Data Protection Employment Policy UK: Employer Guide

What this document is

A Data Protection Employment Policy is an internal rulebook that explains how your organisation collects, stores, uses and eventually disposes of personal data about its workforce. It sits alongside your privacy notice (which is outward-facing and tells staff what happens to their information) and your wider data protection and information security policies.

The employment policy focuses specifically on the HR context: job applications, employment contracts, payroll, pensions, monitoring, training records, occupational health, references and post-employment retention. In law, your organisation is almost always the data controller for employee information, which means you carry the legal responsibility for how it is handled.

A well-drafted policy sets out the lawful bases you rely on, the categories of data you hold, the rights your staff have, the security measures you apply, and what managers and employees must do day to day. It also gives you something credible to point to if the ICO, a tribunal or an individual ever asks how you approach personal data in the employment relationship.

How to use this document

1. Set the scope and define your terms. Start by making clear who the policy covers (employees, workers, contractors, job applicants, former staff) and what kinds of personal data fall within it. Define terms like controller, processor, personal data, special category data and processing so that everyone reading the policy, including line managers with no legal background, works from the same shared understanding.
2. Map the data protection principles to your HR practice. Translate the UK GDPR principles (lawfulness, fairness, transparency, purpose limitation, data minimisation, accuracy, storage limitation, integrity and confidentiality, and accountability) into plain language commitments your organisation will follow. Give practical examples so managers can see how each principle applies to things like reference checks, appraisals or exit interviews.
3. Identify your lawful bases for each activity. Go through your main HR processing activities and record the lawful basis you rely on, whether that is performance of the employment contract, compliance with a legal obligation, legitimate interests, or consent. For special category data such as health or trade union membership, you also need to identify a separate condition under Article 9. Document this reasoning.
4. Explain staff rights and how to exercise them. Set out the rights individuals have over their data, including access, rectification, erasure (where it applies), restriction, objection and portability. Give a named contact or inbox for requests, explain internal timescales, and describe how the organisation will verify identity and respond. This section helps reduce confusion when a subject access request lands.
5. Cover security, retention, breaches and training. Describe the technical and organisational measures you use to protect staff data, how long different categories are kept, and when records are deleted or archived. Set out how employees must report a suspected data breach, how the organisation assesses whether to notify the ICO, and how staff are trained on their responsibilities at induction and refresher points.

Common questions