Personal data is information that identifies, or could identify, a living person. In people practice, this can include names, addresses, National Insurance numbers, pay, absence, disciplinary records, appraisals, training records, equality monitoring data, photographs, system logs and employee survey responses. The UK GDPR applies when this information is collected, stored, shared, analysed, deleted or otherwise used. Carey (2020) explains that data protection law is built around accountability: organisations must not only comply but also show how they comply.
The starting point is the seven data protection principles (ICO, 2026a):
- Lawfulness, fairness and transparency.
- Purpose limitation.
- Data minimisation.
- Accuracy.
- Storage limitation.
- Integrity and confidentiality.
- Accountability.
For HR, these principles become practical questions. Why do we need this data? Have we told workers how it will be used? Are we collecting more than necessary? Who can see it? How long will it be kept? What evidence shows controls work? These principles matter because HR data can affect employment, pay, reputation, well-being and trust.
Lawfulness means identifying a valid lawful basis before processing personal data. In employment, consent is often difficult because of the imbalance of power between employer and worker. The ICO advises employers to consider other lawful bases where appropriate, such as contract, legal obligation, legitimate interests or public task (ICO, n.d. a). Payroll information may be needed to perform the employment contract and meet legal duties, while workforce planning may rely on legitimate interests if the impact on workers is assessed and managed.
Some HR information needs extra protection. Special category data includes information about health, racial or ethnic origin, political opinions, religion or belief, trade union membership, genetics, biometrics used for identification, sex life or sexual orientation (ICO, n.d. b). To process it, an organisation usually needs both an Article 6 lawful basis and an Article 9 condition. Sickness records, occupational health reports, reasonable adjustments, equality monitoring and some investigations should therefore be handled with tighter access, clearer documentation and stronger safeguards.
Transparency is central to trust. Workers should receive clear privacy information explaining what data is collected, why it is used, lawful basis, retention, sharing, rights and contact details. This is particularly important when digital solutions are introduced, such as HR information systems, e-recruitment tools, learning platforms, case management systems, engagement surveys, dashboards or AI-supported analytics. Jay, R (2020) notes that compliance requires attention to both legal rules and the practical realities of how information flows through systems and decisions.
Digital working increases both opportunity and risk. Well-designed HR systems can improve accuracy, reporting, self-service and decision-making. Poorly governed systems can create excessive access, duplicated records, outdated information, hidden profiling or unclear processor relationships. When a third-party platform processes HR data, the organisation should check contracts, security arrangements, data location, sub-processors, breach notification routes and deletion arrangements. Privacy by design means considering these issues before the system goes live.
Worker monitoring and analytics require particular care. The ICO explains that monitoring should protect workers’ rights and help employers build trust (ICO, n.d. c). Monitoring may include CCTV, vehicle tracking, email and internet logs, productivity tools, call recording or absence analytics. A lawful purpose is not enough on its own. The organisation should consider proportionality, less intrusive alternatives, consultation, privacy information, access controls and whether a data protection impact assessment is needed.
People professionals also need to recognise individual rights. Workers may request access to their personal data through a subject access request (SAR), which can be made verbally or in writing and does not need to mention ‘SAR’ or data protection law.
The ICO states that organisations should respond without delay and within one month in most circumstances, with limited extensions for complex or multiple requests (ICO, nd d). HR teams therefore need reliable filing, search, redaction and escalation processes, including a clear route for checking third-party information before disclosure.
Finally, GDPR requires good incident response. A personal data breach could include sending a report to the wrong person, losing a laptop, exposing payroll files, misconfigured system access or unauthorised viewing of an employee relations case. Not every breach must be reported to the ICO, but notifiable breaches must be reported without undue delay and within 72 hours (ICO, n.d. e). A strong HR approach combines prevention, training, clear ownership, evidence of decisions and a culture where people report concerns quickly.
Action Point
Choose one HR process or digital system, such as recruitment, absence management, payroll, learning records or engagement surveys. Map what personal data is collected, why it is needed, the lawful basis, who can access it, how long it is retained and what risks exist. Identify one control that should be strengthened, such as privacy information, permissions, retention rules or breach escalation.