Data protection laws exist to protect individuals' fundamental rights from the misuse of information about them. As technology develops so quickly, including the use of AI, data protection law is in danger of lagging behind technological change. Regularly updated laws are needed to give individuals control over their personal data as the digital age evolves.

Employers should develop policies that take a compliant, but balanced, approach. They should also ensure that employees understand their own rights and obligations under data protection law.

Information is easily transferred nationally and internationally, making data protection a complex global issue. Any worldwide organisation can hold data on citizens from the UK, Europe and other countries.

Data protection law is a highly technical area, so employers should seek appropriate legal advice if unsure of any aspect. Organisations that ignore their legal obligations risk reputational damage, potential prosecution in the courts and heavy penalties.

Data protection law is a highly technical area, so employers should seek appropriate legal advice if unsure of any aspect. Organisations that ignore their legal obligations risk reputational damage, potential prosecution in the courts and heavy penalties.

The main UK legislation governing data protection is the Data Protection Act 2018 (DPA). However, this legislation is being amended in 2024 following Brexit - see below.   

The Information Commissioner’s Office (ICO)

The ICO promotes and enforces data protection legislation and is independent from government. It provides guidance to aid DPA compliance and takes action where needed. From 2024, the ICO will undergo some structural changes and be given additional duties and powers to promote innovation and competition and will be able to compel certain documents, reports and interviews, and will have increased ability to reject complaints. There's more detail on the ICO website.

The General Data Protection Regulation (GDPR)

The GDPR gives people the right to access information held about themselves. In addition, there are obligations regarding data management and a regime of fines.

New data protection legislation in 2024 introduces changes in the UK whilst attempting to be sufficiently GDPR compliant, bearing in mind that the UK’s adequacy status will be reviewed in 2025. In summary, organisations which only do UK business can decide whether to only comply with the DPA as amended, or to continue complying with current GDPR requirements in case their business wishes to offer goods or services to EU-based customers, which requires an EU compliant data protection strategy. Organisations that already conduct business within the EU will likely hold data on EU citizens and must continue to comply with both the DPA and GDPR frameworks. 

USA regulations

Organisations conducting business with the USA can transfer personal data to US businesses certified under the UK-US Data Bridge without the need to implement further transfer safeguards, following the Data Protection (Adequacy) (United States of America) Regulations 2023, which came into effect from 12 October 2023.

The Data Protection Act 2018 (DPA)

The DPA and GDPR contain rights about processing of personal data held in either a computerised format as part of a database or as manual records in a filing system. From 2024, new legislation will amend the DPA in a number of respects, for example the UK data protection regime will reduce the requirements for record keeping and data protection impact assessments which, going forwards, will be restricted to businesses that carry out high risk processing. The definitions of personal data and legitimate interests will also change. Data protection officer and subject access request requirements will also be redefined. 

DPA: Key principles

In essence, those who decide how and why personal data is processed (data controllers) must comply with certain principles. Those individuals whose data is held or processed (data subjects) have rights, for example in relation to accessing that data. In an employment context, employers will generally be data controllers and employees, workers, ex-employees and applicants will be data subjects. Most HR and employment files and records are covered by the DPA.

Personal and sensitive data

Personal data relates to someone who can be identified, directly or indirectly, by an ‘identifier’ such as their name or an identification number. It includes online data, such as HR records about sickness absence, performance appraisals and recruitment notes. Under the imminent changes to the data protection regime, data protected by appropriate technical or organisational measures preventing risks of unauthorised third-party access may not be classed as personal data.

When handling personal data, organisations must tell employees why the organisation is collecting the information, what will happen to it and who will see it.

Sensitive personal data includes information about an individual’s race, ethnicity, politics, religion or beliefs, trade union status, health, or sexual orientation. It's legitimate to process ‘sensitive personal data’ where necessary to carry out an obligation under an employment contract or collective agreement.

Criminal records are also sensitive data. Employers can carry out criminal record checks for roles that involve working with children or vulnerable adults but not on a routine basis.

Health information is special category personal data and warrants additional protection. It should only be held with explicit consent from the individual. Processing medical records may be permissible in certain circumstances, for example assessing working capacity or confirming diagnoses. In 2023, the ICO published specific guidance on workers' health, to assist employers in understanding their data protection obligations when processing workers' health data. Under the guidance, worker status is broadly defined to include employees and workers such as those working in the gig economy. The guidance covers legal requirements and good practice regarding UK data protection laws and processing of workers’ health information and handling records of absence and sickness. There are also checklists as quick reference guides for data protection and health records.  

Processing data

Processing data includes obtaining, holding, retrieving, consulting and using data by carrying out any operation on it. There are seven general key principles which apply, for example that data must be processed fairly and collected for specified and legitimate purposes.

Data protection impact assessments should be undertaken help identify and minimise data protection risks. Currently, impact assessments are needed for processing that is likely to result in a high risk to individuals. From 2024, the language changes to require assessments only for high-risk processing. From 2024, legitimate interests for processing will include:

• Communicating advertising or marketing material to particular individuals.
• Intragroup transmissions of personal data for internal administration.
• Processing for security of network and information systems.

From 2024 a new concept of recognised legitimate interests means that certain processing will be deemed legitimate, for example, if there is an important public interest (e.g. safeguarding vulnerable individuals). This means no balancing test against individuals' rights will be necessary.

Data subjects have individual rights including the right to be informed about the processing of personal data and to be forgotten by having data deleted where there’s no compelling reason for it to be processed.

The full list of these rights is on the ICO website.

Enforcement

Substantial penalties may be imposed if an employer doesn’t follow the data protection principles and fails to remedy issues in an enforcement notice or to co-operate with an inspection. 

CIPD members should see the more detailed information on enforcement of the DPA and the GDPR in our Data protection law Q&As.

All employers should follow the ICO guide on the DPA and the GDPR as it applies in the UK. 

Consent

Organisations must demonstrate that employees were:

• informed of the purpose and use of their personal data, and
• given a clear explanation of how it will be treated.

Employees must consent freely to specific use, purpose, or processing of data. Employees’ silence or lack of complaint about the processing, or consent incorporated as a standard employment contract term or in data protection policies does not meet the standard required.

Employers must record the grounds on which they will be processing each separate category of employee data.

Lawful processing

Organisations may process personal information lawfully for six reasons including complying with an employment contract or legal obligation.

Job references

Unless a relevant exemption applies, data subjects can request and be given a copy of their reference. 

CIPD members should see the more detailed information in our References law Q&As.

Email and internet

Providing staff with digital devices such as smartphones has data protection implications, as does employees’ use of their own devices. Organisations need a comprehensive internet, social media and communications policy governing permitted data use including email and internet issues.

Monitoring should not be intrusive, for example using traffic data (about the routing, duration or timing of messages) rather than accessing email content. Both the DPA and Telecommunications Regulations (see below) must be complied with.

Accountability

Employers must demonstrate data protection compliance by training, auditing and documenting processing activities, and reviewing HR policies. They should also:

• Only collect personal data that is adequate, relevant and necessary.
• Remove names from data (anonymisation) or use data encryption to anonymise it (pseudonymisation conceals identities but allows them to be recovered).
• Be open with employees about data processing and allowing them to monitor it.
• Identify and limit any detrimental effects on individual privacy.

Senior responsible individuals and/or data protection officers (DPOs)

Prior to 2024, organisations must appoint a DPO if they:

• Are a public authority.
• Carry out large scale systematic monitoring of individuals.
• Carry out large scale processing of special categories of data or data relating to criminal convictions and offences.

From 2024 in the UK, the requirement for DPOs is replaced with a senior responsible individual who is part of senior management. This individual must only be appointed for high-risk processing, and the ICO will publish examples of this. This senior individual can involve a job-share, and they can delegate other persons to perform the relevant tasks.

Subject access requests (SARs)

SARs are written requests from individuals for information covered by the DPA. Organisations must respond for free and without ‘undue delay’, which means within a month. However, this can be extended by up to two months if the SAR is complex. From 2024, time limit extensions may be possible where substantial relevant data is held, and organisations will be able to refuse an SAR or charge a fee if the requests are vexatious or excessive when taking the organisation’s resources into consideration.

Employers should identify who is responsible for responding to SARs and provide sufficient training. The ICO has a useful checklist of how to deal with SARs.

Sharing and transferring personal data

Third parties, such as payroll providers, external HR and recruitment agencies process employee data. The employer must ensure the third party is data protection compliant.

Data security

Data security must be appropriate to the processing risks. The organisation’s size, the nature of information processed, and the potential harm from security breaches are all relevant.

In addition to clear policies covering security incidents, organisations should:

• Carry out risk assessments of data systems and act on the results.
• Maintain up-to-date security systems (for example, using firewalls and encryption technology).
• Restrict access to personal data to those who need it.
• Train staff on data security.
• Review data security regularly.

Record keeping and correction

Currently, organisations with over 250 employees must keep clear, accessible records of all their data processing activities. Smaller organisations only need to record any regular data processing, or any processing of personal data which is sensitive, or intrudes on an individual's personal life. From 2024, this obligation will be restricted to businesses that carry out high risk processing which will be defined by the ICO.

Data should only be kept for as long as needed to fulfil the purpose.

Find out more on UK statutory and recommended time periods for keeping HR records.

Organisations should:

• Monitor data compliance on an ongoing basis including the 2024 changes.
• Appoint a data protection officer or senior responsible individual if required to cover all aspects of information including DPA and Freedom of Information Act compliance.
• Audit information systems to find out who holds what data, and why.
• Consider how data is used, and issue guidelines for managers about how to manage data.
• Ensure that all information collected complies with the DPA (and GDPR if required).
• Check the security of information stored.
• Check the transfer of data internationally.
• Check the organisation’s use of automated decision making.
• Review policies and practice, for example for references and the private use of telephones, email and post.

The Data Protection (Fundamental Rights and Freedoms) (Amendment) Regulations 2023 

These Data Protection Amendment Regulations are part of the extensive post Brexit legislation which amend the UK data protection regime to swap references to fundamental rights and freedoms to the European Convention on Human Rights as incorporated into UK law by the Human Rights Act 1998 (instead of references to retained EU law).

Data Protection and Digital Information Bill No.2 (265 2022-23)

This bill, when fully enacted, changes the UK data protection regime on matters such as record keeping, data protection impact assessments, definitions of personal data and legitimate interests, data protection officers and subject access requests.

The Freedom of Information Act 2000

This law affects public sector employers providing public access to information held by public authorities. It requires them to publish certain information about their activities.

The Telecommunications (Lawful Business Practice) Regulations 2000

These rules cover all telecommunications (telephone, email, fax, etc). Employers may intercept these with the parties’ consent. If employers can’t demonstrate consent, they’ll need to show they took reasonable steps to inform every user that there may be interception.

Employers can also intercept telecommunications without consent in certain situations, for example to find out if a communication is for business or private purpose or to prevent or detect crime.

The Investigatory Powers Act 2016

This law is primarily directed at the communications industry, not the employer/employee relationship. However, it affects many types of business, for example online market places or website providers providing a telecommunications service. It imposes powers to enable the police, government and other authorities to gather and retain data about people.

Privacy and Electronic Communications Regulations 2003 (amended 2004-2018)

These rules regulate direct marketing activities by telephone, email or other electronic methods. They ban companies from sending unsolicited electronic communications to consumers for direct marketing, unless that individual has given their consent or if the sender can demonstrate an existing commercial relationship with the recipient. 

Contacts

Information Commissioner’s Office Tel: 01625 545745 (information line)

Information Commissioner’s Office – for organisations

Employment practices and data protection: information about workers’ health

GOV.UK - data protection

GOV.UK - personal data an employer can keep about an employee

Books and reports

Barnett, D. (2020) GDPR for HR professionals. (Employment Law Library 2). London: Nielsen.

Bygrave, L.A. (2014) Data privacy law: an international perspective. Oxford: Oxford University Press.

Carey, P. (2018) Data protection: a practical guide to UK and EU law. 5th rev ed. Oxford: OUP.

TUC (2018) I’ll be watching you: a report on workplace monitoring. London: TUC.

Voight, P. and von dem Bussche, A. (2017) The EU General Data Protection Regulation (GDPR): a practical guide. Springer.

Journal articles

Beaumont, A. (2020) Staying GDPR compliant during Covid-19. People Management (online). 25 August.

Fry, E. (2019) Are you getting GDPR compliance right? People Management (online). 9 August.

Hannah, D.R. and Robertson, K. (2015) Why and how do employees break and bend confidential information protection rules? Journal of Management Studies. Vol 52, No 3, May. pp381-413.

Trapnell, L. (2021) What businesses need to know about the GDPR post Brexit. People Management (online). 2 March.

CIPD members can use our online journals to find articles from over 300 journal titles relevant to HR.

Members and People Management subscribers can see articles on the People Management website.