GDPR-compliant idea management software processes employees’ ideas as personal data under a data processing agreement, with a published sub-processor list, EU hosting or a valid transfer mechanism, deletion you control and anonymity you can set where it is needed. No vendor can make your programme compliant on its own: the lawful basis, the notice to employees, the retention rule and the works council agreement are the employer’s job. The software must make those choices possible and keep its own part of the chain short and documented.
Why are employee ideas personal data?
An idea is personal data as soon as it can be linked to a person, which in most programmes is always. The submitter’s name, email, role and site are stored with the idea, and comments, votes and scores are linked to the people who gave them (Article 4(1) GDPR).
The content matters too. An idea about a dangerous loading bay may name the colleague who was injured there, and that is health data, a special category under Article 9, which may only be processed if a condition in Article 9(2) applies. For most programmes the practical answer is to word the challenge around the hazard rather than the person, ask contributors to leave health details out, and have managers remove them when they appear.
What lawful basis covers a staff idea programme?
For a private employer, the usual basis is legitimate interests under Article 6(1)(f), backed by a written balancing test showing that collecting ideas does not override employees’ rights. Consent is weak at work: Recital 43 and the European Data Protection Board’s guidance note that the imbalance between employer and employee means it is rarely freely given.
A public body cannot rely on legitimate interests for its tasks (the last sentence of Article 6(1)), so municipalities and agencies usually use Article 6(1)(e), a task in the public interest. Article 88 lets member states and collective agreements set more specific rules for employee data, so check your national law. Whatever the basis, contributors must be told at the point of collection what happens to their idea and who sees it (Article 13).
What should the DPA and the sub-processor list show?
You are the controller and the vendor is a processor, so Article 28 requires a data processing agreement (DPA). Look for:
- processing only on your documented instructions;
- confidentiality for everyone who handles the data;
- the security measures under Article 32;
- a list of sub-processors, with notice before any change and a right to object;
- help with data subject requests and breach notification;
- deletion or return of the data when the contract ends.
The sub-processor list is where promises become checkable: each entry should name the company, where it processes data, what it does and the transfer mechanism.
Does EU hosting settle the transfer question?
It settles most of it, not all of it. EU hosting keeps the database in the EU, but email, support tools and AI services can still send personal data elsewhere, and Article 44 onwards applies to every transfer outside the EU and EEA.
So read the sub-processor list line by line: for each entry, check where it processes data and which transfer mechanism covers it. If your policy needs everything inside your own walls, ask about on-premise delivery.
How long should ideas be kept, and who deletes them?
Only as long as the programme needs them (storage limitation, Article 5(1)(e)), and the controller sets that period. A common rule: keep implemented ideas while their value is reported, and delete rejected ones a set time after the decision. Ask vendors whether managers can delete single ideas and whole collections, whether a person’s account can be removed on request (Article 17), and what happens to the data and backups when the contract ends.
Does anonymous submission solve GDPR?
Only partly. If nothing linking the idea to a person is stored, it is not personal data (Recital 26), but the text can still identify someone: in a team of six, “the night shift on line 3” is a name. Anonymity also means no one can ask the contributor a follow-up question or tell them what happened to their idea.
So anonymity should be set per collection, not for the whole platform. A safety or culture challenge may need it. A cost-saving challenge usually works better with names, so people get the credit.
Does Article 22 apply to AI scoring of ideas?
Rarely, but check. Article 22 covers decisions based solely on automated processing that produce legal effects for a person or similarly significantly affect them. An AI that summarises ideas or flags duplicates while people decide is not that. An algorithm that alone decided bonuses, awards or performance marks from someone’s ideas could be. Keep a person in that decision and record that you do.
Do we need the works council or union first?
In most European countries, yes, and before launch. In Germany, § 87(1) BetrVG gives the Betriebsrat co-determination rights over technical systems suitable for monitoring behaviour or performance (no. 6) and over the principles of the suggestion scheme (no. 12), so a Betriebsvereinbarung is the normal route. In Sweden, the employer must negotiate with the union before a major change under 11 § MBL. In France, companies with 50 or more employees must inform and consult the CSE before introducing new technologies or means of monitoring employees’ activity (Code du travail, articles L2312-8 and L2312-38). Anonymity, retention, access and AI are the usual points of negotiation.
What does ISO 27001 tell you about GDPR?
It tells you how the vendor runs information security, not that its processing complies with GDPR. ISO 27001 covers an information security management system; it does not cover lawful basis, transfers or retention, so you still need the DPA and the sub-processor list.
Hives.co’s security is set up in line with the ISO 27001 standard. Alongside that you get the DPA in every contract, a public sub-processor list, EU hosting on Google Cloud in Germany, a written security overview for your IT review and direct answers to your security questionnaire.
What should you ask idea management vendors?
| What to check | Why it matters | How Hives does it |
|---|---|---|
| DPA | Required by Article 28 | Part of every customer agreement |
| Sub-processors | You must know who else processes the data | Two, listed publicly, 30 days’ notice of changes |
| Hosting | Decides where transfers start | Google Cloud in Frankfurt by default, on-premise on request |
| AI processing | Data must stay on the agreed path | Ida on Vertex AI in Frankfurt, not used to train models |
| Anonymity | Some topics need it, most don’t | Set per collection |
| Sign-in | Access ends when employment ends | Microsoft and Google SSO on every plan, SAML on Enterprise |
| Contract end | Storage limitation | 60 days to export, then deletion within 30 days |
| Security standard | Procurement will ask | Set up in line with the ISO 27001 standard |
How does Hives handle GDPR?
Hives is idea management software for organisations from about 100 employees to multinational groups. Teams start with one challenge and grow the same setup to more sites, countries and business units. Hives is a Swedish company and your processor for everything in your workspace, under the Personal Data Processing Terms in your agreement. As a processor, Hives.co is fully GDPR compliant.
The service runs on Google Cloud in Frankfurt. Every sub-processor is on the sub-processor page, where changes are announced at least 30 days ahead. Ida, the AI assistant, runs on Vertex AI in the same region, reads only what the person asking may see, and AI features can be turned off.
Access starts with sign-in through the Microsoft or Google work account, so only your own people get in. Staff without a work email use their own email with a one-time passcode. Each collection has its own access scope and its own anonymity setting: hide contributor names (stored, but shown to no one else, not even Admins) or save contributions anonymously (no name stored at all). The security page and the privacy notice cover the rest.
When is another kind of tool a better fit?
When the reports are about wrongdoing, use a whistleblowing system: the EU Whistleblower Directive sets confidentiality and follow-up rules an idea programme is not built for. When the subject is incidents and injuries, use an EHS or incident management system, which handles health data and legal retention periods every day. The buyer’s guide sorts vendors by need.
Frequently asked questions
Is idea management software GDPR compliant by default?
No software is. The vendor can comply as a processor, but the employer still needs a lawful basis, a notice to employees, a retention rule and, in many countries, an agreement with employee representatives.
Do we need a DPIA for an idea programme?
Only if the processing is likely to result in a high risk (Article 35). Many idea programmes do not meet that bar, but some data protection officers run one when ideas may contain health or safety details or when AI analyses them.
Can employees ask for their ideas to be deleted?
Yes, under Article 17, subject to its exceptions. In Hives a contributor can delete their own idea while it is still in the Inbox, managers can delete it later, and an account is removed on the organisation’s request.
Can an anonymous idea be deleted on request?
Usually not, because nothing links it to the person asking. An idea saved with no name is not personal data, so the right does not apply, but a manager can still remove it if the text identifies someone.
What does Hives cost?
Core is €695 a month, Pro €1,495 and Enterprise €1,995, billed annually with no per-user fees. The DPA and EU hosting come with every plan. See pricing.
The regulation itself is on EUR-Lex.