A guide to employee data protection

With growing developments in GDPR and employee rights, it is more important than ever for SMEs to understand their legal obligations surrounding data.

Employee data protection is an essential responsibility for every employer, regardless of size or sector. Businesses handle significant amounts of personal information, and managing it correctly is key to remaining compliant.

In this guide, we outline what employee data protection means in practice, the policies and processes you should have in place, how to manage sensitive information appropriately, and the role HR plays in keeping your business aligned with regulations.

What is employee data protection?

Employee data protection refers to an employer’s legal and ethical responsibility to collect, process, store, and share employee information in line with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

These laws set out how personal data must be handled; the rights individuals have over their information and the standards organisations must meet to keep that data secure.

What counts as employee data?

Employee data includes any information that relates to an identifiable person. This is known as personal data and can range from obvious details such as a name and address to less direct identifiers such as employee numbers or online identifiers.

In an employment context, examples of employee data may include:

• Payroll information and bank details
• Performance reviews and appraisal records
• Absence records, including sickness information
• Disciplinary or grievance notes
• CCTV footage captured in the workplace
• Email communications and internal correspondence

Even informal notes taken by managers during meetings can fall within the scope of employee data if they relate to an identifiable individual.

There is also a category known as special category data, which is more sensitive and requires additional safeguards. This can include information about health, ethnicity, religious beliefs or trade union membership.

Who does employee data protection apply to?

Employee data protection does not only apply to people currently on your payroll. Your responsibilities extend to:

• Current employees
• Job applicants and candidates
• Contractors and temporary workers
• Former employees

From the point someone submits a CV to the period after they leave your organisation, their personal information must be handled in accordance with data protection law.

Why data protection matters for SMEs

Even small and medium-sized businesses hold significant amounts of personal information about employees. Here’s why protecting it matters:

GDPR obligations apply regardless of business size

There is no small business exemption to data protection regulations. If you have employees, you are responsible for handling their information lawfully and securely.

Potential ICO fines and enforcement action

The Information Commissioner’s Office (ICO) has the authority to investigate complaints, carry out audits and issue enforcement notices. In serious cases, organisations can face substantial financial penalties.

Increased employee awareness of their rights

Employees are increasingly aware of their data protection rights, including the right to access their data, correct inaccuracies and, in some cases, request its erasure. Employers must have clear processes in place and be ready to respond appropriately.

The growing number of data subject access requests

Many SMEs are seeing a rise in data subject access requests (DSARs), particularly during disputes or when employment relationships end. It’s essential to handle these requests correctly and within the required timeframe.

Risk of tribunal claims if data is mishandled

Poor data management can increase the risk of Employment Tribunal claims. Disclosing confidential information, retaining data too long or mishandling a request can all escalate to a dispute. Strong data protection practices help reduce legal risk.

Reputational and trust impact

Beyond legal and financial risk, there’s trust. Employees expect their personal data to be handled carefully, and breaches or misuse can damage morale, leadership confidence and your reputation. For SMEs especially, where reputation drives growth and recruitment, maintaining trust is essential.

The policies every small business should have in place

Having the right documentation in place is one of the simplest and most effective ways to protect your business. Below are the key policies every SME should consider.

Data protection policy

A data protection policy outlines your organisation’s overall approach to handling personal data. It should explain the principles of UK GDPR, define roles and responsibilities, and set out how data is collected, processed, stored and shared.

This policy provides a framework for compliance and shows that your business takes its legal obligations seriously.

Privacy notice for employees

An employee privacy notice explains what personal data you collect, why you collect it, how it is used, who it may be shared with and how long it will be retained. It should also outline employees’ rights under data protection law.

Transparency is key. A clear privacy notice helps build trust and reduces the risk of disputes about how information is handled.

Data retention policy

A data retention policy sets out how long different types of employee data will be kept and when it will be securely deleted. It should cover both electronic and paper records.

Clear retention timelines protect the business and demonstrate accountability.

IT and communications policy

An IT and communications policy should outline how workplace systems, email, internet access and devices are to be used. It should also explain any monitoring practices and the lawful basis for doing so.

Clarity here helps prevent misuse of systems and ensures employees understand how their data may be processed in a digital environment.

Data subject access request procedure

A documented DSAR procedure outlines how requests are received, who is responsible for handling them, how information is gathered, and the timeframe for response.

It should also set out the steps the business will take once a request is submitted, including acknowledging receipt, verifying identity where necessary, searching all relevant systems, reviewing and redacting third-party data, and issuing the response within the legal deadline.

Having a clear procedure in place ensures the business can act quickly, remain compliant and reduce the risk of errors or missed time limits.

How employee data should be handled and stored

Employee data must be processed responsibly and protected at every stage. Here’s what you need to consider:

Lawful basis for processing

Under UK GDPR, employers must identify a valid lawful basis every time they process employee data. The most commonly relied upon bases include:

• Processing that is necessary to fulfil the terms of employment, such as paying salaries, managing pensions, or administering benefits.
• Processing required to meet statutory and regulatory duties, including HMRC reporting, right to work checks, and compliance with health and safety legislation.
• Processing that supports a genuine business need, provided it does not override the employee’s rights and freedoms, and is supported by a documented balancing test where appropriate.

Secure storage

Employee data must be stored securely, whether it is held digitally or in paper form. Key measures include:

• All systems containing employee information should be protected by strong passwords, with robust password policies and multi-factor authentication implemented wherever possible.
• Sensitive data, particularly special category data such as health information, should be encrypted both in transit and at rest to reduce the risk of unauthorised access.
• Access to HR files, payroll systems and personnel records should be restricted to authorised individuals only, with permissions regularly reviewed.
• Not every manager requires access to all employee information. Limiting access on a strict need-to-know basis reduces the risk of accidental disclosure and demonstrates responsible data governance.

Physical documents

Businesses must also ensure that physical records are handled and stored securely. Key measures include:

• Personnel files and other confidential documents should be stored in locked cabinets, with access to keys strictly controlled and limited to authorised individuals.
• Implementing a clear desk policy helps prevent sensitive information from being left visible in shared workspaces, reducing the risk of accidental disclosure or data breaches.

Handling sensitive data such as mental health information

As special category data, mental health information must be handled with heightened care and strict confidentiality.

Details relating to an employee’s mental health, medical reports or sickness absence should only be processed where there is a clear lawful basis and an additional condition for processing. Mishandling this type of data can expose both the individual and the organisation to significant problems.

Access to this information should be limited to those who genuinely need it to carry out their role, such as HR or senior management. In most cases, managers do not require detailed medical information confirmation of fitness for work or recommended adjustments will usually be sufficient.

Employers should also avoid excessive note-taking or recording detailed symptoms. It is generally enough to record that an employee is unwell, rather than documenting specific medical information.

Occupational health reports and related correspondence should focus on practical recommendations, be stored securely, and shared strictly on a need-to-know basis.

Managing data for job applicants

Data protection duties begin at the first point of contact, not when employment starts. During recruitment, employers often collect CVs, application forms, interview notes, references and right-to-work documents, all of which count as personal data. Even internal comments about a candidate can fall within scope.

Candidates should be given a clear privacy notice at the application stage explaining what data is collected, why it is needed, how it will be used and how long it will be kept.

Retention periods must be defined. Unsuccessful applicant data is commonly kept for around six months before secure deletion, unless the individual has consented to being considered for future roles. Equality monitoring data should be stored separately from hiring decisions and access restricted.

Clear notices, sensible retention limits and secure handling help businesses stay compliant and reduce risk from the outset.

What happens to employee data when someone leaves

When someone leaves, their personal data must be reviewed. Employers should decide what must be retained, what can be removed and how the remaining data will stay secure.

Some records, such as payroll and tax information, must be kept for statutory reasons. Limited details may also be retained to provide references. Disciplinary or grievance records can be held where legal claims are possible, but retention periods should be defined and not indefinite.

Access to systems should be disabled immediately to prevent unauthorised use. When information is no longer needed, it must be securely deleted or confidentially destroyed rather than simply archived.

Former employees still have data protection rights, including the ability to submit a data subject access request, so clear off-boarding and retention procedures are essential.

The importance of training in creating a culture of data protection

Effective data protection relies on more than policies. It depends on employees understanding and applying them consistently. Training should therefore cover:

• Guidance on confidentiality responsibilities, recognising sensitive information and knowing when data can and cannot be shared.
• Password security, including using strong, unique passwords, enabling multi-factor authentication where possible and never sharing login details.
• Phishing awareness, so employees can identify suspicious emails, links or requests for information and report them quickly.
• Secure document sharing, ensuring sensitive data is only sent through encrypted platforms with correct access controls and verified recipients.
• Manager responsibilities where relevant, including accurate note-taking, secure record keeping, appropriate language and retention requirements.

The role of HR in protecting employee data and the benefits of outsourcing

Protecting employee data requires structure, consistency, and specialist knowledge. HR plays a central role in setting standards, managing sensitive information and ensuring compliance.

When you outsource HR, these same responsibilities are strengthened through independent expertise and reduced internal risk.

Impartial oversight and unbiased decision-making

HR provides a neutral perspective when handling employee information, helping ensure data is managed fairly and confidentially.

An outsourced HR provider enhances this impartiality further, giving employees greater confidence that sensitive matters are handled objectively and without internal bias.

Structured record keeping and reduced error risk

Accurate, consistent documentation is essential for compliance and defensibility. HR establishes how records are created, stored, and retained.

External HR teams bring tested systems and processes, reducing duplication, inconsistencies and informal practices that often lead to mistakes.

Advising managers and strengthening accountability

Managers regularly handle sensitive data during performance management, disciplinaries and investigations. HR guidance ensures information is documented lawfully and shared proportionately.

Outsourced HR adds specialist expertise, helping managers act confidently while lowering legal and reputational risk.

Managing disputes with professionalism and distance

In contentious situations, HR acts as a buffer by controlling communications and documentation.

An external HR partner provides additional professional distance, which can de-escalate conflict and improve trust in the fairness of the process.

Coordinating DSAR responses and meeting deadlines

DSARs require careful review and strict time management. HR ensures relevant records are identified, and statutory deadlines are met.

External HR support reduces the administrative burden and lowers the risk of incomplete or non-compliant responses.

Ensuring organisation-wide compliance and up-to-date policies

Employee data moves across payroll, IT, and management teams. HR sets consistent standards and monitors compliance.

Outsourced HR services typically include regular policy reviews and legislative updates, ensuring procedures remain current rather than becoming outdated.

Why Sapphire HR is a trusted partner for SMEs

At Sapphire HR, we provide HR support for small businesses to strengthen data protection by providing dedicated expertise, an external perspective and consistent oversight that can be difficult to maintain in-house.

Our support gives organisations access to specialist knowledge whenever it is needed, without the cost or resource pressure of employing a full internal HR team.

This improves confidence in sensitive decision-making, reduces compliance gaps and provides reassurance that processes are being handled professionally and independently.

Our HR On Demand and HR Unlimited services give businesses the option of ad-hoc expert advice or ongoing, comprehensive support.

These options provide practical HR guidance, assistance and support exactly when required, helping maintain strong data protection standards without overextending internal resources.

Contact us today to ensure your employee data protection processes are compliant.