When introducing desk sharing, HR and IT should make sure that purpose, legal basis, data types, access rights, deletion periods and data processing are set out in writing before go live, and that the desk booking software used supports data minimisation technically. Desk sharing can then usually be implemented in a GDPR compliant way. The assessment in the individual case lies with the data protection officers and should be legally reviewed.
The typical trigger: a company wants to introduce desk sharing with booking software in Microsoft 365 as an organisational model. HR and IT are to clarify together with data protection which personal data arises. The works council and data protection officers want clarity before giving their approval.
This guide is aimed at HR, IT, data protection officers and works council members in companies with 250 or more employees using Microsoft 365. It focuses on the personal data of a desk booking solution, the division of tasks between the roles involved and a checklist for GDPR approval.
What personal data arises in desk sharing
Desk sharing projects usually involve personal data. As soon as employees book a workstation, records are created that can be attributed to an identifiable person. Early transparency towards the works council and data protection is therefore the first step to build trust and avoid delaying implementation.
Master data from Microsoft Entra ID and HR systems
A desk booking solution typically holds basic data: name, business email address, department, location and possibly cost centre or team. This master data is usually synchronised via a directory service such as Microsoft Entra ID or an HRIS. Automatic synchronisation avoids duplicate data maintenance and reduces sources of error.
Master data is personal data within the meaning of the General Data Protection Regulation (GDPR) and should be described as such in the data protection documentation.
Booking data with location, period and resource
Every booking generates concrete information: date, time, booked resource (shared workstation, meeting room, parking space), zone or floor. Desk sharing software enables workstations to be reserved digitally in real time. Precisely this reservation data allows conclusions about attendance patterns, even without explicit working time recording.
If analyses are too granular and not aggregated, the impression of performance or behaviour monitoring can quickly arise. It should therefore be set out in writing that booking data is usually processed only for organising workstations.
Booking rules, clean desk policy and desk sharing ratio
Organisational rules also determine which data arises in the booking system. Booking rules define how far in advance workstations can be reserved, when unused bookings expire and who may book for others. The more detailed these rules are, the more data is generated. Hot desking without reservation usually generates less personal booking data than fixed advance bookings.
A clean desk policy also makes sense from a data protection perspective: clean desk rules ensure that confidential documents are not left on shared desks. Such rules on order in the workplace can be subject to co-determination under employment law and should therefore be agreed with the works council. Companies ideally plan the desk sharing ratio, i.e. the ratio of workstations to employees, on the basis of aggregated utilisation rather than personal individual analyses.
Attendance information and IP-based presence
Attendance information describes whether a person is in the office on a given day, regardless of exact working hours. IP-based presence detects attendance automatically via the existing network infrastructure, without an additional check-in. There is no geolocation, no movement profiles are created, and there is no working time recording.
Whether such attendance information is permissible depends on the specific design and should be assessed by data protection officers in the individual case.
Usage analyses and aggregated Office Intelligence
For space and cost decisions, for example on the number of desks needed or optimising areas, it is not the booking data of individuals that matters but anonymised, aggregated figures: average utilisation per area, heavily used zones, comparison of locations. Such analyses allow no conclusions about individual employees and at the same time provide a basis for reviewing rent and space costs. How the use of office space can be recorded with different measurement methods in a privacy compliant way and analysed anonymously is shown in our guide to measuring office utilisation in a GDPR compliant way.
The target picture for HR, IT and the works council is a setup in which strategic space decisions are based on aggregated data, without monitoring employees. Booking data should usually be anonymised or deleted as soon as it is no longer needed for the defined purpose. Particular care is needed in small teams or with rarely used resources, as re-identification may be possible by combining data with other sources.
The GDPR principles usually affected by desk sharing
HR, IT and data protection should go through the relevant GDPR articles together before the works council exercises its co-determination rights. All of the following statements describe what usually applies. A legal review in the individual case remains necessary.
Purpose limitation and data minimisation under Art. 5 GDPR
Typical legitimate purposes in the context of desk sharing: organising workstations, planning office space, complying with occupational safety requirements. The GDPR requires data minimisation when processing personal data. In practice, this means: doing without unnecessary fields, optional details on the work location, limiting the booking history to sensible periods.
Purpose limitation should be documented in writing and communicated internally, especially to the works council and employees.
Defining the legal basis under Art. 6 GDPR
In the employment context, two legal bases are usually discussed: the performance of obligations under the employment contract and the employer's legitimate interest in efficient workstation organisation. Which one applies in a specific company is decided by data protection officers and legal advisers together with HR.
The chosen legal basis should later be referred to again in the privacy information under Art. 13 GDPR.
Information obligations under Art. 13 GDPR
Employees should be informed transparently about data collection in desk sharing. Before the system starts, they should usually learn: the purposes of processing, data categories, retention period, groups of recipients and a reference to the rights of data subjects (access, rectification, erasure).
The desk sharing rules should be aligned with the privacy information and any existing works agreement to avoid contradictions. The clean desk policy can also be recorded there as a rule for tidy workstations communicated in writing.
Data processing under Art. 28 GDPR
The desk booking software is, as a rule, a processor within the meaning of Art. 28 GDPR. The company remains the controller. Particularly relevant in the data processing agreement are: subject matter and duration of processing, categories of data, sub-processors, technical and organisational measures (TOMs), from automatic screen locks to individual access rights, and the deletion concept.
HR, IT and data protection should review this agreement together before a provider is chosen.
Security of processing under Art. 32 GDPR
From the perspective of the works council and data protection, the following security aspects are particularly important: encryption in transit and at rest, access control with differentiated roles, logging of administrative access and protection against unauthorised viewing. These technical and organisational measures (TOMs) should be documented. GDPR compliant solutions are intended to protect employees against misuse of data.
A certification under ISO 27001 is a strong signal of a structured information security management system, but does not automatically replace all legal requirements. It shows that the provider has its security processes assessed regularly by external auditors.
Checking whether a data protection impact assessment under Art. 35 GDPR is needed
A data protection impact assessment (DPIA) may be required for certain desk booking systems. Systems that process attendance data, especially with automatic or IP-based presence detection, should be explicitly checked against Art. 35 GDPR by the data protection officers. The decision on the DPIA and its execution lies with the data protection officers and should be legally assessed.
In Germany, the works council's right of co-determination under Section 87(1) No. 6 of the Works Constitution Act is also usually affected if technical equipment is suitable for monitoring behaviour or performance. Rules on order in the workplace, such as booking rules or clean desk rules, can additionally fall under Section 87(1) No. 1 BetrVG. This should be legally reviewed. In Austria and Switzerland, partly different rules apply, which should be reviewed separately.
Division of tasks: what HR, IT and data protection each clarify
A shared roadmap with clear responsibilities reduces friction and mistrust in desk sharing projects. The following table shows who takes on which tasks and what the result should be.
Table: roles and responsibilities in the desk sharing project
| Role | Tasks | Result |
|---|---|---|
| HR | Defining the purposes of data processing in the context of work organisation; alignment with the hybrid work policy; drafting information for employees; agreeing the ergonomic equipment of shared workstations | Written description of purpose, legal basis and organisational rules as the basis for privacy information and the works agreement |
| IT | Defining selection criteria for the technical solution (Microsoft 365 integration, Microsoft Entra Sync, role and permission concept, security standards, hosting location); technical review of the provider | Technical architecture concept with integrations, authorisation concept and documentation of protective measures |
| Data protection officers | Assessment of data categories, legal basis, necessity and proportionality; review of the data processing agreement and the TOMs | Data protection assessment with recommendation (including a DPIA where needed), finalised privacy information under Art. 13 GDPR |
| Works council (as a party involved) | Reviewing the impact on employees; assessing transparency, fairness and possible monitoring; early involvement in the introduction process; contributing to a works agreement for desk sharing and booking software | Co-determined rules on use, data access, analyses and complaint channels that strengthen trust in the system |
Involve the works council early. In desk sharing, individual parts of the design can be subject to co-determination under Section 87 BetrVG, so that works council approval may be required depending on the measure. Depending on the design, questions of health protection and workplace design can be affected as well as transparency and analyses. A works agreement is usually the standard way to regulate these points bindingly and to record the involvement of all parties. Its design should be legally reviewed.
Checklist for GDPR approval of desk booking software
The following checklist is intended as a working basis for data protection officers and the works council. It does not replace a legal review, but provides structure for the most important checkpoints before introduction.
Purpose and legal basis
- Is the purpose of the desk booking solution defined in writing (e.g. organising workstations, planning space, complying with occupational safety) and agreed internally?
- Is it documented which legal basis the processing of booking and attendance data in the employment context is based on?
- Is it ensured that the data is not used for performance or behaviour monitoring, and is this clearly communicated to employees?
Scope of data and anonymisation
- Is only the data collected that is required for the desk booking purposes (no collecting optional information without a specific purpose)?
- Is it planned that analyses of office utilisation are anonymised or aggregated so that no conclusions about individuals are possible?
- Is specifying the work location (e.g. office, home office, other location) optional?
Hosting, server location and data processing
- Is all data processed and hosted in the EU, without transfer to third countries outside the EU/EEA?
- Is there a data processing agreement under Art. 28 GDPR with clear rules on sub-processors, TOMs and deletion obligations?
- Are the provider's processing routes documented transparently, including for connected tools or calendar synchronisation (e.g. in a technical service description or list of TOMs)?
Security and certification
- Is data encrypted in transit and at rest according to the state of the art, and which methods does the provider name?
- Is the provider ISO 27001 certified, and is the scope of this certification explained? (An ISO certification is a quality criterion, not a legal obligation.)
- Are there clear processes for reporting and handling security incidents between the company and the provider?
Access rights, roles and transparency within the company
- Is a role concept defined that specifies which groups (e.g. facility management, HR, managers) may access which data?
- Is it ensured that individual booking or attendance data is not visible to managers without necessity, and that mainly aggregations are used?
- Are administrative activities logged so that unauthorised access can be traced?
Deletion concept and rights of data subjects
- Are deletion periods for booking and attendance data defined and documented?
- Is it regulated how requests from employees for access, rectification and erasure in connection with desk booking are handled?
- Can historical booking data be reduced so that only anonymised information relevant for utilisation analyses remains?
Objection: does desk sharing software make the attendance of individual employees visible?
This objection comes up in many coordination meetings with the works council and data protection. It is justified and deserves an objective answer rather than playing it down.
A booking is not automatically attendance monitoring
A booking is first of all a reservation. It does not prove that a person was actually on site. Unused bookings and short notice changes weaken this equation further. Desk booking systems can be deliberately designed so that they do not record working time and do not create movement profiles.
Anonymous booking and optional work location
Anonymous bookings or bookings in team areas without showing names to colleagues are technically possible. Specifying the work location (office, home office, on the move) can be made optional and thus supports more flexibility in hybrid working models. It should not become a mandatory check of office attendance, but make the desk sharing concept more flexible.
Aggregated analyses and role concepts instead of detailed monitoring
Management and space planning should primarily use aggregated reports that do not allow statements about individual employees. Desk booking software can improve space efficiency in the office if it shows utilisation at zone or location level, not at individual level.
A clear role concept defines who may see which detailed data. The works council and data protection should review this concept in advance. In addition, purpose limitation should be set out in writing.
There is no guarantee that every design is permissible. The specific solution is usually developed together with the works council and data protection officers.
How Seatti supports the GDPR requirements technically
Seatti runs natively in Microsoft Teams and Outlook and, as a platform for the modern office, combines booking and analysis. The following table maps the checkpoints from this guide to Seatti's capabilities.
Table: GDPR requirements in desk sharing and how Seatti addresses them
| Requirement | What Seatti provides |
|---|---|
| Hosting and data processing | Hosting and data processing in the EU, GDPR compliant, data processing agreement under Art. 28 GDPR, encryption with TLS 1.2 and AES 256 |
| Data minimisation and no monitoring | Usage data is analysed in pseudonymised and aggregated form, without conclusions about individuals. Seatti works without live monitoring, geolocation and working time recording. Bookings can be anonymous, specifying the work location is optional. |
| Attendance data without movement profiles | IP-based presence records only the network login, without location tracking and without movement profiles |
| Integration into Microsoft 365 and consistent master data | Microsoft Entra Sync for automatic synchronisation of users, groups and access without duplicate data maintenance; native integration into Microsoft Teams and Outlook |
| Access rights and enterprise structures | Management of multiple locations, companies and rule sets with granular roles and permissions, so that access to personal booking data can be clearly controlled |
| Certification | ISO 27001 certified |
| Technical rollout after data protection approval | Rollout usually in under two weeks; the data protection review beforehand depends on your company |
Seatti is built to make co-determination easier. For the review by data protection and IT, the ISO 27001 certificate, the information on data protection at Seatti and the description of IP-based presence are available. How booking is integrated into Teams and Outlook is shown on the Microsoft 365 integration page. Which functions are included in which package, for example meeting room bookings, visitor management, IP-based presence or compliance roles, can be found on the pricing page.
Once the data protection question is settled, a second one remains: in many companies, space and cost decisions rely on estimates rather than reliable usage data. A pure booking solution only records who sits where and when. With Workspace Management and Office Intelligence, Seatti combines booking and aggregated analysis on one platform within Microsoft 365 and shows how much space your company really needs. Setting up data protection properly therefore also lays the foundation for space decisions that are no longer based on assumptions.
How to prepare data protection approval
Desk sharing in the Microsoft 365 environment can usually be designed in a GDPR compliant way if purpose, scope of data, roles, deletion concept and data processing are clearly regulated and documented in advance.
Next steps:
- Go through the checklist from this article together with HR, IT, data protection officers and the works council and document open points.
- Only shortlist providers once hosting, certification and data processing have been clarified.
- Hold a joint product demo with data protection and the works council to clarify specific questions about data flows, roles and analyses directly in the system.
Would you like to see how Seatti runs in your Microsoft 365 environment? In a 30 minute walkthrough, we show how Seatti simplifies your office processes and puts your space decisions on a solid data basis.
Read more: Works agreement for desk sharing: checklist and model and GDPR compliant visitor management.
Author and sources
Author: Saskia Neuner, Chief of Staff at Seatti. As of 11 November 2026.
This guide does not constitute legal advice and does not replace a legal review in the individual case.
Sources:
- GDPR (Art. 5, Art. 6, Art. 13, Art. 28, Art. 32, Art. 35)
- German Works Constitution Act (Section 87(1) No. 1 and No. 6)
- Seatti ISO 27001 certificate (Trust Center)
- Seatti data protection
- Seatti IP-based presence
- Seatti integration
- Seatti pricing
- Workplace Analytics
- Office Intelligence
- Guide to measuring office utilisation in a GDPR compliant way
Frequently asked questions
Usually yes, if purpose, legal basis, scope of data, access rights, deletion periods and data processing are defined and documented before introduction and the software supports data minimisation and aggregation. The assessment of the individual case lies with the data protection officers. A legal review is recommended.
In the employment context, the performance of obligations under the employment contract or the employer's legitimate interests usually come into consideration. Which option is chosen in a specific company is decided by data protection officers and legal advisers. This legal basis should be clearly named in the information under Art. 13 GDPR.
Whether a data protection impact assessment is required depends on the risk to the rights of the data subjects. Systems that process attendance and behavioural data should be explicitly checked against Art. 35 GDPR by the data protection officers. The decision can only be made for each company individually.
Seatti processes and hosts data in the EU and works in a GDPR compliant way with data processing under Art. 28 GDPR. Details on data processing can be found on the data protection page of Seatti.
After data protection approval, the technical rollout of Seatti usually takes less than two weeks. The schedule: kick-off and technical installation on the first day, admin training and office configuration in the first week, user onboarding in the second week, followed by go live. The preceding data protection and co-determination review is project specific and should be started early by HR, IT, data protection and the works council.
