How the employee portal supports GDPR, BetrVG co-determination, DORA and NIS-2 policy distribution, logging and accessibility, and which flags you need.

The portal handles employee data every day, so data protection and co-determination are built into how it works. The table shows which requirements it supports and how. The portal provides controls and evidence; it does not by itself make an organisation compliant.

Requirements and evidence

Requirement	TENSOR feature	Evidence produced
GDPR Art. 5(1)(c): data minimisation	Directory fields are private until published; importing from the company directory publishes nothing; anonymous polls; PII-free analytics	Directory settings history in the audit log
GDPR Art. 20: data portability	Self-service download of your personal data as a JSON file (flag `gdpr_enhanced_data_export`)	The export file; audit entry
GDPR: pseudonymisation	Works council and restricted views replace identities with stable pseudonyms; small groups are suppressed (k-anonymity, default 5); de-pseudonymisation needs dual approval and becomes visible to the works council after seven days	PII access log, de-pseudonymisation records
GDPR Art. 17: erasure	Deletion of primary data always leaves a sealing record in the audit chain. The retention purge and erasure execution workflow is planned — not yet available	Sealing record
BetrVG §87(1)(6): co-determination on technical monitoring	Directory and polls blocked until the works-council acknowledgement is recorded; no relationship mining; no individual rankings; My activity shows only your own data	Works-council acknowledgement date, audit entries
DORA Art. 19 / NIS-2 Art. 23 / historical BAIT: policy distribution	Mandatory acknowledgements with append-only, hash-chained receipts; author of a mandatory item cannot publish it	Receipts per person and publication, acknowledgement coverage
DORA / NIS-2: access management	Users deactivated in the company directory lose access automatically and leave the published directory	Directory sync run log, audit entries
DORA Art. 5 / MaRisk AT 4.3.1 / historical BAIT 6: logging	One audit entry per change, append-only and hash-chained	Audit log with daily verification
Accessibility: WCAG 2.1 AA	Keyboard operation with visible focus, screen-reader labels and announced states, contrast checks, navigation targets of at least 44 pixels on phones, personal accessibility settings; automated accessibility checks in the build	Accessibility test results

Receipts are evidence

Receipts for mandatory items are regulated artifacts.

A receipt is written together with an audit entry in the same transaction.
Receipts have no update or delete right at database level and survive the archiving of their publication.
With the first receipt, the flags publication_acknowledgements (and for banners portal_banners) become sticky: they can only be switched off with a reason and a second approver.

For evidence of distribution, a push banner carries a Regulated intent, for example dora-major-incident. The reasoning behind sticky flags is explained in Why regulatory toggles are sticky.

Works council first

Before you switch on the people directory or run employee polls in Germany, agree the scope with your works council (for example in a works agreement). TENSOR records the date of that acknowledgement and refuses to enable the directory or open a poll without it.

What the works-council gate covers:

Enable the people directory stays blocked with "Record the works-council acknowledgement first." until a tenant administrator with directory.admin clicks Record acknowledgement under Workspace settings → People directory.
A poll cannot be opened without the recorded acknowledgement. A release attempt fails and appears under Release failures in the portal manager.
Works council members see only the pseudonymised aggregate view (flag betrvg_works_council_view); no individual tickets and no directory.

Data minimisation in practice

Directory fields leave the server only if the administrator has published them. Importing users from the company directory does not publish anything; see Directory Sync — ingest is not publish.
Anonymous polls store answers without a user ID; a separate token only records that you voted, never what. Results appear only once the results threshold is reached (five by default).
Usage events and analytics never contain search text, poll answers, publication titles or the person you looked up. Analytics is opt-in per company and anonymous.
The portal uses only strictly necessary session cookies; no analytics or marketing tags load by default.

Segregation of duties that supports compliance

The author of a mandatory publication, a mandatory poll, or a critical or mandatory banner cannot publish or open it.
Nobody can approve their own service request, also not through a delegation.
Adding report exports or audit permissions to a custom role requires dual approval.

See Roles and permissions and the platform-wide segregation of duties.

Which flags you need

For	Switch on
Receipts for mandatory policies	`tenant_publications` and `publication_acknowledgements`
Mandatory banners with receipt	`portal_banners`
People directory	`tenant_directory` plus the works-council acknowledgement
Employee polls	`portal_polls` plus the works-council acknowledgement
Personal data export	`gdpr_enhanced_data_export`
Pseudonymised works council view	`betrvg_works_council_view`

All flags are switched on under Workspace settings → Regulatory features. Every flag with its sticky condition is listed in the toggle catalog.

Compliance