If your employer has engaged HumanDynamics, this page explains the nature of that work, the legal basis for it, and what it means for you
HumanDynamics analyses how organisations communicate. We collect email and chat metadata: who contacts whom, when, and how often. We do not access any message content, subject lines, attachments, or calendar details
Every major data protection framework — GDPR in Europe, UK GDPR, CPRA in California, LGPD in Brazil, PIPEDA in Canada, and their equivalents across Asia-Pacific — permits employers to process employee data where there is a legitimate organisational purpose, the processing is proportionate to that purpose, and employees are informed. This page is part of that notification obligation
The legal basis used across all engagements is Legitimate Interests (or its equivalent under local law). For that basis to hold, the employer must demonstrate a genuine purpose, show that no less intrusive means would achieve it, and confirm that organisational interests do not override individual privacy rights. All three conditions are assessed and documented before any processing begins
The engagement falls into one of the following purposes:
Analysing how the acquired company operates in practice — its informal networks, collaborative patterns, and structural dependencies — to inform decisions about its future management as a standalone entity, independently of any integration decision
Does not extend to: redundancy selection, integration planning, or any individual assessment
Identifying structural alignment and misalignment between two organisations to inform decisions about the combined entity's design. This purpose only applies once a decision to integrate has been made and documented
Does not extend to: individual redundancy, pay harmonisation, or performance decisions
Identifying how existing people can be most effectively deployed within a proposed structure, with the explicit aim of minimising further workforce reduction
Does not extend to: redundancy selection, performance management, or pay decisions
Outputs are delivered as aggregates, structural groupings, or banded rankings. None refer to individuals by name or identifier in isolation. Every output group contains enough people that no individual within it can reasonably be inferred — the exact threshold is set relative to the organisation's size and is fixed before processing begins
Every individual is assigned a random pseudo-identifier at the point data is received. No analysis takes place on named data
Where a question can be answered at team or department level, it is. No individual appears in those outputs at all
Where individual-level structure matters, people are grouped by actual communication patterns rather than formal reporting lines. The output records group membership only — nothing about activity, influence, or performance
Where structural position is relevant to a specific design question, outputs use band assignments with a minimum number of people per band. Precise coefficients are never delivered
What changes is the basis on which they are made — and the degree of individual exposure involved
Named individuals assessed, quoted, and documented by consultants
Formal structure reviewed against named employee records. Shows hierarchy, not how work flows
Outcomes shaped by individual visibility and proximity to decision-makers. No audit trail
All analysis conducted on pseudonymised data. No names at any stage of processing
How the organisation really works — not how it appears on paper, and not dependent on who spoke to the consultant
Outputs are group-level only. Individual identity is not present in any finding delivered to the employer
Every data protection framework's necessity test requires that the same purpose cannot be achieved by less privacy-intrusive means. The conventional approach produces individual exposure at every stage. ONA metadata analysis, structured this way, does not
Data protection law gives you the right to know your data is being processed, to access it, to object to its use, to request deletion or restriction, and to complain to your national regulator if you believe your rights have not been respected. Which of these rights applies to you depends on your country
Contact your employer's Data Protection Officer or HR team directly. They are the data controller and are legally required to respond
To raise concerns about our processing, methodology, or controls, contact us directly. We respond to all enquiries within five working days
privacy@human-dynamics.ioWe recognise that analysis of workplace communication is something employees take seriously. The purpose statements, the group size controls, and the jurisdiction-specific processing rules are all documented in the pre-processing assessment completed before this engagement begins