Hamburger
  • Legal system, currency, language

    Constitutional. The official currency is the Kwanza (AOA). The official language is Portuguese.

  • Corporate presence requirements & payroll set-up

    A foreign entity may engage employees in Angola with proper payroll registrations, subject to business, corporate and tax considerations. The employer is responsible for withholding from an employee's pay, and delivering to the tax authority, income tax and contributions to Angolan social security. The level of income tax is defined by the government and varies in line with the employee's salary.

  • Pre-hire checks

    Required

    Immigration compliance and pre-hire medical examinations.

    Permissible

    Reference and education checks are permissible.

  • Immigration

    Criminal and medical checks must be issued by competent authorities, a criminal record must be issued by the home country and a medical certificate must be issued by a doctor in the employee’s home country.

    The visa/work permit requirements for overseas nationals to work in Angola are having a recognized travel document valid for the Angolan territory for at least 6 months, being of legal age, not being included in the national list of undesirable persons prohibited from entering into the national territory, not constituting a danger to public order or to social security interests, complying with all health regulations established by the Ministry of Health for entry into the national territory, having an employment contract or promissory employment contract, having a certificate of professional and educational qualifications and curriculum vitae, and obtaining a positive opinion of the competent Ministry.

  • Hiring options

    Employee

    Indefinite-term contract (which is the rule), fixed-term or open-term (ie, a term contract whose termination date has not yet been defined, but that will be terminated as soon as the underlying need for contracting is no longer verified – for example, as a contract to cover absence), part-time contract, telework contract and contract under service commission regime – a particular type of contract for high-level employees which provides flexibility for termination and is not common. The parties may execute an employment contract for a fixed term or open term, which must be done in writing.  Part-time, fixed-term and open-term employees may not be discriminated against due to their status.

    Independent contractor

    Independent contractors may be engaged directly by the company or via a personal services company. Engagement may be subject to misclassification exposure. The factors that tend to indicate an individual is an employee (rather than, for example, a self-employed independent contractor) are the existence of a work schedule, the scheduling of vacation, the worker’s legal subordination to the company, the company’s authority, direction and disciplinary powers, control of punctuality and attendance over the individual, integration into the structure of the company and use of work tools belonging to the company, among others.

    In the event of misclassification, the relationship may be converted into an employment relationship on a permanent basis, and the employer may be liable to pay a fine for non-compliance.

    Agency worker

    Agency workers may only be engaged to fulfill a temporary need for work. The agency work contract duration depends on the underlying reason for hiring and does not typically exceed 12 months. Agency workers have the right to equal treatment to employees in relation to pay and other regular benefits.

  • Employment contracts & policies

    Employment contracts

    Written employment contracts are common but not mandatory, except for fixed-term, part-time, telework and service commission regime contracts as well as contracts with foreign employees and underage employees. Employment contracts cannot contain conditions that are less favorable to employees than mandatory employment legislation.

    Probationary periods

    Permissible.

    Employment contracts for an unlimited period of time may be subject to a probation period corresponding to the first 60 days of performance of work; the parties may, by written agreement, reduce or waive this period.

    The parties may extend the probation period, in writing, to up to 4 months in case of employees who perform highly technical, complex work that is difficult to evaluate, and to up to 6 months in case of employees who perform management duties.

    In an employment contract for a limited period of time, the parties may set forth a probation period in writing, and its duration cannot exceed 15 days in case of non-qualified employees, or 30 days in case of qualified employees. Angolan law does not define qualified and non-qualified, but the common practice is that qualified employees correspond to positions that involve technical complexity, a high degree of responsibility or special qualifications as well as those carrying out functions of trust.

    Policies

    Employers with more than 50 employees must, in order to organize the work and labor discipline, draft and approve employee handbooks, guidelines, instructions, service orders and work rules defining rules for the technical organization of work, performance of work and work discipline, delegation of powers, employee job descriptions, safety, hygiene and health protection of work, performance indicators, a remuneration system, working hours for the several sections of the company or work center, control of entrances and exits and circulation within the premises of the company, and surveillance and control of production.

    Employers with 50 or fewer employees may, but are not required to, implement employee handbooks on the matters described above.

    Third-party approval

    Whenever the employee’s handbook or any other rules and regulations establish rules on performance and discipline, remuneration systems, work performance or safety, hygiene and health protection at work, the employer must forward such regulations for information and registration purposes to the General Labor Inspectorate.

  • Language requirements

    Portuguese. Nevertheless, employment contracts and other documents may be drafted in a bilingual template.

  • Minimum employment rights

    Employees entitled to minimum employment rights

    All employees are entitled to minimum employment rights.

    Working hours

    Maximum daily and weekly working hours are 8 hours per day and 44 hours per week. Overtime pay is required for hours worked in excess of these limits. These limits are inapplicable to employees who perform direction and leadership duties, duties of inspection, or provide direct support to the employer. In case the employee usually performs their work outside the company's premises, an exemption regime may also be agreed upon by the parties, in which case those limits shall not apply. Typically, employees under the exemption regime are entitled to an exemption bonus.

    Overtime

    Overtime may occur with an extraordinary increase in workload, to prevent serious damage or if due to majeure force. It is subject to the following maximum limits: (a) 2 hours per day, (b) 40 hours per month and (c) 200 hours per year.

    Overtime must be compensated with additional payment (ie, an increase of hourly rates) up to 30 hours per month: 50 percent. 30 percent, 20 percent and 10 percent depending on whether it is a large, medium, small or micro company dependent on number of employees and turnover. A company which is a subsidiary or branch of a company with headquarters abroad always qualifies as a large company. Overtime that exceeds that limit is paid for each hour at an additional 75 percent, 45 percent, 20 percent and 10 percent depending on whether it is a large, medium, small or micro company.

    Wages

    The minimum wage is established by Presidential Decree. It is set out as a general minimum wage, but there is also a minimum wage for trade and extractive industry groups, transport services and manufacturing groups and agriculture groups. Under the Decree currently in force, the general minimum wage is AOA21,454.10. The following sector-specific minimum wages also apply:

    • Trade and extractive industry groups: AOA32,181.15
    • Transport services and manufacturing groups: AOA26,817.63 and
    • Agriculture groups: AOA21,454.10.

    Vacation

    Minimum 22 working days per year, plus 12 public national holidays.

    Sick leave & pay

    Employees are entitled to take off as much time as they need for sick leave. For large and medium companies: In case of incapacity to work due to illness or common accident, pay is required in the amount corresponding to 100 percent of the base salary for a period of 2 months. For as long as the employee is not entitled to protection in case of illness or common accident from the social security authorities, the employer must pay to the employee 50 percent of salary from the 3rd to the 12th month.

    In case of small and micro companies: The employee is paid, in case of illness or common accident, the amount of 50 percent of the base salary within 90 days, after which the contract is terminated by expiration if the condition of illness remains.

    Maternity/parental leave & pay

    A pregnant employee is entitled to a paid maternity leave of 3 months. The amount of the maternity allowance is equal to the average of the 2 best monthly salaries from the 6 months preceding the commencement of the maternity leave. The maternity allowance is paid directly by the employer to the employee and, subsequently, the Social Security services reimburse the employer in full. Fathers are not entitled to any leave on the birth of a child; it is only considered as a justifiable reason for absence from work for 1 day.

  • Discrimination

    Discrimination based on the following protected characteristics is prohibited: race, color, gender, ethnic origin, marital status, origin or social rank, religious beliefs, political opinion, union affiliation and language.

  • Benefits & pensions

    Both employer and employee must pay contributions to social security in Angola to cover various employee benefits (eg, maternity leave payment and retirement pension). The employer must withhold the contribution due by the employee and deliver both contributions (ie, employer and employee) to social security every month.

    Current general rates are 3 percent of the gross wage for the employee and 8 percent for the employer.

    Employees with a minimum contributory period (ie, 35 years) qualify for a retirement pension at age 60 or in cases of total incapacity.

    Employers have no legal obligation to provide complementary or supplementary social benefits in addition to the social coverage provided for by the social public scheme. However, some companies – mostly large companies or multinational companies who have their own schemes worldwide – set up and provide private complementary health and pension schemes to their employees.

  • Data privacy

    The Data Privacy Law No. 22/11, June 17 governs Angolan data privacy and determines, in general terms, how to collect, use, disclose, store and give access to "personal information."

    There is no specific regulation on employee data privacy.

  • Rules in transactions/business transfers

    Provided that the same business activity is maintained, the new employer takes the position of the former employer in the employment contracts and takes their position in respect of the rights and obligations arising from the employment relationships. This is the case even if the employment contract is terminated before the transfer. The new employer takes their position as the employer of such former employees in respect of due and non-paid credits. All credits, rights and obligations of the employer arising from the execution and implementation of the employment contract, its violation or termination are subject to a statute of limitations of 1 year starting on the day following the day of termination of the contract. Employees keep the same seniority and acquired rights which they had in the service of their former employer.

    The new employer undertakes the obligations of the former employer limited to those incurred during the 12 months prior to the modification, provided that, up to 22 business days prior to the modification, the new mployer gives notice to the employees that they must claim their credits up to the 2nd business day prior to the date scheduled for such modification. Within 22 business days following the modification of employer, the employees have the right to terminate the employment contract with prior notice, but this does not confer any right to compensation.

  • Employee representation

    Employee representative bodies are permissible but not mandatory.

    Trade unions are not common in Angola.

    In order to carry out their duties, trade union representatives are entitled to 4 paid hours a month but must notify the employer in advance of the date and number of days they require for the exercise of trade union functions. Employers are obliged to provide a suitable place for workers' meetings whenever this is requested by the union representatives. Special protections against dismissal are granted to employees who perform, or have performed, duties as union representatives, either as leaders or delegates, or members of the employees’ representative body performing union-related activities.

  • Termination

    Grounds

    Unilateral termination by the employer: dismissal based on objective grounds (ie, redundancy reasons); disciplinary dismissal with just cause (ie, based on serious breach of the employee's duties).

    Termination without cause (with notice): only for employees hired under an employment contract of service commission regime (a particular type of contract for high-level employees which provides flexibility for termination but is not common).

    Other termination causes: mutual agreement, termination by the employee (ie, termination with notice or constructive dismissal with just cause), expiration (ie, fixed-term and open-term contracts or retirement).

    Employees subject to termination laws

    All employees.

    Restricted or prohibited terminations

    Special protection against dismissal is granted to employees who perform, or have performed, duties as union representatives, either as leaders or delegates, or members of the employees’ representative body performing activities; women covered by the regime of maternity protection; war veterans as per the definition provided by the applicable law; employees under the legal age; employees with a reduced work capacity or with a disability degree equal or higher than 20 percent.

    As a general rule, a copy of the notice served on the employee must be forwarded to General Labor Inspectorate.

    Third-party approval for termination/termination documents

    Except in respect of protected employees, third-party approval is not required to terminate an employment.

    Mass layoff rules

    If economic, technological or structural circumstances occur, which may be clearly demonstrated and which involve an internal reorganization or conversion, or the reduction or the shutting down of activities, which makes it necessary to eliminate or significantly change job positions, the employer may terminate the employment contracts of the employees who perform such job positions.

    Collective dismissal rules are triggered if the dismissal involves at least 20 employees.

    Information to the General Labour Inspectorate is required. However, there is no need to obtain approval for termination.

    The General Labor Inspectorate may undertake the diligence deemed necessary for clarification of the situation and, in case of a collective dismissal, during the period in which the evaluation of the General Labor Inspectorate occurs, the employer may promote a meeting with the representative body or with the committee appointed for the purpose of exchange of information and clarification and may forward the conclusions of the meetings to the General Labor Inspectorate.

    Notice

    For individual dismissals based on objective grounds (up to 20 employees): the employer must forward, at least 30 days in advance, prior notice of dismissal to the employee or employees who occupy the job positions to be extinguished or transformed.

    For collective dismissal: the prior notice is 60 days.

    Notice periods in case of term contract: 15 business days if its duration is equal to or higher than 3 months.

    Statutory right to pay in lieu of notice or garden leave

    Payment in lieu of notice is permitted (and required if the notice period is not honored).

    Garden leave is allowed during the notice period.

    Severance

    Fair dismissal based on objective grounds (redundancy/collective dismissal):

    • Large companies: compensation corresponds to 1 base salary for each year of effective service up to the limit of 5 and an additional 50 percent of the base salary multiplied by the number of years of service that exceed such limit
    • Medium companies: compensation corresponds to 1 base salary for each year of effective service up to the limit of 3 and an additional 40 percent of the base salary multiplied by the number of years of service which exceed such limit
    • Small companies: compensation corresponds to 2 base salary and an additional 30 percent of the base salary multiplied by the number of years of service which exceed the limit of 2 years
    • Micro companies: compensation corresponds to 2 base salary and an additional 20 percent of the base salary multiplied by the number of years of service which exceed the limit of 2 years

       

      Fair disciplinary dismissal: no severance.

      Higher severance payments may be agreed and are usual as a way to avoid litigation.

  • Post-termination restraints

    A clause of the employment contract which restricts the activity of the employee for a period of time, which may not exceed 3 years from the termination of the contract, is lawful if the following conditions are met: (a) such clause is included, in writing, in the employment contract, or in its addendum; (b) the activity performed may cause real damage to the employer and may be considered as unfair competition; (c) the employee is paid a salary during the period of restriction of work: the corresponding amount will be included in the contract or its addendum, and it must be taken into account, in its calculation, the fact that the employer may have incurred in significant expenses in the professional training of the employee.

    A clause which requires an employee who benefits from professional improvement or higher level education at the expense of the employer to remain at the service of the same employer for a certain period of time, provided that such period does not exceed 1 year, in case of training of professional improvement and up to 3 years in case of courses of high level education, is also lawful if established in writing. In this case, the employee may release themselves from remaining at the employer’s service by repaying to the employer the amount of the expenses incurred by the employer, in proportion to the remaining time until the term of the agreed period. The employer that hires the employee within the period of restriction of activity in the company is jointly liable for the damages caused by the employee or for the amount not returned by the employee.

  • Waivers

    In principle, statutory rights cannot be waived and any waiver of such rights will be null and void.

  • Remedies

    Discrimination

    Fine corresponding to 5 to 10 times the average salary paid by the company.

    Unfair Dismissal

    The employee may challenge the validity of the dismissal before the labor courts.

    If the relevant court declares the dismissal to be unlawful, by final judgment, the employer must immediately re-instate the employee in the same job position and benefiting from the same previous conditions, or, alternatively, shall indemnify the employee (compensation is different depending on whether it is a large, medium, small or micro company and the cause of dismissal).

    In addition to re-instatement or the compensation, the employee is entitled to the base salaries they would have received if they had continued to perform work, until the date on which the employee finds a new job or up to the date of final judgment, whichever comes first, with a maximum limit of 6 months of base salary for large companies, 4 months to medium companies and 2 months for small and micro companies.

    Failure to inform and consult

    Not applicable.

  • Criminal sanctions

    Typically, non-compliance with employment laws leads to administrative proceedings which may lead to the payment of fines. If such non-compliance is based on violation of rights that deserve protection under criminal law, it may also lead to this type of judicial proceedings.

  • Key contacts

Data privacy

Angola

The Data Privacy Law No. 22/11, June 17 governs Angolan data privacy and determines, in general terms, how to collect, use, disclose, store and give access to "personal information."

There is no specific regulation on employee data privacy.

Argentina

The Argentine Data Privacy Law No. 25,326 (Ley de Protección de los Datos Personales or LPDP) protects the personal data stored in files, registers, data banks or other technical storage of data processing, whether public or private, in order to guarantee the right to honor and privacy of the data of individuals, as well as to restrict the access to such information, in accordance with the provisions set out in Article No. 43, third paragraph of the Argentine National Constitution.

Australia

Australia has stringent data privacy obligations. As a general rule, personally identifiable data may only be processed if it is required for the performance of the employment contract and constitutes an employee record. Certain acts and practices are exempt from the application of Australia's data privacy laws, but there are strict criteria which must be met for an exemption to apply. Employee records are generally exempt, but this exemption will not apply to documents that come into existence prior to the employment relationship (eg, pre-employment or hire documentation) of any contractors engaged by the business. At the time it collects personal information, the employer is required to provide the individual with a statement setting out the company's obligations under Australia's data privacy laws and the individual's rights. Further restrictions apply for sensitive personal data. Employee records – with the exception of tax file numbers – are not covered by the Australian notifiable data breach regime, which requires notification to the Office of the Australian Information Commissioner (OAIC) and to affected individuals of any data breach that could result in serious harm. However, the OAIC advises that it is good practice for employers to notify employees affected by a data breach so that they may take protective action.

The monitoring of individuals and their data is covered by various surveillance legislation in each state or territory. Essentially, surveillance of employees is prohibited in sensitive areas, such as washrooms and change rooms, unless the surveillance device is installed pursuant to a warrant or authorization. Surveillance is permitted in public areas if it conforms with relevant legislation. The monitoring of an employee's use of a work computer (ie, emails and internet browsing) is governed by specific laws in some states.

Austria

Employees must be generally notified of personal data processing – and, in certain cases, must give consent. Strict rules apply to data transfer outside the EEA. Monitoring employees usually requires an agreement with the work counsel, if any, or an individual agreement with each employee. Since May 2018, Austria has been subject to the General Data Protection Regulation (GDPR), which has introduced significant new obligations and onerous sanctions for employers.

Bahrain

Personal data privacy is protected under Law No. 30 of 2018 with respect to Personal Data Protection (PDPL). Employees must be notified prior to processing their personal data, and their prior written consent should be obtained (unless exceptions stipulated under the relevant legislation are present) for such processing and transfer of their personal data.

Transfers of personal data out of Bahrain is prohibited unless the transfer is made to a country or region that provides sufficient protection to personal data. Those countries have yet to be listed by the Personal Data Protection Authority or published in the Official Gazette.

Belgium

Employees generally must be notified of personal data processing and, in certain cases, give consent. Registrations with the Privacy Commission are required in certain cases. Special rules apply to data transfer outside the EEA. Significant restrictions on monitoring email and internet use and use of cameras at the workplace. Since May 2018, Belgium has been subject to the General Data Protection Regulation (GDPR), which has introduced significant new obligations and onerous sanctions for employers.

Brazil

The new General Data Protection Law (Lei Geral de Proteção de Dados or LGPD) came into force on September 18, 2021. The LGPD is Brazil´s first comprehensive data protection regulation and applies to any processing operation carried out by a natural person or a legal entity, of public or private law, irrespective of the means used for the processing, the country in which its headquarters are located or the country where the data is located, provided that:

  • The processing operation is carried out in Brazil
  • The purpose of the processing activity is aimed at the offering or provision of goods or services, or at the processing of data of individuals located in Brazil, or
  • The personal data was collected in Brazil.  

The LGPD does not contain specific employment provisions, but its provisions cover employment data.

The monitoring of corporate email and internet use is allowed, but employees should be notified that they cannot expect privacy in the use of these work tools.

Canada

Legislative requirements vary by jurisdiction. Where privacy laws apply, personal information must only be collected with consent and may only be used for the purposes for which it was collected. In most jurisdictions, email and internet use may be monitored where notice has been given through clear employer policies.

Chile

The employer is obliged to maintain the privacy of the information and personal data related to its employees. The right to personal data protection has the status of constitutional right, and, therefore, any breach may lead to litigation for impairment of fundamental rights.

China

The Regulations on Employment Services and Employment Management require that an employee's personal data is kept confidential and not made public without the employee's consent.

The PRC Cyber Security Law imposes new security and data protection obligations on "network operators," puts restrictions on transfers of data outside China by "key information infrastructure operators" and introduces new restrictions on critical network and cybersecurity products.

The Civil Code strengthens protection on individuals’ privacy and personal information. It improves the legal definition of personal information and clarifies the connotation, principles and conditions of handling personal information as well as strengthens the information security obligations of processors.

Colombia

To process personal data, data controllers must provide a privacy notice to the affected employees prior to the collection and processing of personal data. In the case of data transfers, the privacy notice must contain the name of the transferee or the person to whom the information is transferred. All transfers of personal data to domestic or foreign third parties must be pre-approved by the data subject/employee.

Employees have the right to know, update and correct their personal data. This right may be exercised in relation to partial, inaccurate, incomplete, split or deceptive data, and/or data that is prohibited from or not authorized for processing, such as race or ethnic origin, political orientation, religious or philosophical orientation and enrollment to unions or social organizations, among other items considered sensitive information.

Employees may revoke the authorization granted for the processing of their personal data and may request to remove their personal information from the employers or subcontractor's databases by filing a formal claim, save for information directly related to their employment (eg, HR core data, recruitment, performance, global compensation learning and training-related data and master data). This possibility is only applicable in the case of wrongful use of the employee's information.

Czech Republic

Generally, employees must be notified of personal data processing (eg, camera recordings) and, in certain limited cases, give their consent (eg, for use of the employee’s personal data for marketing purposes). Significant restrictions on monitoring employees, including email and internet use.

The Czech Republic is subject to the General Data Protection Regulation (GDPR). The local law implementing the GDPR was issued in 2019.

Denmark

Employers must comply with the General Data Protection Regulation (GDPR) as of May 25, 2018 as well as the Danish Data Protection Act.

Employees have the right to detailed information about the processing of their data. All information provided must be concise, transparent, easily accessible and in plain language. Employers must provide information on the legal basis for processing and, if the data is sensitive, which of the conditions for processing special categories of personal data on which the employer relies. The notice must also advise the employees of their rights under the GDPR.

Finland

Employees must usually be notified about personal data processing and give consent to this when necessary. Only necessary data may be processed. Special rules apply to data transfers outside of the EEA. There are significant restrictions on monitoring email and internet use.

From May 2018, Finland has been subject to the General Data Protection Regulation (GDPR) which introduced significant new obligations and onerous sanctions for employers.

France

The General Data Protection Regulation (GDPR) came into force on May 25, 2018. It applies to any processing of personal data within the EU. The GDPR implements new rights for data subjects, such as right to access, data erasure, data portability and consent.

Where data processors/controllers process operations which require regular and systematic monitoring of data subjects on a large scale or of special categories of data, a Data Protection Officer (DPO) must be appointed.

Data transfers outside of the EU are subject to additional requirements. Significant restriction on monitoring internet and e-mail use even when on company's IT device.

Germany

Covered by the EU-wide General Data Protection Regulation (Datenschutzgrundverordnung, or GDPR) entered into force in May 2018 and the complementing Federal Data Protection Act. Processing of personal data is generally unlawful except as listed by the Act and the General Data Protection Regulation, a works council agreement or free and individual consent. Appointment of data protection officers is required if more than 9 individuals deal with electronically saved personal data. Special rules apply to data transfer outside the EEA. Significant restrictions on monitoring email and internet use exist.

Hong Kong, SAR

The PDPO is principally concerned with 6 data protection principles (DPPs). Broadly, these require:

  • That personal data is only collected for a lawful purpose, that only personal data that is necessary and not excessive for that purpose is collected and that individuals are informed of certain things before data is collected or used (DPP 1)
  • That all reasonably practicable steps are taken to ensure that personal data is accurate and that it is only retained for as long as is necessary to fulfill its purpose (DPP 2)
  • That personal data is not, without the prescribed consent of the job applicant or employee, used for a purpose other than the purpose for which it was collected (DPP 3)
  • That all reasonably practicable steps are taken to ensure that the personal data is secure and protected against unauthorized or accidental access, processing, erasure or other use (DPP 4)
  • That all reasonably practicable steps are taken to ensure that an individual may access information about the data user's policies and practices in relation to personal data, the kind of personal data about them that is being held and the purposes for which it will be used (DPP 5) and
  • That, with some exceptions, an individual is entitled to request access to all personal data held by a data user and to correct that data if it is inaccurate (DPP 6).

There are provisions in the PDPO that restrict the transfer of personal data outside of Hong Kong, but these are not currently in force.

Hungary

Employers must balance their need to obtain, use, store and disclose information for effective management and business purposes with their employees' right to privacy. The law distinguishes between ''personal data'' and ''sensitive personal data.'' Special rules apply for the transfer of personal data within and outside of the EEA. The National Authority for Data Protection and Freedom of Information is responsible for ensuring compliance and enforcing data protection.

Since May 2018, Hungary has been subject to the General Data Protection Regulation (GDPR), which introduced significant new obligations and onerous sanctions for employers.

India

Employee records and employee access to data

The Information Technology Act, 2000 covers data protection and violation of personal privacy. This statute safeguards against certain breaches in relation to data from computer systems, prevents unauthorized use of computers and creates liability for damage suffered in the event of unauthorized access, downloading, extraction and copying of data from a computer system or network. It stipulates the penalty for breaches of confidentiality and privacy.

The storage, management and handling of sensitive personal data or information belonging to persons located in India is regulated by the Sensitive Information Rules enacted under the Information Technology Act, 2000. The government of India has also released the Personal Data Protection Bill, 2019 (Data Protection Bill), which is being considered by the Indian government to replace the Sensitive Information Rules.

Sensitive personal data or information is defined under the Sensitive Information Rules to include passwords, financial information, physical, psychological and mental health conditions, sexual orientation, medical records and history, and biometric information.

Any body corporate receiving any of the above types of information as a result of either using the services of an individual or employing an individual must comply with the Sensitive Information Rules regarding processing and storing such information.

Indonesia

Law No. 11 of 2008 on Electronic Information and Transactions, as amended, restricts the electronic use of private data without the data subject's consent. Under Law No. 39/1999 on Human Rights, each individual has the right to their own privacy and cannot be subjected to an investigation in relation to personal data without their agreement, except on the order of a court or other legitimate authority under prevailing legislation. A new draft of the Data Privacy Law has been prepared, but it is not clear when it will be introduced.

Ireland

Since May 2018, Ireland has been subject to the General Data Protection Regulation (GDPR), which introduced significant new obligations and onerous sanctions for employers. GDPR requires employers to identify a legal basis for their processing of personal data, and it is unlikely that a catch-all consent will enable processing of employee data by an employer. Employers must ensure that they have GDPR-compliant documentation and that they are able to deal with the new rules on subject access requests. There continue to be significant restrictions on monitoring employees, including email and internet use.

Israel

Employees generally must be notified of the terms of the employer's personal data processing policy, and must consent to it. Registrations in the Databases Register may be required. Special rules apply to data transfer outside Israel. Significant restrictions on monitoring email and Internet use. Monitoring personal email is restricted.

Italy

Employees generally must be notified of personal data processing – and, in certain cases, give consent. Special rules apply to data transfer outside the European Economic Area (EEA). Not possible to control or monitor employees remotely with devices unless upon agreement with works council or authorization of the Labor Office, with the exception of the instruments used by the employee to carry out their work or to detect access or attendance.

Since May 2018, Italy has been subject to the General Data Protection Regulation (GDPR), which introduced significant new obligations and onerous sanctions for employers.

Japan

The receipt, maintenance of and access to personal information relating to an individual is regulated by the Act of Protection of Personal Information. Broadly, upon the collection of such information, the collector must notify the person of the purpose of the use of such information and thereafter must take necessary and proper measures to prevent leakage, loss or damage of that information, and take other reasonable steps to control the security of the personal information. In addition, the party maintaining such information is required to adopt internal regulations designed to ensure the confidential and secure maintenance of such information as long as it is held. Disclosure of personal information to third parties (parent and affiliated companies are considered third parties) is strictly limited.

Kenya

The Data Protection Act, 2019  gives effect to Article 31(c) and (d) of the Constitution on the right to privacy. The Act establishes the Office of the Data Protection Commissioner, makes provision for the regulation of the processing of personal data and provides for the rights of data subjects and obligations of data controllers and processors, among others. The Act is modeled along the lines of the EU General Data Protection Regulations (GDPR).

The Constitution guarantees the right to privacy.

The Computer Misuse and Cyber Crimes Act, 2018 creates various offenses, including the right to privacy, in relation to computer systems.

Kuwait

There are no clear laws in Kuwait comparable with those in the US or Europe concerning the handling and transmission of employees' personal information, nor do any provisions address the cross-border flow of data. However, it is advisable to seek prior written consent to the processing of personal data from the employee to the extent necessary to address the various privacy protections set out in Kuwait law, including the protections set out in the Kuwait Penal Code and the Kuwait Constitution.

Luxembourg

The General Data Protection Regulation (GDPR) has been in force since May 25, 2018. It has been complemented by the Luxembourg law of August 1, 2018 on the organization of the CNPD.

Since then, the processing of personal data is no longer subject to a prior notification to/authorization from the National Data Protection Commission (Commission Nationale pour la Protection des Données or CNPD). However, the processing of personal data for the purpose of supervising employees in the context of employment relationships may only be carried out by the employer under certain conditions.

The employee's consent does not legitimize the processing of data.

In case of conducting employee monitoring, the employer must first notify:

  • The employees concerned
  • All persons external to the company who may also be concerned (eg, customers, suppliers or visitors) and
  • If a surveillance system is used in the workplace, the staff delegation or, failing this, the Inspectorate of Labor and Mines (Inspection du travail et des mines or ITM).

Please note that a number of strict requirements apply in this context according to the Labor Code.

Data subjects have the right to lodge a complaint with the CNPD.

Malaysia

Collection and processing of personal data is governed by the Personal Data Protection Act 2010 (PDPA). Employers must obtain employees' consent (implied or express) before collecting and processing employees' personal data, and explicit consent is required if "sensitive personal data" is being collected. Employers must notify their employees of the nature and purpose of information being collected, to whom it is being disclosed, and that the employees have the right to access such data. Employee consent is also required before employee personal data is shared with third parties (for example, external payroll service providers).

As a result of the PDPA, an employee consent/notice document is required. This document has to be bilingual – in both English and Bahasa Malaysia – and is usually a separate document and referenced in the employment contract.

Mexico

To process personal data, data controllers must provide a privacy notice to the affected employees prior to the collection and processing of such personal data. In the case of data transfers, the privacy notice must contain the name of the transferee or the person to whom the information is transferred. All transfers of personal data to domestic or foreign third parties must be pre-approved by the data subject (ie, the employee).

Morocco

Employees must be notified of data processing in accordance with law No 09-08 on data protection. Employees' consent to the processing of their data is required. Employees should be given the right to have access to and modify/amend their personal data.

Employers must declare data processing to the National Control Commission for the Protection of Personal Data (Commission Nationale de protection des Données Personnelles).

Mozambique

The Constitution of the Republic of Mozambique, as well as the recently enacted Electronic Transactions Law (The Law No. 3/2017, of January 9), prohibits access to data bases or to computerized archives, files and records for obtaining information on the personal data of third parties, as well as the transfer of personal data from one computerized file to another that belongs to a distinct service or institution, except in cases provided for by law or by judicial decision.

The Labor Law establishes that employers may not require an employee to supply information regarding their private life, except when particular requirements inherent to the nature of the professional activity so require. In addition, employees' personal data obtained by an employer is subject to a duty of confidentiality, and information where the release of which would violate that employee's privacy rights may not be given to a third party without the consent of the employee, unless it is required by law.

Myanmar

There are not currently any specific laws or regulations in Myanmar relating to data privacy. However, per the Law Protecting the Privacy and Security of Citizens enacted on March 8, 2017, a person is not allowed to do the following without permission of the relevant authorities:

  • Request or acquire any private call data, electronic communications data and information from operators or supply such information
  • Open, search, seize, destroy or damage any envelope, parcel or correspondence communicated that are the personal affairs of other individuals and
  • Criticize or interfere in the personal affairs and family affairs of any citizen or engage in conduct that may be detrimental to the good name, standing or dignity of an individual

Other than the above, there are currently no other laws or regulations on data privacy.

Netherlands

Employees generally must be notified of personal data processing – and, in certain cases, give consent. Registrations with the Information Commissioner are required. Special rules apply to data transfer outside the EEA. Significant restrictions on monitoring email and internet use.

From May 2018, the country is subject to the General Data Protection Regulation (GDPR), which introduces significant new obligations and onerous sanctions for employers. In general, the GDPR aims at empowering individuals (including temporary employees, job applicants, contractors, trainees and other workers) with regard to controlling the use of their personal data and at harmonizing the data protection legislation across the EU.

New Zealand

The Privacy Act 2020 controls New Zealand data privacy and determines how employers collect, use, disclose, store and give access to ''personal information.''

Nigeria

The National Information Technology Development Agency published the Nigeria Data Protection Regulation, 2019 which safeguards the rights of natural persons to data privacy.

Norway

Notification to the employee is required. An obligation to notify the Data Inspectorate may apply. Significant restrictions on monitoring and control of employees. Special provisions apply for transmission of data outside the EEA.

Oman

There are no clear laws in Oman comparable to those in the US or Europe concerning the handling and transmission of employees' personal information. However, the Electronic Transactions Law, RD 69/2008 (ETL) provides for the protection of personal data and regulates the transfer of personal data outside of Oman.

The Cyber Crime Law, Royal Decree no. 12 /2011 (Cybercrime Law) provides that it is an offense to violate the privacy of individuals through technology and prohibits the collection of private data.

It is advisable to seek prior written consent from employees to the processing of their personal data to the extent necessary to overcome the various privacy protections set out in the applicable civil and criminal laws.

Peru

During the employment relationship, companies collect employee personal data. The processing of personal data must be done in accordance with the guiding principles provided by the law.

According to the Peruvian Data Protection Law, consent and privacy notices must be obtained/given before the personal data is obtained/processed. Pursuant to the law, personal data may only be processed and/or transferred with prior consent. Such consent must be free, informed, express and unequivocal. However, a company does not need the express consent of the employee to obtain personal data if this information is necessary for the operation of the employment relationship, but it must comply with the duty of inform about the processing of personal data.

Philippines

When an employer collects and processes personal information of its employees, especially sensitive personal information, the employer must comply with applicable guidelines on the adoption of organizational, physical and technical security measures and the registration thereof with the National Privacy Commission. The data subject must have given their consent prior to the collection, or as soon as practicable and reasonable. An employer's collection of personal information from its own employees does not require the employee's prior written consent, provided the personal information collected and the processes applied to such information are only to the extent necessary for compliance with legal requirements prescribed for an employer-employee relationship.

Poland

An employer is obliged to respect its employees' dignity and other personal rights, including their privacy and the confidentiality of the content of employees' private correspondence. There are statutory rules which forbid the secret monitoring of employees, and there are specific rules to introduce camera monitoring and other forms of employee monitoring, including monitoring of software and the internet, among others.

The Polish Labor Code sets forth specific rules regarding collecting and processing personal data of the candidates and the employees and, in particular, lists the types of data that may be requested by the employer. In matters not regulated by the Labor Code, general rules on data protection provided for in the Act on the Protection of Personal Data and the General Data Protection Regulation (GDPR) apply.

Portugal

Since May 2018, Portugal is subject to the General Data Protection Regulation (GDPR), which introduced significant new obligations and onerous sanctions for employers.

The local privacy law under the GDPR (Law no. 58/2019) entered into force on August 9, 2019. Limitations to the use of consent within a working relationship and video surveillance were introduced by this law.

Qatar

On November 2016, Qatar issued a new data protection law No. 13 of 2016 on Protection of Personal Data Privacy (Data Protection Law). Businesses must take action to protect the privacy of personal data or risk fines of up to QAR 5 million. Some of the key features of the new law are:

  • Personal data is defined as data relating to an individual whose identity is determined, or able to be reasonably determined, either through the data or through linking this data with other data
  • The Data Protection Law applies to personal data when it is processed electronically, or when it is accessed or collected or extracted otherwise in preparation for its electronic processing, or when it is processed in a traditional and electronic way together
  • The processing of personal data will be regulated in a way which bears similarities with existing data protection regulations elsewhere in the world
  • Particular protection will be provided to certain types of personal data, such as data relevant to children, to physical and mental health and to crimes referred to as sensitive personal data
    • For example, parental consent will be required in connection with the online collection and processing of the personal data of children
  • Businesses will need to implement suitable measures, including training, to protect personal data from loss, damage, modification, disclosure or illegal access
  • Direct marketing will require the prior consent of the intended recipient and, amongst other requirements, the relevant communication must include a means by which the recipient may opt-out of future communications

This law may sit alongside the Qatar Financial Centre data protection regulations. It is also important to note that as per the Qatar Penal Code it is advisable to seek prior written consent to the processing of personal data from the employee to the extent necessary to overcome the various privacy protections.

Romania

Employees must be informed of personal data processing – and in certain limited cases, must give consent.

Since May 2018, Romania has been subject to the General Data Protection Regulation (GDPR), which introduced significant new obligations and onerous sanctions for employers. Under the GDPR, specific rules apply to any personal data transferred outside the European Economic Area aimed at ensuring that appropriate safeguards are provided for the transferred personal data and that enforceable data subject rights and effective legal remedies for data subjects are available.

Monitoring of employees, including email and internet use, may be performed under very specific circumstances, provided that the legal provisions which impose restrictions on interference with the protection of private life, data privacy and electronic communications are complied with.

Russia

In certain cases, employers are required to obtain the prior written consent of their employees in order to process their personal data (eg, transferring personal data to third parties including cross-border transfers).

Saudi Arabia

Transfer of employee data outside of the KSA is not regulated under Saudi law. However, general Shariah principles provide for personal data protection rules which imply that employers should include provisions in employment contracts where the employee's consent is required for the employer to use or disclose the employee's data to third parties, to the extent that such disclosures may be required.

Singapore

Generally, employers are required to at least notify applicants of the purposes for which their personal data is being used in connection with the management and termination of employment and/or obtain their consent where collecting, using or disclosing their personal data.

However, under the PDPA, an employer is permitted to collect, use and disclose the employees' personal data for purposes of managing or terminating an employment relationship without the need to seek employee's consent, so long as the employee has been notified of the purposes of such collection, use and disclosure and/or provides their consent prior to such collection, use and disclosure. Further, employers may collect, use and disclose personal data without obtaining the employees' consent or notifying them where it is necessary for evaluative purposes, including the determination of the suitability or eligibility of an individual to whom the data relates for employment, continuance in employment or promotion.

Note that employers must seek consent for purposes that are not related to, or for the collection of personal data that is not relevant to, the management or termination of an employment relationship or that are not relevant for evaluative purposes, unless any other exception under the PDPA applies.

Slovak Republic

Covered by the national data protection laws and EU rules. Processing of personal data is generally unlawful except as listed in relevant legislation or based on consent of the individual. Special rules apply to data transfers outside the EEA.

In general, an employer may collect personal information on an employee which relates to their qualifications and professional experience, and other information which is relevant to the work carried out by the employee.

From May 2018, Slovakia is subject to the General Data Protection Regulation (GDPR), which introduced significant new obligations and onerous sanctions for employers. In specific cases, also Act No. 18/2018 Coll. on Personal Data Protection, as amended, applies.

South Africa

The right to privacy is protected under the Constitution of the Republic of South Africa, 1996, the common law and the Protection of Personal Information Act, 2013 (POPIA), which came into effect on July 1, 2020 but is subject to a grace period until June 30, 2021. Case law recognizes that the right to privacy is not absolute and may be limited where it is reasonable and justifiable to do so. Personal information may be processed on the basis of one of the justifications for processing personal information under POPIA. These justifications include consent and where it is necessary for pursuing the legitimate interests of the responsible party or employer or third party to whom it is disclosed.

South Korea

Under the PIPA, an employee is entitled to request the employer to allow access to, correct or delete their personal information. The PIPA requires an employer to obtain the consent of the individual employee when their personal information is obtained or provided to third parties.

Spain

Spain is subject to the General Data Protection Regulation of the European Union (GDPR). The Spanish legislation that implements the GDPR is the Organic Law 3/2018 on data protection and guarantee of digital rights (Ley Orgánica 3/2018 de protección de datos y garantía de los derechos digitales). Employees must generally be notified of personal data processing (and, in certain cases, must give consent). Registration of databases with the Spanish Data Protection Commissioner (AEPD) is no longer required. Special rules apply to data transfers, even between companies belonging to the same group. Prior stringent restrictions on international data transfers, on monitoring email and internet use in the workplace and on video surveillance at work, have been eased and aligned with the GDPR, although significant compliance requirements remain.

Sweden

The General Data Protection Regulation (Regulation (EU) 2016/679) (GDPR), applicable since May 25, 2018, applies to the processing of employees' personal data. The employer must ensure that the fundamental requirements for processing of the employees' personal data are fulfilled (eg, personal data must be correct, adequate and relevant in relation to the purposes of the processing and may not be retained for a longer period than is necessary in light of the purposes of the processing); there must be a legal basis for the processing, such as performance of the employment agreement or consent; and the employee must receive adequate information regarding the processing. Special rules apply to data transfers outside the EEA. Sweden has also issued national laws and regulations in addition to the GDPR including the Swedish Data Protection Act (2018:218) and the Data Protection Ordinance (2018:19) (the DPA). The DPA regulates general aspects of data protection where the GDPR allows (eg, processing of social security numbers and processing of data pertaining to criminal offenses. The DPA entered into force on May 25, 2018.

Switzerland

In general, employees should be notified of any processing of their personal data – and, in certain cases, give consent. Registrations with the Federal Data Protection Commissioner are required in certain circumstances. Special rules apply to data transfers outside of Switzerland. There are significant restrictions on monitoring email and internet use.

Taiwan, Republic of China

The collection, processing and use of employee personal information is governed by the Personal Data Protection Act. The Act has notice and consent requirements that may be applicable to the collection, processing and use of employee information. This applies to cross-border transmission of the information or any use outside of the norms of a domestic employment relationship.

Under amendments to the Employment Service Act that came into force in late 2012, the amount of personal information that an employer may request from an employee or prospective employee has been severely restricted. Prohibited or restricted requests for personal information include physiological information (eg, medical tests and fingerprints), psychological information (eg, psychiatric tests and polygraph tests) and personal lifestyle information (eg, financial records, criminal records, family information / plans and background checks).

Thailand

The Personal Data Protection Act B.E. 2562 (2019) (PDPA) was enacted on May 28, 2019 and has full effect from June 1, 2021. The PDPA is the first-ever law relating to personal data protection in Thailand. Essentially, consent is required for the collection, use and/or disclosure of personal data. Under the PDPA, the term “personal data” is defined as any data pertaining to a person that enables the identification of that person, whether directly or indirectly, but specifically excludes data of someone who is deceased.

Tunisia

Under Tunisian law, all people have the right to the protection of personal data related to their private life and this applies to both automated and non-automated treatment of data. Personal data is defined as information that directly or indirectly permits the identification of a physical person, except for data linked to public life or defined as such under the law. In general, any organization planning to use personal data must make a declaration of the data to be used to the National Authority for the Protection of Personal Data, though there are exceptions for employers using employee data. In addition, express written consent from the data subject is required in most cases.

Turkey

Employees must be notified of personal data processing, and their prior written consent should be obtained (unless exceptions stipulated under the relevant legislation are present) for such processing and transfer of their personal data. Personal data should be processed:

  • In accordance with the law
  • In good faith
  • For definite, clear and legitimate purposes
  • In a relevant and measured manner

Data controllers (ie, individuals or legal entities that determine the purposes and means of processing personal data – for example, employers) are required to be registered with the Data Controllers Registry.

Uganda

The Data Protection and Privacy Act, 2019 was passed into law to supplement constitutional privacy protections under Article 27 of the Constitution of the Republic of Uganda. The Act regulates personal data collection, processing, use and disclosure, and applies to any person, entity or public body within or outside of Uganda who collects, processes, holds or uses personal data.

The Act requires an employer to obtain informed consent prior to collecting or processing an employee’s personal data. The Act permits processing or storage of personal data outside Uganda if adequate measures are in place in the country in which the data is processed or stored, at least equivalent to protections under the Act, or with the data subject’s consent.

Ukraine

In most cases, the processing of personal data requires the consent of the respective data subject. However, employers are allowed to process an employee's basic personal data without consent to the extent required to perform the employer's statutory obligations (eg, pay salary or statutory reporting).

Processing of sensitive data (eg, health status data, data related to religious beliefs or political views) is prohibited, unless the individual provides explicit consent or there is a statutory ground for processing these categories of data. The processing of sensitive data requires notification to the Ukrainian Parliament Commissioner for Human Rights.

Cross-border personal data transfers require documents such as an intercompany agreement on the transfer of data in addition to the data subject's consent.

United Arab Emirates

With the exception of the Dubai International Financial Centre Free Zone, there are no clear laws in the UAE comparable with those in the US or Europe concerning the handling and transmission of employees' personal information, nor do any provisions address the cross-border flow of data. However, it is advisable to seek prior written consent for the processing of personal data from the employee to the extent necessary to address the privacy protections set out in UAE law, including the protections set out in the UAE Penal Code, Cyber Crimes laws and the UAE Constitution.

United Kingdom

As of the end of the transition period following the UK's exit from the EU, the UK is subject to the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018, which impose significant obligations and onerous sanctions for employers. Under this regime, it is extremely difficult for employers to rely on consent as a basis for processing employee data, and other legitimate grounds generally must be identified.

United States

Certain states restrict the use of employees' social security numbers for any identifying purposes. Medical information must be maintained separately from personnel files and kept confidential. Otherwise, employers generally are entitled to monitor or search corporate emails of their employees and internet traffic accessed by their computer systems, on the premise that employees do not have an expectation of privacy in the use of their employer's computer systems or corporate emails, especially with a policy that says so. Jurisdictions vary as to an employer's ability to search or monitor personal email addresses and websites accessed from an employer's computer or premises.

Venezuela

Although there is no specific regulation regarding data privacy, employers have a general duty to uphold employees’ right to privacy and must observe the data protection principles determined by the Supreme Court (DP Principles).

The DP Principles apply to systems, registers or compilations of data that allow the creation of a complete or partial profile of an individual forming part of such system, register or compilation (in this case, an employee, for example). There is no clear outline of what a “complete or partial profile” involves.

This means that, in general, employee consent is required to process personal data. Venezuelan case law does not draw a distinction between forms of personal data. Therefore, there are no separate standards for the protection of sensitive data.

Pursuant to the DP Principles, employers must (i) inform the employee what data has been collected, (ii) inform the employee of the purpose(s) of the collection of their personal data, (iii) inform the employee who will be the final users of the data (ie, whether any third parties will have access to the data) and (iv) allow the employee to correct any erroneous data or delete any data that may be incomplete, inadequate or excessive in relation to the purpose(s) for which they were gathered (and this must be communicated to any third party who has been given access to the personal data).

Venezuelan law also provides for the protection of private communications, and employers have a strict obligation to keep employee health information and records confidential.

Vietnam

The Civil Code requires any person to seek the consent of an individual before collecting, storing, using or publishing their personal data. The parties to a contract are not permitted to disclose any information about each other’s private life or personal affairs of which they became aware in the course of entering into and performance of the contract.

The 2018 Law on Cyber Security covers any domestic or foreign enterprise that provides services on telecommunications networks, the internet or value-added services in Vietnam's cyberspace. The law governs the collection, exploitation, analysis and processing of personal data, data about service users' relationships and data generated by them in Vietnam. Under this law, any such data must be stored in Vietnam under the terms stipulated by the government.