GDPR for Employers and HR

Below we’ll be outlining the key compliance measures every organisation must follow.

Contents

• Understanding GDPR in the Workplace
• The Privacy Principles
• Lawful Bases for Processing Employee Data
• Recruitment and GDPR Compliance
• Employee Records
• Employee GDPR Rights
• Data Sharing and Third Parties
• Handling Data Breaches
• GDPR Policies
• Best Practice Checklist

Understanding GDPR in the Workplace

GDPR governs the processing of personal data — any information that by itself or in combination with other data could identify an individual. In HR, this includes names, addresses, payroll details, performance records, and biometric data of employees and applicants for employment.

In order to comply with GDPR organisations must:

• abide by the data privacy principles

• comply with people’s data rights

• and have a lawful basis for all data processing activity.

In essence GDPR for employers is the same as GDPR for anyone else.

Additionally, special category data—such as health records, trade union membership, and ethnicity—requires extra protection due to its sensitivity. Employers must have a further lawful basis for processing this data and take steps to secure it appropriately.

The Privacy Principles

There are six main privacy principles. When it comes to GDPR for employers the first and most important is the principle that data processing must be lawful, fair and transparent.

This means alongside having the appropriate lawful bases for processing employee and worker data that processing must be:

Fair

Fairness in data processing is a fundamental aspect of GDPR. It involves ensuring that individuals are treated equitably and that their rights and interests are respected. Fair processing requires organisations to:

• Balance their interests against those of data subjects.

• Avoid discrimination, bias, or unjustified harm.

• Clearly communicate their data processing practices to individuals.

It is important, to comply with this privacy principle, organisations take care not to process personal data in ways that people would not expect.

Remember: fair is not the same as nice. It is fair, for example, to process personal data for disciplinary action or employment termination if this is the right thing to do as an employer.

Transparent

Transparency, which is directly linked to the right to be informed (see below), means current and potential workers must be informed of the data you wish to process, and why. People must be given this information at the time the data are collected or as soon as reasonable possible thereafter.

Other Privacy Principles

When it comes to GDPR for employers and HR the other privacy principles require you to consider:

• Principle 2: Purpose limitation. You can only process personal data for the things you said you would, so it is very important to understand the data you need and the things you need it for.

• Principle 3: Data minimisation. Only collect the minimum necessary data for the purposes you have identified. Having too much personal data is a breach of the GDPR

• Principle 4: Accuracy. The personal data you have must be accurate and up to date. You should consider ways in which you can ensure the information you have about workers is right, and ways of refreshing it or updating it regularly.

• Principle 5: Storage limitation. You should not keep personal data for longer than necessary. For HR this can be a long time. For example, you might need to keep pension related data for decades for some workers.

• Principle 6: Integrity and confidentiality. Like all other personal data employee and worker data must be kept safe and secure, protected from unauthorised access and alteration.

Accountability

Accountability is a key part of the GDPR. At its core it means employers and HR professionals are accountable for GDPR compliance and abiding by the privacy principles.

The Legal Bases for Processing Employee Data

Under GDPR, every data processing activity must have a legal basis. In HR, common justifications include:

• Contractual necessity – Processing payroll, managing employment contracts. This includes where you are considering entering into a contract, such as processing applicant and application data and conducting interviews, seeking references etc.

• Legal obligations This includes reporting tax and social security details to authorities. IT also relates to things like checking people’s right to work in the UK, which is a statutory requirement.

• Legitimate interests. This lawful basis requires a clear legitimate interest that does not impact significantly on people’s privacy. This is a useful basis if you cannot rely on a contractual basis, and consent may not be appropriate.

• Consent. As a lawful basis consent is not always the best option as it must be freely given and can be withdrawn at any time. Therefore it should only be used for things where people can freely refuse or withdraw consent without it affecting their role or career prospects.

Understanding these bases is key to compliance and reducing legal risks. You will rely on a range of lawful bases for your data processing and it is important to understand which one is best for any particular activity.

GDPR for Employers: Special Category Data

Special category, or sensitive personal data, are a class of information that has extra protection under the GDPR. Special category data is data about:

• a personal religion, ethnicity or ethnic background

• religion, or cultural and political views

• physical, mental or sexual health

• gender or sexuality

• genetic or biometric data

• trade union membership

It is obviously necessary to process some of these types of data for work related purposes (for example, sending someone for an occupational health assessment). However, to do so you need a second, specific lawful basis.

What the specific lawful basis is depends on the activity and we’re not going to go through all of the options in this brief guide but some of the lawful bases for processing special category data include:

• For employment purposes: you may need to process health data to decide if someone is capable of doing a job, or to make reasonable adjustments to accommodate a disability.

• To promote equality and diversity: in order to help ensure your organisation’s workforce reflects the community it serves you can collect data on ethnicity, gender etc. and use it to analyse your current position and amend recruitment planning to address any gaps or issues.

If you process special category data for employment purposes then it is likely that you will need a specific policy covering this data processing.

Recruitment and GDPR Compliance

While easily overlooked GDPR for HR covers the pre-employment or recruitment process. Recruitment involves handling vast amounts of personal data. Employers must:

• Only collect what is necessary (e.g., CVs, references, and right-to-work documents)

• Inform candidates about how their data will be processed and retained at the time they apply for the role, perhaps by including a privacy statement in your application pack/

• Delete or anonymise unsuccessful applications after a set period unless legally required to retain them, or if you consider there could be a complaint relating to the recruitment process (it does happen!).

Unsolicited CVs and speculative applications must also be handled with care as the GDPR will apply and this should be covered in your main or public facing privacy statement.

Controller or Processor?

When it comes to recruitment it is important to understand whether you as an employer or the engager of a worker are the controller or the processor for GDPR purposes.

In essence controllers decide what personal data is needed and why, and processors are sometimes engaged to process that data for those purposes on controllers’ behalf. When recruitment involves a range of people – you might, for example, ask a recruitment agency to find and do a first-sift of potential employees for you, or hire a temporary worker via another agency – you must know who is the controller; who is the processor; or whether you are all controllers.

It’s important because under the GDPR controller’s are also accountable for their data processors’ compliance.

Employee Records and Data Retention

HR departments store records on everything from performance appraisals to medical leave. However, GDPR has strict data retention rules.

• Payroll records are typically kept for at least six years for tax purposes

• Disciplinary records should only be held as long as necessary

• Health and safety records may require long-term retention for legal claims

• Other data may be needed for longer e.g. pension related records

Employers must maintain a clear data retention policy to ensure they are neither deleting data prematurely nor holding it for too long.

Employee and Worker Rights Under GDPR

Like anyone else the GDPR grants employees and workers rights over their data, including:

• Right of access – Employees can request copies of their personal data

• Rectification – Employers can be asked to correct or complete inaccurate records

• Right to erasure – Employees can request the deletion of their data in certain circumstances

Handling subject access requests (SARs) within the one-month deadline is crucial for compliance. Delays or refusals can trigger complaints to regulators. Subject access requests made under the right of access can be a greater burden for employers than other relationships (e.g. patients or customers).

This is because:

• employers typically have a lot of data over a lengthy period for employees

• a lots of intra-organisation communication (e.g. emails) will contain personal data (email addresses) alongside documents, files, meta data on systems etc. This will all need to be reviewed for disclosure and if necessary redaction

• there are a wider range of information needs around employees – right to work status, for example, or records around training, appraisal and payroll.

• some things may be exempt from disclosure, for example employment references, and these special rules will need to be take account of.

Fortunately a lot of organisations have a form of electronic staff record where people can access information about themselves. With this type of access what employers must disclose under a subject access request can be substantially reduced.

Data Sharing and Third Parties

HR teams regularly share employee data with third-party payroll providers, insurers, pension providers, and government agencies. Employers must, as noted above, determine the controller-processor relationship for these transfers and:

• Ensure contracts include GDPR-compliant data processing clauses

• Assess the security measures of third-party vendors

• Notify employees when their data is shared externally

Failing to conduct due diligence on data-sharing practices can lead to regulatory scrutiny.

For businesses operating across multiple countries, cross-border data transfers require additional compliance steps. Since Brexit, UK employers must also consider:

• UK GDPR rules alongside EU GDPR if they handle EU citizen data

• Standard contractual clauses (SCCs) for data transfers outside the UK/EU

• Binding corporate rules when data is shared across borders within the same group of companies.

Understanding these nuances is key to avoiding regulatory penalties.

Handling Data Breaches in HR

A personal data breach—such as a lost laptop, a misdirected email, or an unauthorised database access—can have severe consequences. HR teams should:

• Identify breaches quickly and assess their impact

• Report serious breaches to the Information Commissioner’s Office (ICO) within 72 hours of becoming aware of them

• Notify affected employees if they are at material risk because of the data breach.

Proactive risk management and training are essential to reducing breach incidents.

GDPR Policies for Employers

A key element of compliance with GDPR for employers is policy. Employers must develop clear GDPR policies that outline:

• How employee data is collected and used

• How long data is retained

• What security measures are in place

• How employees can exercise their GDPR rights

• How to handle data breaches

• The processing of special category data

Alongside this regular staff training ensures HR teams and managers understand their obligations.

Best Practice Checklist for GDPR Compliance in HR

To maintain compliance, employers should:

• Understand their use of employee and worker data, the lawful basis for this, and how that data will be managed

• Ensure this is recorded on their Record of Processing Activity

• Have a full and complete privacy statement, including for applications

• Put in place clear policies and procedures

• Conduct regular GDPR audits of HR data processing

• Ensure staff training on data protection responsibilities

• Implement secure storage solutions for employee records

• Have a clear response plan for SARs and data breaches

Embedding privacy by design into HR processes will protect employees’ rights while minimising legal risks for employers.

GDPR compliance is not just about avoiding fines—it’s about building trust, transparency, and accountability in the workplace. Employers who prioritise data protection not only safeguard their organisation but also foster a culture of respect for employee privacy.