UK employers processing employees' personal data must comply with UK GDPR and the Data Protection Act 2018. Unlike some other jurisdictions, UK law does not have a separate "employment data" framework — UK GDPR applies in full to employment data, with some specific exemptions. This guide covers the key obligations for UK employers.
What Employee Data You Process
Most UK employers process a broad range of employee personal data across multiple systems and processes:
Core HR data: Name, address, date of birth, national insurance number, contact details, emergency contacts
Payroll and benefits: Salary, bank account details, tax code, pension contributions, benefits enrolment, P11D data
Employment records: Job title, department, start date, contract terms, performance reviews, training records, disciplinary records
Absence and health data: Sickness absence records, fit notes, occupational health reports — this is special category data
Monitoring data: IT system access logs, email usage data, building access records, any productivity monitoring tools
Biometric data: Face recognition for building access, fingerprint timekeeping — this is special category data requiring explicit consent
Lawful Bases for UK Employee Data Processing
UK GDPR requires a lawful basis for all processing. For employment data:
| Processing activity | Lawful basis |
|---|---|
| Payroll and salary administration | Contract performance (6(1)(b)) + legal obligation |
| HMRC / tax reporting | Legal obligation (6(1)(c)) |
| HR management (performance, absence) | Contract performance + legitimate interests |
| Disciplinary proceedings | Legitimate interests / legal claims |
| Employee monitoring | Legitimate interests (with balancing test) |
| Background checks | Legitimate interests / legal obligation (sector-dependent) |
| Health data (sickness absence) | Employment law / social security (Article 9(2)(b)) + legal obligation |
| Biometric data | Explicit consent (Article 9(2)(a)) |
Do not rely on consent as a general basis for employment data. The ICO's position is clear: employment consent is not freely given due to the power imbalance. Use contract performance or legitimate interests for standard HR processing.
The Employee Privacy Notice
Employees are data subjects with UK GDPR rights. This means:
Privacy information must be provided under Article 13 — typically at or before the start of employment, as part of the onboarding process. The employee privacy notice must cover all the standard Article 13 elements, with employment-specific content.
Key content for employee privacy notices:
- What HR systems hold employee data (HRIS, payroll, performance management)
- Third parties with access (payroll bureau, pension provider, occupational health, HMRC, benefits providers)
- Any monitoring conducted — email monitoring, building access, IT activity logging
- Retention periods for employment records
- Employee rights and how to exercise them
Employee Data Subject Rights
UK employees have the same UK GDPR rights as other data subjects:
Right of access (DSAR): Employees can request all personal data held about them. This includes HR records, payroll, performance notes, disciplinary files, emails where they are named, and monitoring data. Respond within one calendar month.
Right to erasure: Limited in employment contexts — legal obligations to retain financial and employment records typically override erasure requests for core records.
Right to rectification: Employees can request correction of inaccurate data — for example, correcting an incorrect performance note or fixing an error in personal details.
Right to object: Employees can object to processing based on legitimate interests, including monitoring.
Employment tribunal context: Employees in dispute with their employer routinely use DSARs as a litigation strategy. Ensure your DSAR process can handle sensitive employment disputes professionally and completely.
Employee Monitoring: UK-Specific Requirements
UK law requires transparency about monitoring. Before implementing any monitoring:
- Assess necessity: Is the monitoring necessary for a legitimate business purpose?
- Conduct a DPIA: For systematic or large-scale monitoring, a DPIA is required
- Update the employee privacy notice: Inform employees before monitoring begins
- Works councils / employee representatives: Unlike some EU countries, the UK does not have statutory co-determination rights on monitoring. But consulting employees on new monitoring practices is good practice
ICO's approach to covert monitoring: The ICO's Employment Practices Code (updated for UK GDPR) states that covert monitoring should only be used as a last resort, in limited circumstances, with a specific justification for each instance.
Data Retention for UK Employment Records
UK employment data retention is driven by limitation periods under employment law:
| Data type | Recommended retention |
|---|---|
| Employment records | 6 years post-employment (unfair dismissal claims: 3 years, but safest to retain 6) |
| Payroll and tax records | 6 years (HMRC requirement) |
| Sickness and absence | 6 years post-employment |
| Disciplinary records | Policy-specific — typically 1–5 years depending on severity |
| Unsuccessful job applicants | 6–12 months (discrimination claim period) |
| Biometric data | Delete promptly at end of employment |
Build automated deletion into your HR systems where possible. Manual deletion relying on HR team action is unreliable.