Access and security
Audit, export and erasure
What is logged, what a person can take with them, and why erasure pseudonymises rather than deletes.
The audit trail
It records who did what to which record, on one rule: log the things that would matter in an argument. Reading somebody's passport scan, changing what somebody is paid, deciding a leave request, exporting a person's data, erasing it.
It stores no before-and-after values
It is not a change log. An audit table that quietly becomes a second copy of everyone's salary history is a liability, not a control. *Salary changed* is the record; the salary is in the record that changed.
Approval decisions record how they were reached — whether they were self-approved and whether they came through a delegation — because that is what an argument turns on. Not every actor is a person: a provisioning connector is recorded as itself.
Export
A person's whole record can be exported. Anybody may export their own record without holding an HR role. The exporter is an explicit list of relations rather than an automatic walk of the database — a generic exporter silently omits anything added after it was written, and *we forgot that table existed* is not a defence.
Erasure
Erasure pseudonymises; it does not delete
Employment, tax and leave records must be retained for a statutory period after somebody leaves, and GDPR Article 17(3)(b) exempts exactly that processing. So identity is overwritten and the records remain as de-identified rows that still add up — headcount and cost history do not develop a hole.
Free-text fields matter as much as structured ones: a leave reason naming a doctor survives every column-level redaction, so it is handled explicitly.