GDPR for HR: Lawful Bases for Employee Data Processing

GDPR Basics for HR: why is it important to understand the lawful bases for employee data processing?

Employee data is core to HR functions. This is true before, during, and after employment. For example, during recruitment, for payroll, absence management, performance reviews, learning and development, safeguarding, workplace investigations, references and pensions —each relies on personal information. Often, that information includes highly sensitive details such as health data, union membership, or disciplinary records.

This makes HR one of the most privacy-critical parts of any organisation. It also means HR teams need a clear understanding of the lawful bases for processing employee data under the UK GDPR.

This article explains the essentials, with practical examples HR professionals can use immediately.

Why lawful basis matters in HR

Under the UK GDPR, organisations must have a valid lawful basis to process personal data. This is not optional. It forms the legal justification for collecting, using, storing, and sharing information about employees.

Choosing the wrong lawful basis creates avoidable risk:

• employees may challenge processing and submit complaints,
• organisations may struggle to defend decisions during disputes,
• privacy notices may become inaccurate,
• data retention and sharing practices can become legally fragile.

Most importantly, lawful basis decisions influence which data subject rights apply and how HR should respond to them.

The six lawful bases under Article 6 (and why HR uses them differently)

Article 6 of the UK GDPR provides six lawful bases. HR teams typically rely on four of them most often:

1. Contract
2. Legal obligation
3. Public task (in public bodies)
4. Legitimate interests

Consent exists too, but HR should treat it with caution. Vital interests appears occasionally, but rarely.

Let’s break them down.

1. Contract: processing necessary for the employment relationship

Article 6(1)(b) allows processing where it is necessary for the performance of a contract with the employee. This includes when considering entering into a contract i.e. when considering hiring someone.

In HR, the contractual basis is often appropriate when processing directly supports the core employment relationship.

HR examples where “contract” works well

• issuing and managing employment contracts
• paying salary and contractual benefits
• managing working hours and leave entitlements
• administering pensions and employee benefits
• onboarding and providing access to tools required for the job

Common mistake: overrelying on “contract”

Contract does not cover everything HR does.

For example, you cannot automatically justify:

• broad monitoring of staff emails,
• extensive data sharing with third parties,
• collecting extra personal details “just in case”,
• equality and diversity monitoring,
• occupational health

by claiming it supports the contract. This lawful basis depends on necessity, not convenience.

2. Legal obligation: doing what the law requires

Article 6(1)(c) applies when processing is necessary to comply with a legal obligation.

This basis fits naturally in HR because employment law creates many mandatory duties.

HR examples where “legal obligation” applies

• PAYE, National Insurance, statutory payroll reporting
• statutory sick pay and maternity/paternity processes
• right to work checks (where required by law)
• compliance with health and safety obligations in some circumstances
• responding to court orders or regulatory requests

Why HR teams like this basis

It’s clear and defensible. Employees cannot object simply because they dislike the processing. If the law requires it, HR must do it—provided the processing remains proportionate and secure.

3. Legitimate interests: a flexible option (mainly for private sector HR)

Article 6(1)(f) allows processing where it is necessary for legitimate interests, provided those interests do not override the rights and freedoms of the employee.

Legitimate interests often covers routine HR operations that aren’t strictly contractual or legally required but still serve a valid organisational purpose.

Examples where “legitimate interests” may apply

• internal directories and organisational charts
• basic workforce analytics
• managing access controls and security logs
• investigating minor policy breaches
• managing internal communications

Exercising Caution: imbalance of power

In employment relationships, the organisation usually holds more power than the employee. That means HR must apply legitimate interests carefully and document its reasoning.

A legitimate interests assessment (LIA) should consider:

• what the organisation wants to achieve,
• why the processing is necessary,
• the impact on employees,
• safeguards (minimisation, access controls, retention limits).

If the processing feels intrusive, legitimate interests becomes harder to defend.

4. Public task: for public authorities and public functions

Article 6(1)(e) applies where processing is necessary to perform a task in the public interest or in the exercise of official authority.

This basis commonly applies to:

• NHS bodies,
• local authorities,
• schools and universities,
• regulators and other public bodies.

HR examples in public bodies

• workforce management to deliver statutory services
• compliance activity tied to public functions
• maintaining professional standards in regulated roles
• managing safe staffing and duty-of-care requirements

Public task often overlaps with legal obligation. The difference lies in whether a specific legal duty exists (legal obligation) or whether the processing supports broader public functions (public task).

Consent in HR: a possible choice in limited circumstances

Consent under Article 6(1)(a) requires it to be:

• freely given,
• specific,
• informed,
• unambiguous,
• easy to withdraw.

In employment, consent rarely meets the “freely given” standard because employees may feel pressure to agree.

When consent might work in HR

Consent may be appropriate for genuinely optional activities, such as:

• using staff photos for marketing materials,
• publishing employee testimonials,
• optional wellbeing initiatives not tied to employment decisions.

Even then, HR must ensure:

• no disadvantage for refusing,
• consent can be withdrawn easily,
• withdrawal does not trigger retaliation or negative consequences.

Vital interests: rare but important

Article 6(1)(d) covers processing necessary to protect someone’s life, or the life of another person.

HR might rely on this basis in genuine emergencies, for example:

• disclosing medical information to paramedics,
• contacting next of kin,
• acting during a life-threatening incident at work.

It should remain exceptional. It’s not a routine HR basis.

Don’t forget Article 9: special category employee data

HR frequently processes special category data, such as:

• health and sickness records,
• occupational health reports,
• disability adjustments,
• biometric access systems,
• union membership (in some contexts),
• ethnicity data (e.g., equality monitoring).

To process special category data lawfully, HR needs:

1. a lawful basis under Article 6, and
2. an Article 9 condition (such as employment law obligations, health and safety, occupational medicine, or explicit consent in limited cases).

This is where HR compliance often breaks down—organisations identify Article 6 but forget Article 9 entirely. Fortunately there are two some bases under Article 9 that are particularly relevant to HR.

One lawful basis is consent, but as noted above this is not always a viable option and also consent can be withdrawn. Other relevant options include:

Processing is necessary for the purposes of preventive or occupational medicine, for the assessment of the working capacity of the employee.

This lawful basis may be used for occupational health or other health related management or HR activity. This is different from, for example, making reasonable adjustments or requests for flexible working which have a statutory basis but is helpful in relying on a contract

Processing is necessary for reasons of substantial public interest

Schedule 1 of the Data Protection Act 2018 sets out what these conditions are. The ones HR may be most interests in are:

• Equality of opportunity or treatment – which allows, for example, promoting equality and diversity monitoring in the workplace “with a view to enabling such equality to be promoted or maintained” The condition only relates to race, religion, health and sexual orientation and cannot relate to decisions about specific individuals
• Racial and ethnic diversity at senior levels – unlike the above it can relate to individuals, for example taking into account ethnicity between two otherwise appointable candidates to promote equality and diversity among senior managers. However, you must be able to demonstrate it would not be reasonable to get consent for the processing of this data under this circumstance, and that processing it would not cause significant distress. In this context “senior manager” means director, partner or equivalent.
• Occupational pensions: special category data can be processed for the purpose of “making a determination in connection with eligibility for, or benefits payable under, an occupational pension scheme”. Again, you should be able to demonstrate you cannot reasonably get consent.

What HR teams should do to stay compliant

1) Map employee data processing

Document what data you process, why, and where it flows:

• recruitment systems,
• HRIS,
• payroll providers,
• benefits platforms,
• line manager records.

A Record of Processing Activity (ROPA) helps here.

2) Assign the correct lawful basis for each HR activity

Don’t choose one basis for everything. HR processing is diverse. Your lawful basis should match the purpose.

3) Update your employee privacy notice

Employees must know:

• what you collect,
• why you collect it,
• who you share it with,
• how long you keep it,
• and what rights they have.

4) Build safeguards into high-risk areas

HR often handles sensitive and contentious data. Prioritise:

• strict access controls,
• clear retention rules,
• secure sharing procedures,
• confidentiality expectations,
• audit trails for decisions.

5) Train HR staff and managers

The best policies fail when people don’t understand them. HR and line managers need practical training on:

• lawful bases,
• handling SARs,
• data minimisation,
• breach reporting,
• appropriate disclosure.

Final thought: HR compliance depends on precision

Getting lawful bases right helps HR:

• reduce disputes,
• strengthen trust,
• improve governance,
• and protect the organisation when decisions get challenged.

It’s not about being perfect. It’s about being defensible, consistent, and transparent.