GDPR - by Sarah Wilkinson
- by Cheranne Hack
- •
- 31 Jan, 2018
So, my overview below comes with an appropriate caveat that a) it’s more focused on GDPR for employers and b) be warned that of course it’s not a substitute for seeking specialist legal advice.
Right; let’s start at the beginning. GDPR stands for the General Data Protection Regulation. If you’ve not yet heard of it then you have either been going about your day with your head in the sand, or somewhere else… anyway, long story short is that it replaces the current Data Protection Act (DPA) and it’s a BIG deal. It’s EU law that will come into force automatically on 25 May 2018 and when we leave the EU, it will be incorporated into UK law, supplemented by the Data Protection Bill which will be published by the Government. It applies to all personal data, so if any data identifies a living person, that data will be governed by the GDPR. This could be someone’s name or email address, their bank details or their medical records.
When can you process personal data?
Having an employee’s consent is unlikely to be an adequate legal basis for processing their data. One of the reasons employers can use is for the ‘proper performance of a contract’. For example, processing personal data is often essential for an employment contract, (to pay their salary). In most cases, this will be sufficient. Other reasons are:
- To comply with a legal obligation (e.g. data about an individual’s sickness records)
- The pursuit of a legitimate interest (e.g. for a disciplinary investigation). Be wary of this one, as you must identify what those interests are and ensure that your actions are necessary and are not overridden by the employee’s rights.
As an employer, you will need to consider what information you collect for employees, job applicants (successful and unsuccessful) and contractors (if applicable). How you collect it, where’s it kept, how long you retain it for – and then how you delete this data after the retention period.
Therefore, one of the first things you’ll need to do is conduct a HR personal data audit, determining the legal grounds for processing each category of employee personal data. If you process special categories of personal data or criminal records data, then you’ll need to do the same exercise for this data.
Then review your privacy notice and update in line with the GDPR:
- Company name and contact details
- Your lawful basis for processing as well as the purposes of the processing
- Details of any recipients of the data
- The right to withdraw consent (when the legal basis for processing is consent
- The source of the data (if not directly from the employee)
- How long the data will be held for
- If the data will be transferred to other countries
- Information on the right to make a subject access request:
- Information on the right to have personal data erased. The right to erasure/ the right to be forgotten applies in certain instances including:
- This is a change from the DPA and you need to be familiar with the other reasons for the right to erasure and restrictions on processing personal data. There are also some circumstances where you can refuse the right to erasure.
- Remember to delete any backups!
- Information on the right to have personal data rectified in certain instances
Here's an example of a privacy notice – what do you think of it? What about the boxes at the bottom, would they comply with GDPR? The answer is NO, they wouldn’t! They’re opt out, and remember that under the GDPR you can only use opt-in.

Consent requires a positive opt-in. Don’t use pre-ticked boxes or any other method of default consent (like above!). Avoid making consent to processing a precondition of a service.
Imagine my delight when my milk was delivered last week, along with this leaflet:

If you process special categories of data, you must show that one of the specific legal grounds for processing such data applies. More info here: https://ico.org.uk/for-organisations/guide-to-the-general-data-protection-regulation-gdpr/lawful-bas...
There is some good news, though. For small and medium-sized organisations, documentation requirements are limited to certain types of processing activities.
Current guidance is that if you have less than 250 employees, you only need to document processing activities that:
- are not occasional; or
- could result in a risk to the rights and freedoms of individuals; or
- involve the processing of special categories of data or criminal conviction and offence data.
If you have 250 or more employees, you must document all your processing activities.
You must also keep a data register to meet the requirements for record-keeping, and it makes sense to combine this with the location of the data, processing activities and the legal bases upon which you’re processing the data. Then, if an individual submits a subject access request, this will really help you to find the information you need within the timescales outlined by the GDPR. If your company transfers personal data outside of the EEA, you will need to ensure that adequate protection is provided.
The right to be forgotten
Individuals can ask you to erase any of their personal data that you hold, which you must do providing there are no other grounds for processing and no overriding legitimate interests. If the data is held elsewhere, like in the public domain or with a third party, you must tell them to erase the data held with them, too. If you have a legal obligation to retain an individual’s data, or if it’s needed to defend a claim, then you wouldn’t need to comply with the request in these circumstances; although you must cease processing for any other purpose.
Do we need to appoint a Data Protection Officer (DPO)? Appointing a DPO is a legal requirement if you are a public authority (except for courts), carry out large scale systematic monitoring of individuals (like online behaviour tracking), or if you carry out large scale processing of special categories of data, or data relating to criminal convictions and offences. Of course, you may wish to appoint a DPO anyway, so that they can manage your obligations under the GDPR and monitor compliance, acting as the first point of contact.
Still want more?
For a free consultation or to chat about how HR support can benefit your business, I’d love to hear from you: sarah@swchr.co.uk.
