GDPR Says Your Employees Can Request All Data You Hold On Them. Can Your Payroll Software Export That in 30 Days?
Monday morning, 9am. An email from a former employee: "I am exercising my right under GDPR Article 15 to request all personal data you hold on me."
You have 30 days.
Most employers spend the first two weeks working out where the data actually lives.
---
The 30-day obligation
GDPR — the General Data Protection Regulation, EU law since 2018 — gives every employee and former employee the right to request a complete export of all personal data their employer holds. This is called a DSAR: a Data Subject Access Request. Sending one costs them nothing. Receiving one is legally binding.
Under GDPR Article 15, your response must cover 14 categories: identity and contact details, employment contract terms, salary history, tax withholding records, sick leave and health data, banking details, pension and mutuelle (supplementary health insurance) contributions, performance notes, disciplinary records, time and attendance records, expense claims, any automated decisions made about the employee, and records of data shared with third parties — including URSSAF (the agency that collects social security contributions) and any pension funds.
One email from your employee. Thirty days and every system that has ever stored their name. That asymmetry is not an accident — it is the law.
---
The numbers are moving
France's data protection authority — the CNIL, Commission Nationale de l'Informatique et des Libertés — received 14,143 DSAR-related complaints in 2023. Up 34% over 2022. Following the exact trajectory the UK demonstrated three years earlier, where ICO (Information Commissioner's Office) DSAR complaints tripled between 2020 and 2023.
These figures cover only complaints that were escalated — cases where the employee went to the regulator after a late, incomplete, or missing response. Formal warnings went to businesses with three to fifty employees in 2023. This is not a large-company problem.
---
Thomas's two weeks
Thomas runs a 12-person cleaning company in Lyon. In October 2024, a former employee filed a DSAR. Across two weeks, he spent 22 hours searching through his Sage payroll exports, a Google Sheets rota, paper timesheets, and email chains. He missed the employment contract metadata and the records of data shared with third parties, including URSSAF submission logs. His response went out on day 29.
A CNIL formal warning followed. Three months of mandatory corrective action.
Twenty-two hours and the regulatory process were not the worst part. That DSAR was filed alongside a complaint to the conseil de prud'hommes — France's labour tribunal. An incomplete DSAR response does not just trigger a regulator. In a labour dispute, it tells the tribunal that the employer is disorganised or concealing something. That impression, once formed, shapes the entire hearing.
---
Why fragmented systems make this a scramble
Payroll software built in the 1990s and 2000s was designed for one purpose: calculating and recording wages for accounting. Data is organised around accounting periods — monthly payroll runs, annual tax summaries. Fast and accurate for payslips. Never designed to answer "give me everything you hold on this one specific person."
Walk through the data a French employer actually stores: payroll software for wages and payslips, a scheduling tool or rota spreadsheet, paper or email records of disciplinary conversations, a separate platform or folder for expense claims, médecine du travail (occupational health) records for mandatory health visits, URSSAF correspondence files, banking records for expense reimbursements.
Eight to ten systems holding one employee's personal data — none connected to the others. Producing a complete DSAR response means locating and compiling records from all of them within 30 days, covering all 14 required categories. Everything is stored somewhere. No single export action retrieves all of it.
---
The architecture question
Hiring a DPO — a Data Protection Officer, a compliance specialist required at large companies and optional for SMBs — does not solve this problem. A DPO can write policies, run training, and manage the compliance calendar. They cannot change what a fragmented system can and cannot export.
Choosing software that stores everything about each employee in one connected record solves this at the source. Every payroll entry, health record, contract term, and disciplinary note, linked to the person they describe and exportable as a single structured file. With that foundation in place, a DSAR becomes a 4-minute operation.
Céline runs an 8-person tutoring agency in Bordeaux. She received a DSAR from a former employee in January 2025. She opened Liberté, selected the employee's record, and exported a structured PDF covering all 14 required categories. Four minutes, including reviewing the output.
What separates Thomas's 22 hours from Céline's 4 minutes was not process discipline, not a compliance manager, not a more expensive subscription. It was the decision made when the software was first set up: one platform that stores all employee data together, from day one.
---
A self-test you can run right now
Pick any current or former employee. Ask: could you produce a complete DSAR response for them in under an hour?
List every system that stores their name: payroll software, scheduling tool, expense platform, health visit records, email threads, bank transfer records, URSSAF correspondence. Most employers reach eight to ten systems before stopping. Each additional system is another source of manual compilation in a 30-day countdown.
French law requires keeping payroll records for five years. For a business with five years of operations and normal staff turnover, 20 to 30 former and current employees may retain active DSAR rights at any given moment. Any of them can send that Monday morning email at any time, at zero cost.
Liberté keeps everything about each employee in one connected record — payroll, contracts, accounting entries, bank transactions, and government declarations. DSAR export is a single action. No manual compilation. No missed categories. No day 27 panic across paper files.
---
The signal your records send
Employers whose employee data is structured and portable handle a DSAR on a normal working day. Businesses with fragmented systems spend 22 hours across two weeks, miss categories, and face regulatory process if the employee escalates.
Response time signals something to every tribunal, regulator, or employee who eventually sees it — about whether the employer keeps reliable records, takes legal obligations seriously, and runs an organised business. That signal is built into the architecture before any DSAR ever arrives.
Four minutes on what previously took 22 hours. That gap is the product of one decision made at setup. Legacy payroll software was built to generate payslips. Liberté was designed knowing both obligations exist — because they always did.
DSAR complaints in France increased 34% in one year. That trend does not reverse. The date of that Monday morning email is still unknown — and that is the only thing still unknown.