Every employer is responsible for ensuring that leave management complies with the GDPR. Leave requests, holiday balances, and absence records all contain personal data falling within data protection law’s scope. Violations can result in substantial penalties.