Is 360° feedback GDPR-compliant? What HR must settle before launch

To be clear from the outset: this article is not legal advice. It sets out the data-protection questions HR should settle before a 360° feedback process and points to the official texts. What is right for your organisation depends on purpose, audience, employee representation and risk – and belongs with your data protection officer and, where needed, a lawyer. Points specific to Germany are flagged as such.

Why 360° feedback is a data-protection project

360° feedback collects assessments of a person and is therefore almost entirely personal data. The leader's data is obvious: name, role, self-assessment, aggregated ratings, free text about them. Less obvious: every answer is also personal data of the person who gave it. Raters are data subjects under the GDPR, not merely data sources. Art. 5 GDPR provides the checklist: lawfulness and transparency, purpose limitation, data minimisation – and accountability, being able to demonstrate compliance.

DefinitionPersonal data in 360° feedback

Any information relating to an identified or identifiable person. For the leader: master data, self-assessment, group averages, free text about them. For the raters: assignment (supervisors, peers, direct reports), individual answers, completion status. Aggregation shields answers from the leader – it does not make them anonymous in the GDPR sense inside the vendor's database.

Legal basis: contract, legitimate interest, § 26 BDSG – and why consent is fragile

Under Art. 6(1) GDPR, processing is lawful only if one of the listed bases applies. For a 360° in employment, three are usually discussed: contract (point (b)), legitimate interest with a documented balancing test (point (f)) and, in Germany, § 26 BDSG, enacted under the opening clause in Art. 88 GDPR. Consent (point (a)) is the most fragile option in an employment relationship.

Why consent is fragile was set out by the Article 29 Working Party in Opinion 2/2017 on data processing at work (WP 249): given the imbalance of power, employees can give free consent only in exceptional circumstances, where refusing carries no adverse consequence. Contract and legitimate interest hold only where processing is genuinely necessary, proportionate and the least intrusive option.

The opinion predates the GDPR's application and was not among the documents the European Data Protection Board formally endorsed in 2018; supervisory authorities still rely on it. In Germany, § 26(2) BDSG adds that voluntariness is assessed with the employee's dependence in mind and may exist in particular where the employee gains a legal or economic advantage.

Germany: § 26 BDSG after the CJEU's C-34/21 ruling

On 30 March 2023 the CJEU held in C-34/21 that a national provision which merely restates the necessity condition of Art. 6(1)(b) or (e) GDPR is not a "more specific rule" under Art. 88(1) and must be disregarded unless it independently qualifies as a legal basis under Art. 6(3). The case concerned a Hessian provision whose wording mirrors § 26(1) BDSG; the prevailing reading in German commentary is that § 26(1) sentence 1 BDSG is equally affected. A 360° resting on § 26 BDSG alone stands on thin ice: anchor it in Art. 6(1)(b) or (f) GDPR as well and, where a works council exists, in a works agreement.

Co-determination under § 87(1) no. 6 and § 94 BetrVG is covered in 360° feedback and the works council.

Purpose limitation: development or appraisal?

The most important decision is the purpose. Art. 5(1)(b) GDPR requires specified, explicit and legitimate purposes and prohibits incompatible further processing. A 360° for development, with results seen only by the leader and their consultant, is a different undertaking from an appraisal system whose scores feed pay, promotion or exit decisions – it changes the balancing test, co-determination, risk and the raters' willingness to answer honestly. Fix the purpose in writing before you invite anyone.

Art. 22 GDPR adds a limit: nobody may be subject to a decision based solely on automated processing, including profiling, that produces legal or similarly significant effects. A 360° result must not be the sole basis of an automated promotion or selection decision unless an Art. 22(2) exception applies and the Art. 22(3) safeguards – human intervention, the right to contest – are in place. Who sees results at all: Can HR see individual 360° results?

Transparency and data-subject rights: Art. 13 and the right of access

Where data is collected from the data subject, they must be informed at that point (Art. 13 GDPR) – including purposes and legal basis (para. 1(c)) and, where you rely on legitimate interest, that interest (1(d)). That applies to the leader at the self-assessment and to every rater at the invitation. The vendor's privacy policy does not replace this notice: your organisation is the controller, the vendor a processor.

The hardest question is the right of access. The leader may access the personal data processed about them – ratings included. The same answers are personal data of the raters, who were promised anonymity. Both positions are legitimate; the tension can only be weighed case by case. Settle in advance: in what form access is given (for instance group values and unattributed free text, as in the report), who handles the request, how free text that could identify a person is treated, and how raters are told about that rule. How technical anonymity is produced: Is 360° feedback anonymous?

Data protection impact assessment: when it becomes likely

Art. 35(1) GDPR requires a data protection impact assessment (DPIA) before processing that – in particular using new technologies, and given its nature, scope, context and purposes – is likely to result in a high risk to the rights and freedoms of natural persons. Art. 35(3)(a) expressly names a systematic and extensive evaluation of personal aspects based on automated processing, including profiling, on which decisions with legal or similarly significant effects are based. Whether a purely developmental 360° falls under that is settled by the supervisory authorities' lists under Art. 35(4) – in Germany coordinated by the Datenschutzkonferenz (DSK), the conference of the federal and state supervisory authorities.

• A DPIA becomes more likely when results feed appraisal, pay or selection decisions;
• when many leaders are assessed repeatedly and profiles are linked across cycles;
• when free text is analysed automatically or combined with other HR data;
• when questions about workload and recovery are asked – for instance on Well-being – whose proximity to health data you should assess with your data-protection adviser.

Ask the vendor for support – Art. 28(3)(f) GDPR obliges a processor to assist the controller with its obligations under Art. 32 to 36, the DPIA included – and a description of the processing: data categories, storage locations, sub-processors, anonymity mechanics, deletion concept. Document a "not required" outcome with reasons too.

Processors, hosting and retention

A 360° vendor processes data on your behalf; Art. 28 GDPR requires a data processing agreement (DPA) setting out the processor's obligations. Ask specifically: where do database, authentication, files and application run? Which sub-processors exist, does any process data outside the EU – on what basis? Are free-text comments processed by third parties or AI services? A vendor who cannot answer in a list is not ready for a DPIA.

Retention is the question most often postponed. Define per data category how long it is needed for the purpose – invitation and status data, individual answers, reports, free text, logs. A report the leader wants to compare across cycles needs a different period from the raw answers behind it. Record the periods in the DPA and in the notice, including what happens when the leader leaves or the contract ends.

Pre-launch checklist

1. Set the purpose down in writing – development, not appraisal – and rule out a later change of purpose.
2. Document the legal basis, including the balancing test; in Germany, do not let § 26 BDSG carry it alone.
3. Involve the works council (Germany): check § 87(1) no. 6 and § 94 BetrVG, negotiate a works agreement – see 360° feedback and the works council.
4. Write the Art. 13 notice separately for leaders and raters, including the anonymity rules.
5. Decide how access requests are handled before the first one arrives.
6. Check whether a DPIA is required and document the outcome – a "no" as well.
7. Sign the DPA; review sub-processors, storage locations and third-country transfers.
8. Record retention, deletion and access rules: periods per data category, and who sees what.