Handling Employee or Contractor Data Under UK GDPR

Handling employee or contractor data under UK GDPR requires a lawful basis, clear policies and documented decisions to protect personal information while running your business. As a founder you must understand your obligations from the moment you begin recruitment through to ongoing payroll and any monitoring activities.

This guide outlines practical steps for maintaining recruitment records, processing payroll information and conducting legitimate interest assessments. It focuses on the actions you can take to reduce risk and demonstrate accountability as required by the regulation.

Understanding Your Role as Data Controller

As an employer or engager of contractors you are the data controller for the personal data you collect and process. This means you decide the purposes and means of processing. You must ensure any processing is lawful, fair and transparent. For most UK startups the key lawful bases are contract, legal obligation and legitimate interests.

Document your decision on which basis applies to each type of processing activity. Keep this information in an internal record of processing activities. Review it whenever your operations change, such as when you begin hiring your first employee or switch from contractors to employees.

Managing Recruitment Records

From the first job advert to the final rejection letter you collect personal data from applicants. Create a privacy notice that applicants can access before they submit their CV. State clearly what data you collect, why you need it, how long you will keep it and who it may be shared with.

Store application forms, CVs and interview notes securely. Delete data belonging to unsuccessful candidates after a short period, typically within six months unless you have a specific reason and the candidate’s consent to retain it longer. For successful candidates transfer their details to your employee file and update your records of processing. Use strong access controls so only those who need to see the information can do so.

Keep a log of recruitment decisions. Note the lawful basis for each stage, such as taking steps to enter into a contract of employment. This helps demonstrate compliance if questioned.

Payroll Processing and Legal Obligations

Payroll involves processing names, addresses, National Insurance numbers, bank details and tax information. Much of this is required by law, giving you a lawful basis of legal obligation. You must still inform individuals about the processing and keep the data secure.

Decide whether to handle payroll in-house or use an external provider. If you use a provider, put a written contract in place that includes data protection clauses. The provider becomes a data processor and must only act on your instructions.

Retain payroll records for the period required by HMRC rules. These periods change so always check current GOV.UK guidance. Separate payroll data from other HR records and restrict access to authorised personnel only. Conduct regular checks to ensure data remains accurate and up to date.

Monitoring Employees and Contractors

Monitoring can include email scanning, CCTV, GPS tracking or productivity software. It must be necessary, proportionate and based on a valid lawful basis. Legitimate interests is often used but requires a formal assessment.

Inform individuals about monitoring before it begins. Update contracts or staff handbooks with clear policies. Explain what is monitored, why, how the data will be used and how long it will be kept. For contractors include similar information in your service agreement.

Consider less intrusive alternatives first. Document why monitoring is necessary for your business. For example, protecting confidential information or ensuring health and safety may justify limited monitoring. Always balance your needs against the individual’s rights and expectations of privacy.

Conducting Legitimate Interest Assessments

A legitimate interest assessment (LIA) has three parts: identifying a legitimate interest, showing that processing is necessary to achieve it, and balancing that against the individual’s interests, rights and freedoms.

Write the LIA before you start the processing. For monitoring, your legitimate interest could be preventing theft of company property or maintaining productivity. Explain why the processing is necessary rather than merely convenient. Then consider the impact on the person: how intrusive is it, would they reasonably expect it, and what safeguards can you put in place?

Keep the completed LIA on file. It does not need to be shared with individuals but it demonstrates accountability. Review the assessment if circumstances change. If the balancing test shows the individual’s rights override your interest, you cannot rely on legitimate interests and must find another basis or stop the processing.

Data Subject Rights and Breach Response

Individuals can request access to their data, ask for corrections, erasure or restriction of processing. Have a simple process for handling these requests. Respond within one month, or inform them if an extension is needed. Verify the requester’s identity before disclosing information.

Train anyone who handles personal data on recognising and reporting a breach. A breach includes lost USB drives, hacked email accounts or accidental sending of payroll spreadsheets. Document every incident, even if it does not require reporting to the Information Commissioner’s Office. For higher-risk breaches notify the ICO without undue delay and, where required, the affected individuals.

Practical Checklist for Early-Stage Founders

Follow these steps to build a compliant approach:

Write and maintain a record of processing activities covering recruitment, payroll and monitoring.
Create privacy notices for job applicants, employees and contractors.
Put contracts in place with any payroll provider or cloud HR platform.
Complete a legitimate interest assessment for any monitoring activity.
Review data retention periods against current HMRC and Companies House guidance.
Limit access to personal data on a need-to-know basis.
Document all decisions and keep policies up to date as your team grows.

Founders based at Loomworks can discuss these processes during operator mentoring sessions to ensure their approach fits their specific operations.

Frequently asked questions

Do I need consent to process employee personal data under UK GDPR?

Consent is rarely the best basis for employee data because of the imbalance of power in the employment relationship. Use contract, legal obligation or legitimate interests instead. Document your chosen basis clearly for each processing activity.

How long can I keep recruitment data for unsuccessful candidates?

Most businesses keep it for six months after the recruitment exercise ends to defend against possible discrimination claims. Only keep it longer if you have a specific reason and the candidate has agreed. Review and delete the data when the retention period ends.

What is a legitimate interest assessment and when do I need one?

A legitimate interest assessment is a three-part test to justify processing under the legitimate interests basis. You need one whenever you rely on legitimate interests, especially for monitoring or direct marketing. Keep the written assessment on file as evidence of compliance.

Can I monitor contractors in the same way as employees?

You can monitor contractors but must respect the terms of your agreement with them. Inform them in advance through the contract and carry out a legitimate interest assessment. Contractors often have a greater expectation of privacy so the balancing test may be stricter.

What should I do if I experience a data breach involving payroll information?

Assess the risk to individuals. If the breach is likely to result in a risk to rights and freedoms, notify the ICO. Document the breach, your assessment and any remedial action. Inform affected people where appropriate. Review your security measures to prevent recurrence.