Skip to content
HR & Recruitment calendar_today Updated: 15 September 2026 schedule 3 min read

Can I Read an Employee's eID Electronically?

verified Last reviewed 15 September 2026 · GDPRWise legal team

Not as an automatic default step: use a card reader only with an appropriate legal basis and read only the data that is necessary for the specific purpose.

summarize Key Takeaways
  • check_circle Technically restrict the software to the necessary fields, with a whitelist
  • check_circle Disable automatic import of the photograph and unrelated fields
  • check_circle Offer a manual alternative where relevant
  • check_circle Document the lawful basis and the retention period

Do not use electronic reading of the eID as an automatic default step when an employee joins. With a card reader, more data can become available than you need for personnel administration, including the address, the photograph, the national identification number (in Belgium the rijksregisternummer) and the electronic certificates on the card.

Electronic reading requires an appropriate legal basis. If consent is being considered, it must be genuinely free, specific and informed, and an equivalent alternative must exist.

Because of the imbalance of power between employer and employee, consent is usually not a suitable default basis in the employment relationship. The European Data Protection Board (EDPB) notes that employees can give free consent only in exceptional circumstances.

The Belgian data protection authority further states that reading must be limited to the data strictly necessary for the purpose, and that specific conditions apply to certain card data.

If you do use a card reader

Technically restrict the software to the necessary data. Do not automatically store all available card data.

Inform the employee beforehand about which data is read, why, where it is stored and how long it is kept.

A visual check and separate recording are usually less intrusive. Which data you then record is explained in Which data from an employee’s identity card may I record?

Electronic reading must comply with the principles of lawfulness, purpose limitation and data minimisation (Article 5(1)(a) to (c) GDPR) and requires a legal basis under Article 6 GDPR; if you rely on consent, the conditions of Article 7 GDPR apply. You must inform the employee beforehand (Article 13 GDPR), design the software according to data protection by design and by default (Article 25 GDPR) and secure the data read appropriately (Article 32 GDPR). Article 87 GDPR lets member states set specific conditions for the national identification number on the card, and national legislation on identity cards and population registers sets the further rules.

auto_awesome Do you know which employee data you process?

GDPRWise maps your HR processes, from onboarding to offboarding, so you know for every data item why you keep it.

Share share LinkedIn mail Email
GW
GDPRWise Editorial

This article was written by the GDPRWise team and reviewed by our privacy experts. We regularly review our content for accuracy and legal correctness.