Compliance data must be useful without exposing the worker

The first question is not whether a file contains compliance evidence. It is whether the information relates to an identified or identifiable living person. The Commission's definition covers direct identifiers and combinations of information that can identify someone. It also states that pseudonymised information remains personal data where re-identification is possible. A case number substituted for a name is therefore not automatically anonymous. Irreversible anonymisation has a different status, but a supplier should not assert it merely because the obvious names have been removed.[S1101]

Processing is equally broad. Collection, recording, retrieval, consultation, disclosure, alteration and destruction can all count. A buyer portal is not the only processing event. A supervisor opening a restricted interview, an HR officer exporting a spreadsheet and a consultant correcting a case record may each form part of the relevant processing map. The Commission also makes clear that the rules can cover manual as well as automated processing. A paper grievance file does not become irrelevant to privacy simply because the factory has no integrated software.[S1101]

GDPR applicability then needs its own analysis. Commission guidance addresses controllers and processors established in the EU that process personal data as part of their activities, regardless of where the processing occurs. It also addresses organisations established outside the EU when they offer goods or services to individuals in the EU or monitor their behaviour there. These tests concern the processing and entity circumstances. They do not support the shortcut that every African employment record falls under GDPR whenever the factory has a European customer.[S1101]

The buyer's sustainability duty does not remove that analysis. The amended corporate due-diligence framework requires in-scope companies to identify and address adverse human-rights and environmental impacts across their own operations, subsidiaries and chains of activities. Supplier evidence can support that process. The duty is not, however, a general instruction to collect unlimited identity material. The reviewer must still establish what information is necessary, which entity processes it and which legal rules govern that processing.[S02][S23]

Roles should be assigned for each processing operation rather than for the commercial relationship as a whole. The Commission describes the controller as determining the purposes and means, and the processor as acting on the controller's behalf under documented instructions. A supplier may control its payroll administration while a hosted service processes records for it. A buyer may determine a separate purpose when it receives an extract. Joint determination, repeated reuse and onward hosting need particular scrutiny. A contract label alone should not be treated as the factual answer.[S1101]

GFT therefore proposes an applicability record before any worker evidence is shared. Record the entities, establishments, affected individuals, processing purpose, data categories, systems, recipients and actual direction of each disclosure. Identify who decides why and how the processing occurs, the claimed lawful basis and the relevant local employment, privacy and confidentiality rules. Where GDPR is engaged, add the applicable principles and transfer analysis. Where it is not, do not infer that disclosure is unrestricted. Local law, contractual confidentiality and worker protection still need attention.

That record should be revisited when the route changes. A new buyer portal, an external auditor, a labour recruiter, a cloud host or a buyer's non-EEA affiliate can alter the actors and purposes. A different use of an existing file can be just as important as a new file. Purpose limitation requires a specified purpose where GDPR applies, and further use needs its own compatibility assessment rather than a vague appeal to compliance.[S23]

Access control becomes useful when it starts with a decision, not with a job title. Operations may need to see a blocked batch and its unresolved test. HR may need the worker identity behind an incorrect payment. A compliance reviewer may need the status and evidence scope without seeing the underlying interview. A buyer may need assurance that a defined concern was investigated. An auditor may need controlled access to selected source material. An authority may have a specific legal power, but the recipient should still record and verify the request rather than treating the word authority as a universal password.

The factory should translate these decisions into role views and field-level entitlements. Routine views should show the minimum content needed for the task. Sensitive source records should require a separate, logged action. Temporary access should have an owner and an end condition. Removing a name from a dashboard is insufficient if the same user can open an unrestricted attachment library or export the whole case population. Where GDPR applies, integrity and confidentiality require appropriate technical and organisational measures against unauthorised processing, loss and damage.[S23]

Every disclosure needs a purpose that can be stated in plain language. “The buyer requested it” identifies a commercial event, not a lawful basis or a necessity test. A better record might say that an importer needs to assess a reported recruitment-fee issue affecting a named production route. That purpose allows the supplier to consider a case status, scoped investigation findings and remedy confirmation before considering identity documents. Where GDPR applies, the Commission also calls for transparency about recipients and whether information will be transferred outside the EU.[S23]

An export log should preserve that reasoning. Record the requester, recipient organisation, evidence set, purpose, legal and contractual basis reviewed, fields removed, approving role, destination, onward recipients and correction route. The log should also identify what was not disclosed. That negative boundary helps a later reviewer distinguish an incomplete investigation from a deliberate redaction. A recipient who needs broader access can then request a defined addition rather than receiving the whole archive by default.

Urgent safeguarding needs a different route from routine reporting. A credible threat to a worker may require immediate action by a small authorised group even before a normal buyer review. That does not justify broadcasting the allegation to every commercial contact. The incident protocol should separate protective decisions from evidential disclosure and preserve both. It should also guard against a supervisor learning the complainant's identity through a supposedly anonymous summary.

External service providers need the same scrutiny. A portal host, payroll provider or investigator may process information for another organisation, but the actual facts determine the role. The Commission describes processor duties as specified through a binding contract or other legal act and notes that an organisation can be a controller for one part of an operation and a processor for another. The access review should therefore cover instructions, subcontractors, retention, return or deletion and incident communication rather than relying on a hosting label.[S1101]

No role view is permanent. Access should change when a worker leaves a team, an investigation closes, an auditor's engagement ends or a recipient's purpose changes. Periodic review should compare actual exports and administrator rights with approved purposes. The point is not to accumulate logs as another form of surveillance. It is to detect disclosures that no longer have an explanation and to stop them.