Watch: Data Protection for HR - 10 Top Tips to Stay Compliant

1. Reviewing and updating privacy notices

Employers should have an up to date and accessible Privacy Notice for employees and job candidates, clearly and comprehensively explaining what personal data is held, how it is used and why. Privacy Notices should also detail the rights that individuals have in relation to their personal data.

2. Data Collection Audits

Employers should regularly audit of what categories of personal data is collected and retained in relation to employees in order to ensure that personal data is lawfully held and processed.

3. Understanding rules on criminal conviction

Criminal conviction data is a separate category of data, and there are specific rules around this. It is only lawful to collect and store criminal conviction data in specific, limited circumstances.

4. Employee health data

Health data is also a special category of data, but employers may have a legitimate reason for processing health data in order to ensure they are meeting their health and safety and other obligations. However, given the sensitive nature of such data, additional controls must be established to ensure lawful processing.  

5. Conducting annual employee data checks

Employee data must be accurate, so employers should establish practices to regularly verify and update employee personal data to make sure it is up to date.

6. Managing data sharing with third parties

Employers may be required to share personal data with third parties such as payroll and benefits providers. Employee Privacy Notices should expressly state how and with whom data is shared.  It is essential that employers have in place adequate arrangements with third parties to ensure the security and lawful processing of employee personal data.

7. Handling data subject access requests (DSARs)

DSARs are a commonly exercised right of individuals, including employees. Recognising and responding to DSARs within the appropriate time frame is a key aspect of data protection compliance. Managers and HR teams should receive training on how to recognise and respond to a DSAR.  Systems should be established to support a timely response.

8. Strengthening data security measures

Breaches of security, such as loss, damage or unauthorised disclosure of data, can cause financial loss, risks to personal safety and distress and ultimately claims from individuals. Personal data should always be held securely, for example, by using access controls and password protection.

9. Data Protection Impact Assessments (DPIAs)

DPIAs are a useful tool to assess data protection risks and identify the means to address those risks. DPIAs also evidence that an employer has considered and managed data protection risks in the event of any subsequent complaint or claim.

10. Compliance Training

Education and training are fundamental to any compliance initiative. All employees should be trained on data protection issues and, in particular, data security. Managers should be specifically trained to understand the data protection principles underpinning record keeping, recruitment, performance management and absence management.