Employee data and GDPR: profiles, signatures and cards
An email signature or a digital business card publishes personal data: name, job title, phone number, sometimes a photo. For this employee data, the GDPR prohibits nothing, but it imposes a few rules. Here is a clear, practical overview for the employer.
When a company equips its employees with consistent email signatures or digital business cards, it processes personal data: each person's name and job title, their contact details, sometimes their photo. And this data doesn't stay internal: it is published, sent and shared with customers.
The GDPR doesn't prohibit this; quite the opposite: it is a normal part of business life. It simply asks that it be done methodically. This article sums things up, without jargon. It does not replace the advice of your data protection officer or your legal advisor.
Employee data and GDPR: what is concerned
A signature or a digital business card usually contains:
- identity: first name, last name, possibly a photo;
- professional life: job title, department, establishment;
- contact details: business email, direct line, business mobile;
- links: LinkedIn profile, company social networks.
This is personal data within the meaning of the GDPR, even though it is professional. The rules therefore apply, with a few nuances depending on the data.
On what legal basis can this data be published
The GDPR (article 6) requires every processing operation to rest on a legal basis. For business contact details, the employer generally relies on performance of the employment contract or on its legitimate interest: a salesperson must be reachable by their customers; it is the heart of their job.
Two cases deserve more attention:
- The photo. It also falls under image rights. In practice, publishing an employee's portrait on a public medium requires their consent, freely given and for specific uses. An employee must be able to refuse without consequence, and to withdraw their consent later.
- The personal mobile number. It has no place on a business medium, unless the person expressly asks for it.
The CNIL (French data protection authority) has published a framework on human resources management, with a FAQ, which details the possible legal bases for each common purpose: it is available from its La gestion des ressources humaines page.
Principles to follow day to day
Article 5 of the GDPR sets out a few principles that become very concrete when applied to signatures and cards.
- Data minimization: publish only what is useful. A job title and a direct line, yes; a date of birth, no.
- Accuracy: published data must be up to date. A signature with an old title or a number reassigned to someone else is a real problem, not just an image issue.
- Storage limitation: when an employee leaves, their profile page, card and signature must be disabled. In 2026 the CNIL published a framework for HR data retention periods.
- Security (article 32): access to the tool that manages this data must be protected, and each person must be able to change only what concerns them.
Informing employees
Article 13 of the GDPR requires people to be informed. In practice, let your employees know:
- what will be published, and where (signature, online page, Wallet card);
- the reason for this publication;
- the tool used and where the data is hosted;
- their rights: access, rectification, objection where applicable, and withdrawal of consent for the photo.
An internal memo, a mention in the IT charter or in the welcome booklet is often enough. Remember to add it to the record of processing activities (article 30).
Choosing and overseeing the provider
If an external tool manages signatures or cards, this provider is generally your processor within the meaning of article 28 of the GDPR. You remain the data controller. Check:
- that a contract or terms govern the processing (purpose, duration, security, what happens to the data at the end);
- the list of its own subprocessors (hosting, email sending, payment);
- where the data is hosted, and whether any transfers outside the European Union take place;
- the ability to retrieve and delete the data at the end of the contract.
The question of hosting deserves an article of its own: see why sovereign hosting.
What about visitor data?
A digital business card can also collect data: view analytics, contact details left by a prospect. Two points to watch:
- Audience measurement: trackers placed on the visitor's phone in principle require their consent, except for strictly limited audience measurement that the CNIL exempts.
- Contact details left by prospects: they must be collected with clear information, and the company must be able to prove what the person agreed to.
Common mistakes
- Publishing the photo without asking: yet it is the easiest consent to collect, when the photo is taken.
- Forgetting departures: a profile page still online six months after someone has left, with a reassigned number.
- Letting everyone choose their own tool: employee data scattered across several free services, with no contract or visibility.
- Telling the teams nothing: informing them is an obligation, and a way to get their buy-in.
What Profiles Flow does
Profiles Flow was designed with these rules in mind, without claiming to handle your compliance for you.
- Separate roles: a User sees and edits only their own profile; an Editor manages the company's profiles; an Administrator also manages the company, the modules and the roles. An employee can also have their card without any access to the interface.
- Passwordless login, with a one-time code sent by email or a passkey.
- Departures: the profile's “Enabled” switch disables it; with Active Directory synchronization, the cards of people who have left are disabled automatically, never deleted without you.
- Cookieless analytics: no cookies, no IP address stored, a fingerprint that changes every day. No banner to display.
- Leads: the consent text accepted by the prospect is kept exactly as it was presented, with the date and time of acceptance.
On the contract side, your company is the data controller for profiles, users and leads; Profiles Flow is a processor within the meaning of article 28, and publishes the dated list of its subprocessors. Data can be retrieved on request for 30 days after the end of the subscription, then deleted. Hosting is detailed on the sovereign cloud page.
Frequently asked questions
Do you need the employee's consent to publish their business contact details?
Generally not: the employer relies on the employment contract or its legitimate interest, provided it limits the data to what is necessary and informs the employee. The photo is the exception, because it also falls under image rights.
Can an employee refuse to have their photo appear in their signature?
Yes. Publishing their image requires their consent, and they can withdraw it. Plan for materials that still look right without a photo.
What should you do with the data of an employee who leaves the company?
Disable their profile page, card and signature without delay, then apply your usual retention periods to the data that must be kept.
Is the publisher of a signature tool a processor?
In most cases, yes: it processes data on behalf of the company, which remains the data controller. A contract compliant with article 28 of the GDPR must govern the relationship.
Want to see how your data is organized in it? Profiles Flow offers a 30-day free trial, no credit card required.
