What this feature does

Privacy legislation (GDPR) requires you to stop keeping personal data once there is no longer a reason to keep it. For an HR system that means: once an employee has left and the legal retention period has passed, their personal file has to go.

Epowerhr automates this with a data retention service task. Once a day it looks for people whose last employment ended more than N years ago and then, per person:

• deletes the complete HR file (job histories, contracts, salaries, addresses, absences, trainings, documents, …) and the person record itself, or
• anonymizes the person when they cannot be deleted because other records still point to them (for example as the former manager of colleagues who still work for you). The name is replaced by a placeholder such as Anonym Anonymous and all identifying fields are cleared, while the reference itself stays intact.

The linked user account is handled in the same way: its logins, group memberships and permissions are removed, and the account is deleted or anonymized.

Everything is driven by five settings and one service task. Nothing happens until you switch it on.

This is irreversible. Deleted data cannot be recovered from within Epowerhr. Read the whole article, agree the retention period with your DPO or legal department, and test on your acceptance environment before enabling it in production.

Before you start

You will need:

• The permissions Administration, Settings (view) and Update setting to open Admin → Settings and change the five data retention settings.
• The permissions Service tasks (view) and Update service tasks to open Admin → Service tasks, check the task's status and log, or run it by hand.
• An agreed retention period in years, counted from the end date of the person's last employment. Epowerhr does not impose a default. Belgian social legislation typically requires several years; your DPO decides.

Step 1 — configure the settings

Navigate to Admin → Settings and open the General component. Five settings control the feature:

Click Save after each change.

Two rules to keep in mind:

• If Anonymize employee data if it cannot be deleted is ticked, both the anonymised first name and surname must be filled in. If either is empty, the task does nothing at all — not even the deletions.
• The period applies to everybody. There is no per-person, per-company or per-population exception. If you need to keep a specific ex-employee longer (ongoing litigation, for example), leave their last job history open-ended or extend its end date until the matter is closed.

Step 2 — understand what the task does

Who qualifies

On every run the task selects persons that meet all of these conditions:

• The person has at least one job history (employment record). People without any employment — pure business contacts, candidates, family members — are never touched.
• Every job history of the person has an end date. Anyone with an open-ended employment is an active employee and is skipped.
• The latest end date + retention period (years) lies before today, evaluated in the tenant's time zone.
• The person has not already been anonymized by an earlier run.

What is deleted

For every qualifying person Epowerhr deletes, in one transaction:

• Personnel administration: job histories, employee contracts, salaries, supplements, benefits, insurance contracts, payroll info, fiscal info, civil states, addresses, personal and business contacts, emergency contacts, family members, educations, previous employers, languages, reference numbers, side activities, commuting data, the photo.
• Leave: leave requests and leave counters, absences, planning calendars.
• Training: training participations, training programs, budgets, counters, training advice, certificates (including shared certificate items), acquired competences, federal learning account data via the participations.
• Talent and performance: performance management documents where the person is the employee, objectives and objective uploads, competence assessments, development paths and needs, talent reviews and successor entries, feedback, incentive exercises, evaluation committee memberships, workflow states.
• Other: expenses the person requested, on/offboarding actions, todos, delegations, population and employee group memberships, work projects (and the projects themselves when they become empty), generated documents.
• Files: every file and uploaded document attached to the person is removed from storage.
• Audit trail: the change-tracking entries of all the records above are removed with them.

Family members of the person who are not themselves employees or business contacts are deleted as well.

Person: delete or anonymize

After the HR file is gone, Epowerhr checks whether the person is still referenced anywhere else. The most common references are:

• Manager on another person's job history, or manager / approver / HR officer / training coordinator / director of an organizational unit.
• Manager of a cost center, owner of a training, training coordinator of a participant.
• Approver on leave requests, expenses, talent reviews or open positions; delegate or delegator; hiring manager, recruiter or replaced employee on an open position.
• Reviewer, committee member or manager on talent reviews, questionnaires, projects or competence assessments.
• Participant in feedback (as recipient or reader); reviewer or other non-employee role on a performance management document.

Then:

User account

If the person has a user account, the task first removes everything that would let them sign in or that is personal: authentication methods, group memberships, direct permissions, login attempts, logs, displays and todos. The account can no longer be used after this.

The account itself is then:

• deleted when nothing else references it, or
• anonymized when it is still referenced (owner of a training or training session, approver, responsible for a boarding task, completed a boarding action, creator of a project feedback review, logged a document action, …) and Anonymize if it cannot be deleted is on. The names become the placeholders, the e-mail becomes <first name>.<surname>@ano.com (for the defaults Anonym.Anonymous@ano.com), and the link to the person is removed.
• left in place without logins when it is referenced and anonymization is off.

Clean-up of anonymized records

Anonymized persons and users exist only because something still refers to them. On every run the task re-checks them and permanently deletes each one that is no longer referenced — for instance after the colleagues who had them as manager are themselves deleted. Anonymization is therefore a waiting room, not a final state.

How anonymized people appear

• They are hidden from Who-is-who searches, employee pickers and the employee lists in the application.
• Where a reference still shows them — the former manager on a colleague's job history, for example — the placeholder name is displayed as plain text, without a link to a detail page.
• Reports and the OData reporting API return the placeholder values; the deleted records are simply gone.

Step 3 — check the service task

Navigate to Admin → Service tasks. Every tenant automatically has a task of type Delete / anonymize out-of-service employees, scheduled Daily at 0:00 and Active. You do not need to create it.

Open the task to:

• Check Status (Waiting, Running, Succeeded, Failed) and the last execution date.
• Click View log to read the result of the last run. A successful run reads Successfully completed. When one or more persons could not be processed the status is Failed and the log lists, per person, "Could not remove person with id {id} because: {reason}". The other persons in the same run are still processed; the failing ones are retried on the next run.
• Click Execute to run the task immediately instead of waiting for midnight. Use this for your first run on acceptance, and for a controlled first run in production during office hours so you can watch the log.
• Add a parameter Mail or MailOnError with one or more e-mail addresses (comma separated). Mail sends the log after every run; MailOnError only when the status is Failed. The mail subject is the task name followed by the tenant name.

Untick Active if you want to suspend the clean-up temporarily without changing the settings.

Recommended roll-out

1. Agree the retention period and the placeholder names with your DPO.
2. Export anything you are legally obliged to keep outside Epowerhr (payslips, contracts) before switching on. Epowerhr deletes the generated documents and uploaded files together with the person.
3. On your acceptance environment: fill in the five settings, click Execute on the service task, and review the log and a few affected persons.
4. In production: fill in the settings, run the task once manually during office hours, check the log, then leave it to the daily schedule.

The first run is the big one — it processes everybody who left more than N years ago. From then on it typically handles a handful of persons per day.

Frequently asked questions

The task says Succeeded but nobody was removed. Why? In order of likelihood: Delete employee data is still unticked; the period is empty or 0; Anonymize if it cannot be deleted is ticked but one of the placeholder names is empty (then the whole run is a no-op); or simply nobody's last employment ended more than N years ago yet.

An ex-employee who left long ago is still in the system. Check their job histories on the person page. One of them probably has no end date, or there is a later job history (a re-hire, a second contract) whose end date is more recent. The clock starts at the latest end date.

Can I exclude one person? Not directly. Keep one of their job histories open-ended, or give it an end date far enough in the future, for as long as you need to retain the file.

Can I undo a deletion? No. Only a database restore by BCS can bring the data back, and that affects the whole tenant. Treat the settings as a one-way door.

Why does a deleted colleague still show up as "Anonym Anonymous" on someone's job history? That person was the manager of colleagues who are still employed, so the reference had to be kept. The record was anonymized instead of deleted and will be deleted automatically once no colleague's history refers to it anymore.

Does this also clean up candidates in Recruitment or external payroll systems? No. Only persons with an employment record in Epowerhr are in scope. Candidates, Connexys data and your payroll provider's archives follow their own retention rules.

Does anonymization change the audit trail? The change-tracking entries of the deleted records are removed with them. Entries on other objects (for example an approval the person gave on a colleague's leave request) remain, and from then on show the placeholder name.

Can I change the placeholder names later? Yes, but only persons anonymized after the change get the new names. Already anonymized records keep the old placeholder.