UK GDPR in the workplace: Everything you need to know

The UK GDPR — or UK General Data Protection Regulation — is the gold standard of data privacy and security laws. It applies to any business that handles the data of any UK resident, not only those operating in the UK. 

The GDPR contains an array of legal terms, but here are five of the most important ones:

1. Personal data: Any information that relates to an individual that can directly or indirectly identify them. 

2. Data processing: Any action performed on data, including collecting, recording, organising, storing, and erasing it.

3. Data subject: The person whose data is processed, for example an employee.

4. Data controller: The person or entity responsible for how and why data will be processed.

5. Data processor: A third party that processes data on your behalf, like Google or Microsoft — or an HR tool like Personio.

Article 5 of the UK GDPR sets out the principles for processing personal data. When it comes to your employees, their personal data must be:

• Processed lawfully, fairly and transparently. You need to request your employees’ permission to process their data and tell them what you’ll do with it.

• Collected for specific, explicit and legitimate purposes. You can’t process information for any reasons you haven’t specified.

• Adequate, relevant and limited to what is necessary. Don’t collect and process more data than you need to. For example, you probably don’t need to know your employees’ children’s names.

• Accurate and kept up to date. If any data subject’s information is incorrect, it must be fixed as soon as possible. 

• Kept only for as long as is necessary. It can only be kept for longer than this if it’s in the public interest, or for scientific, historical research or statistical purposes.

• Processed in a way that ensures the data is protected against unauthorised and unlawful processing. You should also not accidentally lose employee data, or destroy or damage it.

The details about what information you collect, why and how you process it, and how your employees can access or modify it should be laid out in a data protection policy (also known as a document retention policy or a records management policy).

Processing employee data — and, usually, a huge amount of it — is part and parcel of running a business. HR teams in particular handle the sensitive personal data of employees every day, whether it’s through onboarding new people or reviewing performance bonuses.

Under the UK GDPR, all organisations that handle the data of employees who live and work in the UK must comply with the regulation, even if the main business operations are carried out in another country or region.

As a result, everyone on your HR team needs to be aware of what type of employee personal data they’re allowed to share and with whom. Not everyone in the organisation has the right to access or process the information of employees.

You also need a data controller who must be able to prove compliance with the Article 5 data protection principles. It’s a good idea for this person to ensure that certain data protection-related clauses are included in contracts and that employees receive training about processing data. 

The UK GDPR sets out stringent requirements for any business that handles the personal information of UK residents. Having employee’s data on hand is important, but can create challenges if:

• You don’t have legal professionals on your team. For companies that are smaller, there might not be resources available to employ a legal professional who is well-versed in the UK GDPR.

• Employees are joining or leaving your organisation frequently. What information do you collect when an employee joins? What data do you destroy when they leave? And when do you destroy it?

• Employees are unaware of the regulations. All employees, whether in HR or not, need to know their own and others’ rights around their personal data.

It can be difficult for companies to know exactly how to comply with the UK GDPR, especially those that don’t have a data protection officer. Follow the five steps below to bring you closer to achieving compliance.

The UK GDPR might be sizable, but its provisions are laid down as simply as possible so that everyone can understand them. It’s important for all employees, particularly those in HR, to know how it works and their obligations — even if you have an expert on your team. 

Take time to figure out which provisions of the UK GDPR are applicable to your business and read them thoroughly, and review guidance from the ICO on specific areas like security, subject access requests (SARs), and exemptions.

Your company’s data controller will be responsible for developing the compliance framework. This might be the owner of the business or someone else appointed to the position. 

This individual should create a comprehensive compliance framework that clearly defines how the company will process, store and otherwise handle employee information, and what tools and programs they’ll use to do this. 

Compliance is a team effort. Your data controller and data protection officer (if you have one) are the people who are closest to your company’s compliance efforts, but they aren’t the only ones who need to know about the UK GDPR and its requirements.

You need to educate all employees about how they must handle other employees’ data. For example, you could send out a document that includes the basics of the data protection law and then quiz employees about it to test their competency. 

Using HR compliance software can ease some of the concerns around UK GDPR and employment law compliance by offering settings, features, and alerts that support compliance.

The right HR software enables you to keep accurate digital records, enforce strict access controls, and safeguard data from security concerns. With all employee data in one place, it's easier to streamline proceses across the employee lifecycle and collect, store, and retain data in line with regulations.

Part of data protection legislation is to maintain clean, compliant and accurate records. That’s why it’s vital that your HR department conducts internal audits regularly to ensure your organisation is compliant with the UK GDPR. 

If your team finds that data isn’t being processed properly, they should first fix the issue and then adjust their strategies to ensure that the problem doesn't happen again.

Sensitive data passes through HR departments on a daily basis, which can make complying with the UK GDPR in the workplace challenging. This is why it’s so important to have an HR system built for businesses in the UK.

Personio is designed for UK and EU businesses, with support for UK GDPR compliance included as standard — no manual workarounds required.

Personio's compliance highlights include:

• Single system of record for all HR data

• Support for UK GDPR and EU GDPR compliance

• Role-based access controls

• Automatic compliance alerts

• Audit logs

• Automatic data retention according to local requirements

• Data stored within the EU

• Software that's secure by design and complies with the GDPR

Discover secure HR software that helps you stay compliant

Personio’s specialised platform protects HR and employee data and includes the features and alerts you need to support compliance with the UK GDPR.

Discover Core HR

The UK GDPR governs what data an organisation can collect about its employees and what it’s allowed to do with that data. Article 5 is particularly important for businesses as it sets out the principles for processing personal data, which apply to employee data.

Article 5 sets out seven key principles around processing personal data. These are: lawfulness, fairness and transparency, purpose limitation, data minimisation, accuracy, storage limitation, integrity and confidentiality, and accountability.

There's no certification that guarantees HR software is UK GDPR compliant, but you can make your own organisation's compliance process easier by choosing a system designed for the complexities of the UK data protection and employment law system.