The General Data Protection Regulation (GDPR) regulates the collection and processing of the personal data of individuals in the European Union (EU).

Under the GDPR, employers are required to provide employees with a legal basis for the collection and processing of the personal data of users. This could be through a privacy notice or through an employee data protection policy. The document needs to be concise, transparent, easily accessible and written in plain language.