The issue of security and compliance with GDPR and legislation in general is central to the Human Resources module. AyMINE was created at a time when GDPR was already in force and was born by an expert on GDPR (among other things, he was responsible for meeting GDPR requirements in large organizations). At the same time, the whole system is built to protect data – not only human resources – as much as possible. Therefore, Human Resources used the whole concept of the system, which puts security first.

Can system administrators see the data?

They can't. Until an employee has one of the above-mentioned roles, he or she is not authorized to look at the data.

Access control applies not only to administrators within the organization, but also to system administrators. Data from the Human Resources module can never be looked at by any system administrator, because it is possible to work with it only within the account of your organization. System administrators do not have an account of your organization.

System administrators can see data about users!

Yes, system administrators can see the system accounts overview, but this is not the data of the HR module. The system account contains:

First name (required)
Last name (required)
Email (required)
Phone number (optional)

This data does not have to match the data in the HR module. The data is needed for the administration of the system – e.g. to allow system support to respond to a query or problem of the user.

Is the system fully compliant with the GDPR?

Yes, it is. From the GDPR point of view, not only the protection within the HR module is important, but throughout the system.

Both the system itself and its operation are compliant not only with the GDPR, but also with other legislation. Even if you are using a system hosted as a service, the system complies with all security requirements.

The data is located in the European Union
The system can forget a worker, but at the same time store the data necessary to preserve for reasons of legislation or legitimate interests of the organization
The system allows a worker to verify what data the organization holds about him or her. As part of the work overview – the worker's dashborad has a view of this data, but cannot change it (He must report the change to the HR officer)

The worker expressed suspicion that someone had accessed his data

The system – as well as the basic registers of the state – records each individual access to the HR folder by the HR officer. The worker can therefore check whether the HR officer has accessed the data.

The system does not individually register the approaches of the payroll accountant. It is not about access to individual data, but about mass data processing mandatory by law. It is registered as a mass access, which is not displayed to the workers.