Employee Privacy Notice - Germany

1. Introduction

This Employee Privacy Notice ("Notice") applies to the ABB Group of companies, which means ABB Ltd, Switzerland and each entity in which ABB Ltd, Switzerland, directly or indirectly, has a majority holding or owns or controls the majority of voting rights. The ABB company that is your employer (referred to as "ABB") is responsible for the processing of your personal data and controls how it is used, in accordance with this Notice. In this context employment also covers any contractual relationship between ABB and you on the basis of an intern or traineeship, temporary work or other dependent working relationship within the meaning of § 26 (8) BDSG. 

At ABB respecting your data protection rights is a top priority. This Notice explains how we use personal data about you and what rights you have regarding your personal data.  

2. Who is responsible for the processing of your personal data?

ABB Asea Brown Boveri Ltd and its subsidiary companies are responsible for your personal data. For applicable privacy and data protection laws, the primary controller of your data is the ABB subsidiary company which is your current (or former) employer. Other subsidiary companies of ABB may also receive and process your personal data, either in the capacity of controller or processor, and this Notice applies equally to them. 

In your case, ABB AG, Kallstadter Straße 1, 68309 Mannheim, Germany, or any respective company affiliated with ABB AG pursuant to §§ 15 ff. of the German Stock Corporation Act (Aktiengesetz - AktG), having an employment relationship with you, decides as "controller" within the meaning of the EU General Data Protection Regulation (GDPR) and the Federal Data Protection Act (Bundesdatenschutzgesetz - BDSG) how and for which purpose your personal data will be used in accordance with this notice (hereinafter: “ABB”, "we" or "us"). In this context employment also covers any contractual relationship between ABB and you on the basis of an intern or traineeship, temporary work or other dependent working relationship within the meaning of § 26 (8) BDSG (hereinafter altogether referred to as “employment”). 

We have a data protection officer which you can contact for all issues related to processing of your personal data and the exercise of your data protection rights as follows: 

Kallstadter Str. 1 
68309 Mannheim 


3. Which of your personal data do we collect and use? 

We collect and use personal data that we receive from you in the course of or in connection with your employment at ABB. In addition, and to the extent necessary for the purposes mentioned in this Notice, we process personal data which we may obtain from publicly accessible sources or which are legitimately transmitted by other third parties (e.g. commercial and association registers, press, etc.). We may use the following categories of your personal data, as applicable and necessary for the purposes of processing under this Notice: 

  • Personal details and identification data such as name, personal and business address, personal and business telephone number, personal and business email address or any other contact details, date and country of birth. 

  • Personal data related to family, lifestyle and social circumstances such as gender, age, marital and family status (including also the name and contact details of the next of kin).  

  • Employment related personal data such as employee number, signature, employment status, social security and tax numbers, insurance number, country of residence, nationality, photo, emergency contacts and passport information, work and residence permit, immigration status and travel visa information. 

  • Qualifications such as qualifications and certifications including current and previous positions, education and training courses, resume/CV, records of education and work achievements, in some cases: contact details of referees and results of capability assessments and interview assessment/feedback. 

  • Job information and work metrics such as position, title, employment contract, payroll ID, line manager, job band, performance history, employment status, leave of absence information, working time logging, training records, performance targets and development goals. In some cases, we may also record results of capability assessments, safety reports and incidents, professional feedback. 

  • Compensation, allowances, benefits and expense related information such as salary data, payroll data, pension plan number and contributions, non-salary benefits, bonus, compensation, share options, dependents, beneficiaries or health benefit nomination, bank statements, expense claims and receipts, bank account details, credit card data, phone expenses and insurance data. 

  • Electronic identification data and information (where employee has access or is affected by such systems or applications) such as access logs, IT and internet usage, device identifiers (mobile device ID, PC ID etc.), registration and login credentials, IP address, geolocation data, tracking and analytics data, recordings (e.g. CCTV footage, voice mail/call recordings), posts on corporate platforms (e.g. Yammer), password recovery data, information obtained via IT security tools. 

  • Financial and other details (notably where it concerns staff members with access to or control of ABB financial business accounts) such as account information, credit checks, payment details and transactions (the latter for Know Your Customer ("KYC")/ Anti Money Laundering ("AML") monitoring purposes as explained further in this Notice), investigation information. 

  • Other personal data (which may include special categories of information as mentioned below) namely where you or others (such as your colleagues) may register these data on or in our systems, programs and application such as business documents containing personal information (e.g. queries, questions, complaints, orders and related records; emails; reports; contracts; presentations, minutes; work products), photos, images and/or videos. 

The below mentioned types of personal data are only collected and processed, if at all, in accordance with applicable local laws in your country of residence.  

  • Special categories of personal data such as: 

    • membership of religious congregations (e.g. if required for tax purposes);

    • health and medical information, including disability status, special working conditions (such as use of a standing desk) and medical devices needed on the premises, work related injury and illness information, data for travel emergency support (blood type, medical history, allergies); 

    • race or ethnicity (e.g. where this is used for diversity purposes);

    • in some cases: trade union membership. 

  • Data about criminal convictions and offences such as criminal background information and sanction list information to the extent required for the purposes of criminal background screening and KYC and AML or other legal obligations.   

In case you would like to be provided with information about a specific personal data processing activity, you can request that by submitting a request at www.abb.com/privacy

4. Why do we need and use your personal data?  

We primarily process your personal data to fulfil and perform our employment relationship with you. As part of the employment relationship between you and us, we need to process your personal data which is required by us to commence, complete or terminate the employment relationship with you or to perform the contractual and legal obligations associated therewith, or which we are required by law to collect and process (mainly based on social security laws). 

Without processing of certain of such personal data, ABB will generally not be able to establish, maintain or terminate an employment relationship with you or to take any contractual or legal action on your request. Furthermore, where it concerns processing operations related to your employment (as described above), ABB will not be able to adequately perform such operation at your request without certain personal data and you may not be able to exercise your employee or social security rights if you do not provide the personal data requested. Whenever you are asked to provide us with any personal data related to you, we will indicate which personal data is required and which personal data may be provided voluntarily and on which legal basis such personal data is required to be processed. 

We may use your personal data as listed above in particular for the following purposes:  

  • human resources management including organization and personal administration, working hours management, improving and maintaining effective staff administration, internal workforce analysis, reporting and planning; 

  • staff transfer management from different affiliates and succession planning; 

  • payroll, compensation and benefits management including providing staff benefits and maintaining salary, compensations, allowances, benefits, insurances, pensions and performance reviews; 

  • talent management and acquisition including recruitment, assessing suitability and working capacity, background checks and verification of qualifications, obtaining and providing references; 

  • learning and development management including certifications, training staff and performing assessments and employee satisfaction surveys; 

  • processes related to joining and leaving including internal moves and terminations; 

  • sickness and other leave and vacations management; 

  • internal health and safety programs including health and safety and accident records or reporting and managing process quality; 

  • travel and expenses management and organization of business trips including monitoring of travelers to provide support during security or medical emergencies; providing travel security, health and safety training and on a voluntary basis assistance in giving security support during emergencies; 

  • carrying out the obligations and exercising specific rights in the field of employment and social security law or a collective agreement; 

  • internal and external communication of ABB’s organization and representation of ABB; 

  • organizing ABB events and documentation of such events including managing and organizing internal non-marketing related campaigns, events and meetings; 

  • managing ABB assets including pictures and videos depicting employees or other individuals available for download on the ABB intranet, ABB website, etc.; 

  • finance and shared accounting services providing record to report, order to cash and purchase to pay services; 

  • reorganization, acquisition and sale of activities, business units and companies; 

  • business reporting, statistics and analytics; 

  • monitoring and auditing compliance of employees’ activities in the workplace with ABB’s corporate policies, contractual obligations and legal requirements including disciplinary actions; 

  • carrying out audits, reviews and regulatory checks to meet obligations to regulators; 

  • governance, risk and compliance, including compliance with laws, law enforcement, court and regulatory bodies’ requirements (such as KYC, AML, customs and global trade compliance and security obligations) and prevention, detection, investigation and remediation of crime and fraud or prohibited activities or to otherwise protect legal rights and to establish, exercise or defend legal claims; 

  • managing the customer relationship, processing customer orders and providing customer support, processing, evaluating and responding to requests and inquiries;  

  • managing the suppliers, contractors, advisers and other professional experts including contact interaction, processing and fulfilling purchases and invoices, and contract lifecycle management; 

  • making use of work performance and products and for references on documents, such as drawings, purchase orders, sales orders, invoices, reports;  

  • video surveillance or CCTV for the purposes of public and staff safety, building security and crime prevention and detection; 

  • access control system providing electronically controlled ingress and/or egress for authorized individuals to locations that have access restrictions and a registry of personnel on site in case of emergencies; 

  • intrusion detection including 3rd party monitoring of duress, perimeter, internal security points and ancillary supervisory monitors for site maintenance/automated systems; 

  • maintaining and protecting the security of products, facilities, services, systems, networks, computers and information, preventing and detecting security threats, fraud or other criminal or malicious activities, and ensuring business continuity; and 

  • managing IT resources, including infrastructure management including data back-up, information systems’ support and service operations for application management, end user support, testing, maintenance, security (incident response, risk, vulnerability, breach response), master data and workplace including user accounts management, software licenses assignment, security and performance testing and business continuity. 

We only collect the personal data from you that we need for the above purposes described. Certain personal data collected from you relates to your next of kin and emergency contacts. In these cases, you are requested to inform such persons about this Notice. 

We may also anonymously collect your personal information so that we can no longer (in)directly identify you or single you out as an individual by that information and then use that information for further processing purposes, including statistical purposes, improvement of our services and testing of our IT systems.  

In case you are working at a third-party site (for example ABB customer location or facility), such third party may need to process your personal data for their purposes acting as a data controller. In these cases, you will receive or may request a separate privacy notice from the relevant data controller. 

5. On which legal basis do we process your personal data? 

We process your personal data for the purposes described above (in section 4) in accordance with the provisions of the EU General Data Protection Regulation (GDPR) and the Federal Data Protection Act (BDSG), in particular according to the following legal bases, as applicable: 

  • Primarily we process your personal data for the purpose of establishment, execution or termination of an employment relationship as well as for the enforcement of rights and fulfilment of obligations under your employment contract with us, the legal basis for such processing is § 26 (1) 1 BDSG (in conjunction with Art. 6 (1) b) GDPR). 

  •  Additionally, if we process your personal data (including special categories of personal data) for the purpose of exercising of rights or fulfilment of legal obligations derived from labour law, social security and social protection law and you do not have an overriding legitimate interest in not processing the data, the legal basis for such data processing is § 26 (3) BDSG (in conjunction with Art. 6 (1) c) and 9 (2) b), f) and h) GDPR).  

  • If we process your personal data (including special categories of personal data) for purposes of health care, occupational medicine or assessment of your ability to work and such processing is done by health professionals or other persons subject to an obligation of professional secrecy, the legal basis is § 22 (1) No. 1 b) BDSG (in conjunction with Art. 9 (2) lit. h) GDPR). 

  • Insofar as an applicable collective agreement regulates the special processing of personal data of employees within the employment relationship (including special categories of personal data), this collective agreement is an additional legal basis for this data processing pursuant to § 26 (4) BDSG (in conjunction with Art. 88 GDPR). 

  • In some cases and where necessary, we process your personal data within the employment relationship in order to safeguard legitimate interests of us or third parties. This requires a weighing of interests pursuant to Art. 6 (1) f) GDPR, according to which a processing of personal data is permissible if it is necessary to safeguard the legitimate interests and does not outweigh the interests or fundamental rights and freedoms of the data subject which require the protection of personal data. Such legitimate interests may include the: 

    • monitoring (for example through CCTV or IT systems), investigating and ensuring compliance with legal, regulatory, standard and ABB internal requirements and policies; 

    • prevention of fraud and criminal activity including investigations of such activity, misuse of ABB assets, products and services, and as strictly necessary and proportionate for ensuring network and information security;  

    • if otherwise necessary for establishment, exercise and defense of legal claims of and against ABB related to your working tasks and duties at ABB; and 

    • transmitting personal data within the ABB group for internal administrative purposes as necessary, for example to provide centralized services. 

You may obtain a copy of our assessment regarding our legitimate interest to process your personal data, including a documented balancing of interests, by submitting a request at www.abb.com/privacy

  • In some cases and if we process your personal data on the basis of statutory requirements, for example, on the basis of tax or reporting obligations, cooperation obligations with authorities or statutory retention periods in order to carry out our contractual and legal responsibilities as an employer, the legal basis for such processing is Art. 6 (1) c) GDPR);

  • In exceptional circumstances and if we process your personal data (including special categories of personal data) for purposes which are not covered by the aforementioned legal bases we may ask your consent in accordance with § 26 (2) BDSG (in conjunction with Art. 6 (1) a) and 9 (2) a) GDPR) as a legal basis for such data processing, for example photos, communications materials and events. Your consent is always on a voluntary basis, so that you are not obliged to provide personal data for such purposes of processing. You can also withdraw your consent at any time in accordance with Art. 7 (3) GDPR without stating reasons with effect for the future. If we ask you for consent in order to use your personal data for a particular purpose, we will remind you that you are free to withdraw your consent at any time and we will tell you how you can do this.

With regard to personal data concerning criminal convictions and offences, we will only process such data where such processing is permitted by applicable (local) law. In particular, we may process your personal data on the legal basis of § 26 (1) 2 BDSG to detect criminal offences and serious violations of labour law obligations (e.g. a serious violation of the ABB Code of Conduct) if there is a documented reason to believe the data subject has committed a criminal offence or a serious violation of labour law obligations while employed, the processing of such data is necessary and proportionate to investigate it and is not outweighed by the employee’s legitimate interest in not processing the data. 

6. Which parties do we share your personal data with (in and outside the EEA)? 

As part of a global group, we have business relationships with ABB Group companies and external service providers, both within and outside the European Economic Area (EEA), which we may also use to process your personal data as necessary for the purposes described in this notice. We only share your personal data with other ABB affiliates or third parties as necessary for the purposes described in the table below. In addition, when processing your personal data for these purposes through the use of external service providers as data processors (e.g. computer centers, software companies, etc.) these data processors are engaged within the framework of an existing contractual relationship, bound by instructions, and receive your personal data only to the extent and for the period required for the provision of the service. 

Where we share your personal data with an affiliate or third party outside the European Economic Area ("EEA"), we always put adequate safeguards in place to protect your personal data. Examples of these safeguards are an adequacy decision of the European Commission (read more here), Standard Contractual Clauses (read more here), Privacy Shield certification (read more here), and the Binding Corporate Rules that some of our suppliers have adopted (read more here). We have taken additional measures for the transfer of data outside the EEA to protect your personal data. If you would like an overview of the safeguards which are in place, please submit a request at www.abb.com/privacy

Recipient category

Recipient location


ABB affiliates and subsidiaries

See the list of ABB subsidiaries

The purposes described in section 4, including human resource management, talent management and organizing internal trainings and events.

ABB customers,  distributors, agents and other business partners 

EU/EEA and non-EU/EEA (global)

The purposes described in section 4, including project placements, carrying out audits, reviews and regulatory checks, customer relationship management and travel and expense management. 

Service providers

EU/EEA and non-EU/EEA (global)

IT services, HR and training, payroll and payment processors, professional and advisory services including accountants, auditors, lawyers, insurers, bankers, recruiters, travel agents and other advisors working on ABB’s behalf. 

Pension funds, labor and industry organizations and associations

EU/EEA and non-EU/EEA (global)

The purposes described in section 4.

Potential or actual acquirers of ABB businesses or assets

EU/EEA and non-EU/EEA (global)

For the evaluation of the business or assets in question or for the purposes described in section 4.

Recipients as required by applicable law or legal process, to law enforcement or government authorities, etc. 

EU/EEA and non-EU/EEA (global)

Where required by applicable law or a legitimate request by government authorities, or a valid legal requirement.

You may obtain a copy of the safeguards which we use to protect your personal data by submitting a request at www.abb.com/privacy.  

7. How long do we process and keep your personal data? 

In principle, we process and store your personal data only as long as this is necessary for the processing purposes mentioned in this Notice, until you withdraw your consent given in accordance with § 26 (2) BDSG or until you object to the use of your personal data in case of a legitimate interest being the legal basis for processing (Art. 6 (1) f) GDPR). 

However, based on mandatory legislation, ABB must keep certain personal data for a minimum period of time. For example, employment contracts, information about salary payments and reimbursements need to be kept for a minimum period based on local corporate and tax legislation.  

At the same time, applicable data protection laws require that we do not keep and process your personal data in an identifiable form for any longer than is necessary for the purpose for which the personal data has been collected and to perform regular reviews in this respect. Through the setting of IT applications and policies we ensure that your personal data is deleted when we no longer need it.  

The retention periods for the information that we hold can be found in our Directive Records Management GD/LI-44 (add link) or your local Directive Records. After an applicable retention period has lapsed, we will securely delete your personal data, unless there are specific circumstances that require us to keep such personal data, such as legal or regulatory obligations or to resolve potential disputes.  

For more information regarding specific retention periods that apply to your personal data, please submit a request at www.abb.com/privacy.  

8. Security and monitoring of ABB systems and sites  

ABB takes the security of its data very seriously, including your information and ABB's digital business assets. ABB sees this as a shared responsibility, where it takes the necessary steps to secure such data, and where it expects its staff members to do the same. You can read more about our security measures and your responsibilities [here/ End User Security Policy]. 

Monitoring of ABB's systems 

The use of corporate systems by employees, including telephone (mobile and fixed network) and computer systems (including e-mails and Internet access) is only permitted for business purposes at ABB and private use is therefore expressly prohibited. Information for personal use is collected, monitored and used for business purposes and to maintain IT security measures as required for the security of ABB systems and compliance with ABB Security Group Policy and applicable law. Therefore, your access data may be viewed by ABB when you log into ABB's IT and communications systems using passwords and user accounts for services. 

Monitoring will only be performed if and to the extent permitted or required by applicable law and justified for business purposes. The minimum storage periods set forth in Section 7 shall also apply to the resulting log files. This is necessary to detect attempted data misuse and other security incidents and to permit subsequent investigations and actions.  

Where permitted by applicable law and internal policies, disciplinary action may be taken. For this purpose, it may be necessary to transfer such personal data to the police or other law enforcement agencies. Investigations and the transfer of information to the relevant authorities will only take place in accordance with applicable law. 


As explained in this Notice, some ABB buildings and sites use CCTV video surveillance systems to monitor the indoor and outdoor areas of their corporate locations for security and operational purposes. We generally do not retain the footage for more than 14 days unless necessary, e.g. due to a security incident. In general collective agreements are concluded for the respective sites and regulate further details.  

9. Which data protection rights do you have with regards to your personal data? 

You are entitled to certain data protection rights regarding your personal data, of which you find a summary in the table below. 

Data protection rights

What it means

The right to access your data

You are entitled to ask ABB for an overview of or to obtain a copy of the personal data we hold about you. 

The right to have your data corrected

You may request immediate correction of inaccurate or incomplete personal data we hold about you.  

The right to have your data erased

You may request that personal data be erased when it is no longer needed, where applicable law obliges us to delete the data or the processing of it is unlawful.

The right to restrict data processing

You have the right to restrict the processing of your personal data in specific circumstances.  

The right to data portability

You have the right to receive your personal data in a structured, machine-readable format for your own purposes, or to request us to transfer it to a third party.  

The right to object to data processing

You have the right to object at any time, for reasons arising from your particular situation, to our processing of your personal data based on the legitimate interests. 

The right to withdraw consent

Where ABB has asked for your consent to process personal data, you may withdraw your consent at any time. 

Please note that the rights described above are not absolute, and that your request cannot always be met entirely. If you want to know more about your data protection rights as well as  the conditions and restrictions under which they are available to you, you may want to refer to the Annex to this Notice.  

You may request to enforce any of your data protection rights at www.abb.com/privacy.

10. Remedies, contact and further information 

If you want to access your personal data, make use of any of your other rights mentioned above or if you have any questions or concerns about how ABB processes your personal data, please contact your Data Protection Officer at privacy@abb.com, or submit your complaint at www.abb.com/privacy.  

Should you not be satisfied with our response or believe we are processing your personal data against the law, you have the right to file a complaint in accordance with Art. 77 GDPR with the competent Data Protection Authority in your country of residence or work, or seek a remedy through the courts where you believe an infringement of data protection laws (and your rights) may have taken place.  


Date of publication: August 23, 2019 

Annex to the Data Protection Notice: Your rights as a data subject 

1) Right of access 

You have the right to receive from us at any time upon request (text form) information about your personal data processed by us within the scope of Art. 15 GDPR.  

This right is limited by the statutory exceptions of § 34 BDSG, according to which the right of access is excluded, in particular if the data is stored on the basis statutory retention and documentation periods or for the purposes of data security and data protection control, the provision of information would require a disproportionate effort and a misuse of the data processing is prevented by suitable technical and organizational measures.

2) Right to rectification 

You have the right, pursuant to Art. 16 GDPR, to obtain from us the immediate rectification of personal data concerning you, should it be incorrect.

3) Right to erasure 

You have the right to obtain from us, under the conditions set out in Art. 17 GDPR, the deletion of any personal data relating to you.  

These conditions apply in particular if a) the respective processing purpose has been achieved or otherwise ceases to apply, b) we have unlawfully processed your personal data, c) you have withdrawn your consent without another legal basis applying to the data processing, d) you have successfully objected to the data processing or e) in cases where there is an obligation to delete personal data on the basis of EU law or the law of an EU member state to which we are subject.  

This right is limited by the statutory exceptions of § 35 BDSG, according to which the right to erasure may in particular be excluded if, in case of non-automated data processing, there is a disproportionately high expenditure for the deletion and your interest in the deletion is to be regarded as low. 

4) Right to restriction of processing 

In accordance with Art. 18 GDPR, you can request us to process your personal data only to a restricted extent.  

This right exists in particular if a) the correctness of your personal data is disputed, b) you request limited processing instead of deletion under the conditions of a justified right of erasure, c) the data is no longer required for the purposes pursued by us, but you need the data to assert, exercise or defend legal claims or d) the success of an objection is still disputed. 

5) Right to data portability 

In accordance with Art. 20 GDPR, you have the right to receive from us personal data concerning you, which you have provided to us, in a structured, commonly used and machine-readable format, as well as the right to request us to forward this personal data to another controller. 

6) Right to object 

In accordance with Art. 21 GDPR, you have the right to object at any time, for reasons arising from your particular situation, to the processing of your personal data, which is either based on a public interest pursuant to Art. 6 (1) e) GDPR or a legitimate interest pursuant to Art. 6 (1) f) GDPR.  

Upon receipt of your objection notice, we will then cease processing your personal data unless we can prove that there are compelling legitimate reasons for the processing which outweigh your interests, rights and freedoms, or the processing serves to establish, exercise or defend legal claims. If you object to the processing of your personal data for marketing purposes, we will cease such processing in any case.