In order to ensure the rights and freedoms of the individual and the citizen, in the process of processing the employee's personal data, the employer and his representatives are obliged to comply with the following requirements:

a) processing of the employee's personal data may be carried out exclusively for the purpose of fulfilling the provisions of the legislation in force, providing assistance in hiring, training and advancement in service, ensuring the employee's personal security, controlling the volume and quality of work performed and ensuring the integrity of the unit's property;

b) when determining the volume and content of the employee's personal data to be processed, the employer is obliged to be guided by the legislation in force;

c) all personal data shall be taken from the employee or from the source indicated by the employee;

d) the employer is not entitled to obtain and process data relating to the employee's political and religious beliefs and private life. In the cases provided for by law, the employer may request and process data on the employee's private life only with the employee's written consent;

e) the employer shall not be entitled to obtain and process data concerning the employee's membership of trade unions, public and religious associations, parties and other socio-political organisations, except in the cases provided for by law;

f) when taking a decision affecting the employee's interests, the employer shall not be entitled to rely on the employee's personal data obtained exclusively by automatic or electronic processing;

g) the protection of the employee's personal data against unlawful use or loss is ensured at the employer's expense;

h) employees and their representatives must be made familiar, under their signature or by another means allowing confirmation of receipt/notification, with the documents concerning the processing and storage of employees' personal data in the establishment and be informed of their rights and obligations in this area;

i) employees must not waive their rights regarding the storage and protection of personal data;

j) employers, employees and their representatives must jointly develop measures to protect employees' personal data.

When transmitting the personal data of the employee, the employer must comply with the following requirements:

a) not to communicate to third parties the personal data of the employee without his written consent, except in cases where this is necessary in order to prevent a danger to the life or health of the employee, as well as the cases provided by law;

b) not to communicate the personal data of the employee for commercial purposes without his written consent;

c) to warn the persons receiving the personal data of the employee about the fact that they can be used only for the purposes for which they were communicated and to ask the persons concerned to confirm in writing the observance of this rule. The persons who receive the personal data of the employee are obliged to respect the confidentiality regime, except for the cases provided by law;

d) to allow access to the personal data of the employee only to the persons empowered in this respect, who, in their turn, have the right to request only the personal data necessary for the exercise of concrete attributions;

e) not to request information regarding the employee's state of health, except for the data regarding the employee's capacity to fulfill his / her work obligations;

f) to transmit to the employees' representatives the personal data of the employee in the manner provided by this code and to limit this information only to those personal data that are necessary for the exercise by the respective representatives of their attributions.

In order to ensure the protection of his personal data that is kept by the employer, the employee has the right:

a) to receive full information about his personal data and how to process them;

b) to have free and unrestricted access to his personal data, including the right to copy any legal act containing his personal data, except in the cases provided by the legislation in force;

c) to appoint its representatives for the protection of its personal data;

d) to have access to the medical information concerning him, including through the medical worker, at his choice;

e) to request the exclusion or rectification of incorrect and / or incomplete personal data, as well as of data processed in violation of the requirements of this code. If the employer refuses to exclude or rectify incorrect personal data, the employee has the right to notify the employer in writing of his reasoned disagreement;

f) to attack in court any illegal actions or inactions of the employer admitted to obtaining, storing, processing and protecting the personal data of the employee.

Persons guilty of violating the rules on obtaining, storing, processing and protecting the employee's personal data are liable according to the legislation in force.