Follow one new hire from offer to first day, and you can see exactly where HR compliance quietly breaks down.
Every new hire sets off the same sequence. An offer goes out. A contract comes back signed. Then a scramble begins: bank details, a national registration number, diplomas, certificates, emergency contacts, a copy of an ID. Somewhere between the offer and the first day, an HR team gathers more sensitive personal data about one individual than most departments handle in a quarter.
Most of it arrives by email.
That is the part worth looking at. Signing itself has been digitised in most organisations. The steps on either side of it, establishing who the person is and collecting the data are often still manual, and that is where the compliance risk actually sits.
1: Knowing who you are hiring
Remote hiring made routine a question that used to answer itself: is this person who they say they are? You may never meet a new colleague face to face before their first day, and a scanned ID card proves very little.
This is where a national digital identity comes into place. In Belgium, itsme® is the obvious example, more than eight million users, and an app most candidates already have on their phone for banking, insurances, telecommunications, energy providers, and much more.
2: The contract
Belgium is stricter when it comes to contract rules. Under Article 3bis of the Employment Contracts Act of 3 July 1978, an employment contract concluded electronically must carry a qualified electronic signature (QES), or one offering equivalent guarantees, such as a signature generated with signature platform Penneo and itsme®. A basic click-to-accept is not enough.
Two conditions travel with it. Neither party can be obliged to conclude the contract electronically. And the signed contract must be archived with a qualified electronic archiving service, and kept for at least five years after the employment relationship ends.
That is what Penneo Sign is for. Combined with itsme®, a qualified signature stops feeling like a special procedure and becomes the same few taps someone already uses to log in to their bank.
3: Everything else
To finish up a contract, a lot of data is required: a national registration number, bank details, diplomas or certificates, dependants for payroll, sometimes a work permit. HR sends an email. Some of it comes back. A reminder goes out. Attachments accumulate in an inbox. Someone re-types the results into the HR system.
Every one of those steps is a small GDPR exposure, sensitive personal data sitting in mailboxes, copied by hand between systems, with no clear record of who supplied what.
This is why we built Penneo Collect. Instead of chasing documents, HR sends one secure request. The form arrives pre-filled with what you already know, the new hire completes the rest in a single guided flow on their phone, tablet or laptop, uploads what is needed, and confirms the submission with their eID. Verified data and files return to the employee record in your HR system, and the whole exchange is sealed in a tamper-proof PDF showing who submitted what, and when.
Nothing lands in an inbox. Nothing gets re-typed. And if anyone later asks where a particular piece of employee data came from, the answer takes seconds to find.
4: The years afterwards
Onboarding produces records that outlive the onboarding, and often the employee. Retention obligations, audit requests, disputes and data subject access requests all arrive long after the first day is forgotten.
A process designed only to get someone started tends to leave those questions unanswered. A process designed with the record in mind answers them almost for free.
Why this matters now
The timing is not accidental. By the end of 2026, every EU member state must offer at least one European Digital Identity Wallet under eIDAS 2.0. From late 2027, sectors such as banking and telecoms must accept it. Employers are not in that first wave, but new hires will arrive already carrying verified digital identity and expecting to use it.
The organisations that handle that easily will be the ones already treating identity, signing and data collection as one connected process rather than three separate scrambles.
Onboarding is the first thing a new colleague experiences of how your organisation actually works. It is worth getting right.