IT, HR, and administrative staff who grant access to ask \u201cwhose purpose is it?\u201d before adding a user. This simple check can prevent wrongly executed group DPAs.<\/p>\n

      2. Select the document that matches those roles<\/h3>\n\n\n\n\n\n\n\n
      Situation<\/th>\nDocument<\/th>\n<\/tr>\n<\/thead>\n
      Company A operates the system; Company B processes data on A\u2019s instructions<\/td>\nArticle 28 DPA\u2014update the existing agreement as needed<\/td>\n<\/tr>\n
      Company B accesses data for its own financial monitoring or oversight<\/td>\nController-to-controller data-sharing agreement<\/td>\n<\/tr>\n
      Both companies jointly determine purposes and means<\/td>\nArticle 26 joint-controller arrangement<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

      The document should reflect the actual activity, not be used to assign a convenient label to it.<\/p>\n

      3. Reduce the data to what the purpose needs<\/h3>\n

      Instead of sending full employment contracts, request an individual-level report. A complete contract can contain remuneration, a bank account number, an address, and potentially special category data under Article 9 GDPR. Sending the whole document for a narrower financial purpose breaches the data minimization principle.<\/p>\n

      A report for the stated oversight purpose could contain:<\/p>\n