Business Rules - HR

This document lists the core business rules of the HR domain, each with a unique BR-NNN code. Every rule is technology-independent and describes an invariant constraint on the behaviour of the domain.

---

BR-001 - Legal basis for every employee data processing

Code: BR-001 Name: Every processing of Employee personal data has an explicit legal basis Description: Every operation processing Employee personal data (hiring, appraisal, training) must rest on a GDPR legal basis (contract performance, legal obligation, legitimate interest). Occupational health data require the reinforced basis of GDPR Art. 9. Descriptive rule, not legal advice. Rationale: Ensure lawfulness of staff data processing per GDPR principles. Priority: HIGH Actors: HR Manager, GDPR DPO Traceability: GDPR Art. 6, Art. 9; events/domain-events.md EmployeeHired; descriptive-only note.

---

BR-002 - HR data minimisation and purpose limitation

Code: BR-002 Name: Employee data is limited to declared HR purposes Description: Only personal data necessary to declared HR purposes (employment management, appraisal, training) is collected and retained. No excess data nor retention beyond the necessary period. Descriptive model principle, not a legal opinion. Rationale: Respect minimisation and purpose-limitation principles (GDPR Art. 5). Priority: HIGH Actors: HR Manager, GDPR DPO Traceability: GDPR Art. 5; glossary.md; descriptive-only note.

---

BR-003 - Performance appraisal on defined criteria

Code: BR-003 Name: Every PerformanceReview follows defined criteria and cadence Description: Employee appraisal must rest on explicit criteria and a defined cadence; outcomes are tracked and shared with the employee. An appraisal cannot change contractual status without a formal process. Rationale: Ensure fairness, transparency and traceability of the appraisal process. Priority: MEDIUM Actors: Line Manager, Employee, HR Manager Traceability: events/domain-events.md ReviewCompleted; glossary.md Performance.

---

BR-004 - Complete onboarding before full operation

Code: BR-004 Name: An Employee reaches full operation only after a completed OnboardingPlan Description: A new hire goes through an OnboardingPlan (documents, initial training, equipment, access) before being considered fully operational (active state). Incomplete onboarding keeps the employee in onboarding. Rationale: Ensure compliance, safety and productivity of integration. Priority: MEDIUM Actors: HR Manager, Line Manager, Employee Traceability: state-machines/employee-lifecycle.md; events/domain-events.md EmployeeHired.

---

BR-005 - Occupational health data with reinforced protection

Code: BR-005 Name: Occupational health data is processed as special categories (Art. 9) Description: Employee occupational health data (fitness, health surveillance) are special categories under GDPR Art. 9: restricted access, purpose limited to occupational health surveillance, separate retention. Model description, not advice. Rationale: Protect special categories of data with reinforced measures (GDPR Art. 9). Priority: CRITICAL Actors: GDPR DPO, HR Manager Traceability: GDPR Art. 9 (special categories); D-37-04-ART9; descriptive-only note.

---

BR-006 - Data-subject rights handled within deadlines

Code: BR-006 Name: Employee rights requests are handled within the required deadlines Description: Access, rectification, erasure or portability requests by the employee as data subject are recorded and handled within the required deadlines, with a traceable response. Descriptive process model, not legal opinion. Rationale: Respect data-subject rights (GDPR Chapter III). Priority: HIGH Actors: GDPR DPO, HR Manager Traceability: GDPR Chapter III; events/domain-events.md FeedbackRecorded; descriptive-only note.

---

BR-007 - Offboarding revokes access and regulates retention

Code: BR-007 Name: Offboarding revokes access and regulates data retention Description: On termination, OffboardingStarted revokes access, recovers equipment and defines the retention period of residual data per legal purposes. The employee moves to offboarding then alumni. Rationale: Ensure information security and compliance in post-employment data handling. Priority: HIGH Actors: HR Manager, GDPR DPO Traceability: state-machines/employee-lifecycle.md; events/domain-events.md OffboardingStarted.

---

BR-008 - Training tracked and linked to the plan

Code: BR-008 Name: Every TrainingDelivered is linked to a TrainingPlan and recorded Description: Training delivered to the employee must be linked to a TrainingPlan with objectives and recorded (date, content, outcome). Mandatory training (e.g. safety) is distinct from development training. Rationale: Ensure traceability of competences and compliance of mandatory training. Priority: MEDIUM Actors: HR Manager, Employee Traceability: glossary.md; events/domain-events.md TrainingDelivered.

---