HR sits on salaries, health information, performance notes, and home addresses. That makes data protection less of a legal checkbox and more of a duty of care.
The principles that do the heavy lifting
Only collect what you'll genuinely use
Keep it accurate, and delete it when the reason to hold it ends
Control who can see what, and log access
Compliance is mostly a by-product of good hygiene: know what you hold, why you hold it, and who can touch it.
None of this requires a legal team on retainer. It requires a single source of truth with sensible permissions — which is exactly what modern HR software is for.