UK GDPR for HR and employers
Every employer processes employee personal data subject to UK GDPR — from recruitment through to post-employment records. Payroll, sickness, performance management, right-to-work checks, and disciplinary records all require a documented lawful basis, appropriate transparency, and careful handling of data subject rights requests from current and former staff.
Processing employee data
The most common lawful basis for processing employee data is contract (Article 6(1)(b)) — processing necessary to perform the employment contract — and legal obligation (Article 6(1)(c)) — processing required by employment law or HMRC rules. Consent is rarely appropriate in the employment context because the power imbalance between employer and employee means consent is unlikely to be freely given. Legitimate interests may apply to some processing, but must be assessed carefully.
Health and sickness data
Health data is special category data under Article 9. Processing sickness records, occupational health reports, and medical certificates requires both an Article 6 lawful basis and a separate Article 9 condition. The most relevant for employers are employment and social protection obligations (Article 9(2)(b)) and preventive occupational medicine (Article 9(2)(h)). Both must be documented separately in the ROPA.
Employee privacy notice
Every employer must provide employees with a privacy notice covering all processing activities, including payroll, performance management, CCTV, health data, and third-party disclosures. This must be provided before or at the start of employment. A customer-facing privacy notice does not satisfy this obligation. The notice must be updated when processing activities change materially.
Workplace monitoring
Monitoring employee communications — email, internet usage, call recording — involves processing personal data with a lawful basis, typically legitimate interests. Employees must be informed that monitoring is taking place; covert monitoring is permitted only in exceptional circumstances involving criminal investigation. The monitoring policy must be documented and proportionate.
SARs from employees
Employees have the same right of access as any data subject. Employee SARs frequently include performance reviews, disciplinary records, grievance files, and management emails. The one-month response deadline applies. Legal professional privilege may cover privileged legal advice obtained during a disciplinary process. A dated log of every employee SAR, the response, and any exemptions applied is essential.