How to build a GDPR-compliant new hire onboarding and document collection workflow in Formaloo

By the end of this guide, you'll have a single onboarding form that collects a new hire's I-9 document, bank details or a voided cheque, and a signed NDA, all stored in admin-only fields that regular teammates can't see. HR reviews and verifies each submission from a Kanban pipeline, sensitive fields anonymize themselves automatically once your retention window closes, and new hires check their status from their own portal page without ever seeing anyone else's paperwork.

Start from your Formaloo homepage rather than an empty form editor. Magic Create builds the entire field structure, including the admin-only fields, from one plain-language prompt.

1. Open Magic Create: From your Formaloo homepage, click Magic Create.

2. Describe the form: Paste a prompt describing a new hire onboarding form that collects full legal name, preferred name, personal email, start date, department, job title, and mailing address, then an I-9 identity document upload, a yes/no question asking whether the new hire wants to upload a voided cheque instead of typing bank details, bank account holder name, routing number, and account number, a voided cheque upload, an NDA agreement yes/no question with a typed signature field, and a GDPR data processing consent yes/no question. Explicitly describe the I-9 upload, bank fields, and NDA signature as admin-only, and ask for three additional admin-only fields: a status dropdown (Submitted, HR review, Verified, Anonymization scheduled, Complete), an assignee field, and an internal notes field.

3. Click Create: Formaloo generates the form in seconds.

4. Verify the fields: Your form should look like this, Magic Create will have generated most of it. Verify each field and field ID matches exactly.

5. Publish the form: Click Publish in the island bar at the top of the editor.

This is where the form starts reacting to what the new hire answers, swapping bank fields for a cheque upload, revealing the NDA signature only after consent, and blocking submission if data processing consent is declined.

1. Open Advanced logic: In the form settings panel on the right side of the form editor, open Advanced logic and go to the Logic tab.

2. Open Magic Logic: Click Magic Logic in the top right corner of the Logic panel.

3. Describe your rules: Paste this prompt: "Hide bank account holder name, bank routing number, and bank account number by default if prefers_voided_check is Yes, and show voided_check_upload instead. Hide nda_signature by default, show it if nda_consent is Yes, and make nda_consent required. Hide gdpr_consent_blocker by default, show it and make gdpr_consent required if gdpr_consent is No. On submit, assign the assignee field to the HR team."

4. Generate and review the rules: Click Generate rules. Review each rule the AI previews, then approve, redo, or cancel it.

5. Add the status trigger: Once approved, add one more rule manually: if status is changed to Verified, send email using your "Your paperwork has been verified" template to the personal_email field.

6. Save your logic: Click Save in the top right corner.

Build the three emails this workflow needs before wiring up when they send.

1. Open custom email templates: Click your profile icon, go to Apps and integrations, and open Custom email templates.

2. Create the confirmation email: Click Add new template, name it "Onboarding documents received," write a subject line like "We've received your onboarding paperwork, @preferred_name," and use an AI block to generate a short, reassuring confirmation that references @job_title and @start_date without listing raw sensitive values.

3. Create the HR notification email: Add a second template named "New hire paperwork ready for review," addressed internally, referencing @full_legal_name, @department, and @start_date, with a CTA linking to the record.

4. Create the verification email: Add a third template named "Your paperwork has been verified," a warm confirmation to @preferred_name that their paperwork is verified ahead of @start_date.

5. Save each template.

Now connect each template to the moment it should fire.

1. Open Notify: From the right sidebar of the form builder, click Notify.

2. Route the confirmation email: Under Send email to respondent, turn on the toggle, select the "Onboarding documents received" template, and confirm personal_email is the field it sends to.

3. Route the HR notification: Under admin notifications, forward the notification to your custom "New hire paperwork ready for review" template instead of the default email, and hit Publish.

4. Confirm the status-change email: The "Your paperwork has been verified" email fires from the logic rule you added in Part 2, not from this panel, so no further setup is needed here.

Generate a compliance summary for every submission that avoids reproducing raw sensitive values.

1. Open custom PDF templates: Click your profile icon, go to Apps and integrations, and open Custom PDF template.

2. Add a new template: Click Add new template, switch the editor to HTML view, and paste your onboarding compliance summary HTML.

3. Name and save it: Name it "New hire onboarding & compliance summary" and click Save.

4. Design it to protect sensitive data: The template should state that the I-9 document and bank details are "on file, admin-only" instead of reproducing the file or the account numbers, since a PDF can't mask values field by field. Keep the NDA signature (a typed name) and the GDPR consent confirmation, since neither is a raw financial or identity document.

This is what actually deletes sensitive answers once your retention window closes, without anyone manually clearing fields.

1. Open form settings: From the island toolbar at the top of the form editor, open the form settings icon.

2. Find privacy and compliance: Scroll down to the Privacy and compliance section.

3. Turn on anonymization: Enable the anonymization toggle and set "Anonymize after (days)" to a retention window that comfortably outlasts your typical onboarding review time, up to 3,350 days.

4. Select the fields to anonymize: Use Select fields to choose i9_document_upload, bank_account_name, bank_routing_number, bank_account_number, voided_check_upload, and nda_signature. This can't be undone once the retention window closes.

Turn the project into a portal so new hires get a place to submit and check status, and HR gets a controlled review space.

1. Activate the portal: From your project, click the Settings (gear) icon and select Activate portal.

2. Run the setup wizard: Click Manage user, open the Setup wizard, and create a new user directory for new hires, since this is the external, submitter-facing role.

3. Enable sign-in: Configure user login and sign-up in the wizard. If your plan supports SSO (available on Enterprise), configure it here so new hires log in with company single sign-on instead of a separate password. Confirm this is available on your plan before relying on it.

4. Connect the profile: Connect the new user directory profile to the onboarding form so each new hire's submission is tied to their portal login.

HR reviewers are internal users, not portal roles, since the Assignee field only works with workspace members or teams. Add them as workspace members and group them into an "HR" team instead of routing them through the setup wizard.

Build the pages both groups need, then lock down who can see each one.

1. Build the new hire pages: Add a form page ("Submit your onboarding documents") and a table page ("My onboarding status") filtered to each new hire's own record.

2. Restrict "My onboarding status" to its owner: Switch to Edit mode on the table's data block, click Options, scroll to Manage access, select the profile field, and toggle on Allow users to view only their data.

3. Build the HR pages: Add a Kanban page ("All onboarding records") grouped by status, a pipeline page ("My assigned reviews") restricted to each reviewer's assigned records, status-filtered tables for Submitted, HR review, and Verified, and a "Records nearing anonymization" table filtered to Anonymization scheduled.

4. Restrict the HR pages to the HR team: On each HR page, click the three-dot menu next to the page name, select Access, and under workspace team members, restrict access to the HR team.

5. Publish the portal: Publish and share the portal link with new hires and your HR team.

Note: Custom domains for your portal are available on the Business plan or via the Brand removal add-on, so your onboarding portal can live at your own URL instead of a formaloo.com address.

New hires submit one form and never have to email HR to check on their paperwork. Sensitive fields, the I-9 upload, bank details, and NDA signature, stay invisible to anyone outside HR, and the compliance summary PDF never reproduces the raw values. Once your retention window closes, those fields anonymize themselves automatically, so nobody has to remember to delete anything. HR works from one Kanban pipeline instead of a shared inbox, and new hires get a self-serve status page instead of a reason to follow up.

Used by an HR team to onboard new hires across multiple departments without exposing bank details or ID documents to anyone outside HR.

Don't build this from scratch, we've already put it together for you.