Luna HR Docs

Data Requests (GDPR)

Luna HR can produce a structured JSON export of what it holds about one person. This supports the right of access (Article 15) and data portability (Article 20).

Producing an export

Two routes, both from the Download my data button:

  • Self-service — any employee can export their own record, no permission needed.
  • Administrator — anyone with the admin permission can export a colleague in the same company.

Either way the download is written to the subject's activity timeline as a data-access event, so there is a record of who took a copy and when.

Before downloading, the dialog lists every category and how many records are in it, so you can see the shape of the answer before you generate it.

What the export contains

The whole profile, plus records from across the modules: leave, expenses (including individual line items and pre-approvals), mileage, training and certifications, CPD, skills, equipment held, documents, signature requests, goals, submitted reviews, 1:1s, org memberships, working patterns, emergency contacts, custom fields, notification and device settings, the notifications they were sent, onboarding and offboarding records, AI conversations, and the subject's own activity timeline.

Two things are shaped by who asked:

Unsubmitted reviews are excluded. A performance review a manager hasn't submitted yet is a working draft. Luna doesn't show it to the subject in the app, and it isn't included here either. Once submitted, it is.

Anonymous responses are self-service only. Wellness survey responses and 360 feedback the person wrote appear in their own export but never in an administrator's. Both features promise that responses can't be traced back to a respondent, and an admin export keyed to that person would break exactly that promise. If a subject wants those records, they export them themselves.

What it deliberately leaves out

The export declares its own gaps. Every bundle carries an omissions list naming what wasn't included and why, so nothing is quietly missing:

| Not bundled | Why | |---|---| | Manager notes about the subject | Usually disclosable, but may name third parties — release through a reviewed request | | Safeguarding reports and case notes | May concern an ongoing process or identify a reporter | | Interview scorecards they wrote | Predominantly candidate (third-party) data | | Pre-employment applications | Not linked to the employee record; retrieve by email address |

If a bundle ever contains a non-empty issues list, a data source failed to load and the export is incomplete — don't send it in answer to a request until that's resolved. The confirmation dialog warns about this before you download.

What Luna does not do yet

There is no automated erasure. Nothing in Luna deletes or anonymises a person's record on request or on a schedule.

The retention period under Admin > Company > GDPR records your policy and stamps a review date on leavers when their offboarding completes. It does not delete anything, and there is currently no screen listing the records that have come due — so acting on that date is a manual process today.

Bear in mind that erasure is rarely absolute for employment records: UK employment law typically requires payroll records to be kept for at least six years. Take advice on what must be retained before deleting anything.