Solutions · HR platforms and SaaS

You wear two hats, and they carry opposite obligations.

For your customers' data you are a processor — you may not decide why it exists. For your own staff's data you are a controller, and every decision is yours to defend. Most breaches in this sector come from applying one rulebook to both.

Your customers' data
Your staff's data

Processor · you act on instructions

Who you answer toThe controller who hired you

And then the Commission. Your customer carries the relationship with the people in the data; you carry the relationship with your customer.

Who decides why it existsThey do, not you

Using their data for your own purposes — training a model, building a benchmark, improving a feature — makes you a controller of it, with every obligation that follows.

Lawful basisNot yours to choose

You never pick one. If they picked wrongly, you inherit the consequence without ever having had the decision.

What the paperwork must beWritten processing terms

Their standard terms of service are not processing terms. Asiri marks that difference plainly, because it is the most common gap in this sector.

Your own vendorsSub-processors they must accept

Notify, then obtain countersignature. Adding one quietly puts your customer in breach of a promise they made to somebody else.

When they get a requestYou help them answer it

You do not answer the person yourself. Asiri produces the extract and records that you produced it, on the date you did.

Controller · every choice is yours

Who you answer toYour own staff, directly

And the Commission, with nobody between you. There is no customer to escalate to and no contract to hide behind.

Who decides why it existsYou do, and you defend it

Every purpose is a choice you made. Device monitoring is the one that gets tested, because proportionality is a judgement rather than a setting.

Lawful basisYours to choose and record

Consent rarely works here — an employee cannot freely refuse their employer, which is exactly why the Act treats it as weak.

Special category dataYou already hold it

Sick notes, accommodations, insurance claims. Held to the same standard as a diagnosis, and usually sitting in an HR tool nobody classified.

How long you keep itSix years after they leave

Employment and tax law sets it, so this one is a fact rather than a choice. The periods you did choose are the ones you will be asked to justify.

When somebody leavesAccess ends that day

Two leavers kept theirs for nine days, and it became a finding in the SOC 2 report. Offboarding now triggers from the HR record, not a ticket.

See both registers Who touches your data

PRO-001 · the sub-processor chain

Their list changed in February. Nobody countersigned it.

Notification is not agreement. A sub-processor added without your countersignature is a company holding your customers' data under terms you never accepted — and your own customers agreed to the old list.

YouYour platform
Processor to every customer who signed with you, and controller of your own staff records.
Your processorAWS EMEA
Written terms signed March 2024, reviewed February 2026. Hosts the core database and the backups.
Their sub-processorsFour on the list
The list your customers saw and accepted when they signed with you.
FebruaryThe list changed
You were notified. Nobody countersigned it, so the list your customers accepted is not the list in force.

Asiri reads the list from the agreement rather than from memory, and dates the last countersignature. Where notification and countersignature disagree it opens the action on both the processor record and the agreements page, because it is one signature closing two gaps.

NDPC-2026-0441 · seven days to answer

Monitoring people without telling them is not a security measure

It is the thing a security measure is supposed to make honest. Three thousand one hundred people had their device activity read for a year, and the control that says they were told has nothing on file and no owner.

The Commission's enquiry did not come from a complaint about the monitoring. It came from somebody noticing the notice never mentioned it.

Letters from the NDPC

Where staff monitoring stands today

Agents told what the app records

Nothing on file

No owner, never tested, and the subject of the enquiry now sitting at seven days.

Staff who signed the rules

48%

1,721 of 3,609. The group with the weakest coverage is the group with the most access.

Two-step sign-in enrolled

84%

The 16% without it are mostly branch staff, who are also the ones phished most often.

Monitoring assessment

Draft

DPIA-2026-0005 exists and is unfinished. Finishing it is most of the answer to the letter.

The register nobody thinks of as a register

Your staff are data subjects too

Sick notes, accommodations and insurance claims are special category data about the people who work for you — held to the same standard as a patient's diagnosis. And the retention period is not yours to pick: six years after they leave, because employment and tax law says so.

Records held

3,609

Every employee is a data subject

The same rights as a customer: access, correction, objection. Most companies have never had one exercised, which is not the same as being ready.

Set by law

6 yrs

After they leave

Employment and tax law decides this, so it is a fact you inherit rather than a period you defend.

Special category

Kinds you already hold

Sick notes, accommodations and insurance claims — sitting in an HR tool that was never classified as holding health data.

The finding

9 days

Two leavers kept access

Found in month eleven of the observation period, remediated and retested before the report closed.

Two registers, kept apart, in one workspace

Asiri keeps your processor obligations and your controller obligations separate, because conflating them is the mistake — and answers your customers’ due diligence out of the same records.

Talk to us Answer diligence faster