Yes. Employee data is personal data, so GDPR applies whenever an employer collects, stores, shares, searches, or deletes it. The more useful question is not whether the law applies, but which rules and controls fit the data you actually hold.
The ICO’s employment guidance is aimed at employers handling workers’ information under UK GDPR and the Data Protection Act 2018. That covers recruitment records, payroll, absence files, performance notes, disciplinary material, monitoring logs, and health information. In other words, employee data is not a special exception to GDPR. It is one of the most common places GDPR applies.
What counts as employee data
Anything that identifies an employee, job applicant, contractor, or former worker can be personal data. In practice, that usually includes contact details, HR files, appraisal records, ID documents, payroll information, sickness records, CCTV or access logs, and internal messages that identify a person or describe their behaviour.
The ICO’s employment records guidance is a useful starting point because it treats worker information as a normal data-protection issue: lawful basis, retention, accuracy, access, and security all matter.
Which rules matter most
For most employment records, the employer needs a lawful basis under Article 6. In practice, that is often contract, legal obligation, or legitimate interests rather than consent. Consent is usually a weak foundation in an employment relationship because the power imbalance makes it hard to call the consent freely given.
If the record includes special category data, such as health information, biometric data, union membership, or similar sensitive material, the employer also needs a valid Article 9 condition. The ICO’s guidance on special category data conditions is the right source for that check. If you process worker health information, the ICO also has specific workers’ health guidance.
Our article on when you need to conduct a GDPR risk assessment/DPIA is the better next read if your employment processing includes monitoring, large-scale profiling, or other higher-risk activity.
How to protect employee data properly
The protections are practical, not abstract. Restrict access to the people who need the records to do their jobs. Keep the data accurate and up to date. Delete it when you no longer need it. Tell workers what you are doing with it. And make sure people who handle it understand the rules.
- Access: limit HR and manager access to the minimum required for the role.
- Accuracy: keep addresses, next-of-kin details, and employment status current.
- Retention: set clear retention periods for payroll, recruitment, absence, and disciplinary files.
- Security: use permissions, audit logs, and secure storage for digital and paper records.
- Transparency: tell workers what you hold, why you hold it, and who can see it.
If your organisation still relies on a templated privacy notice, our piece on operationalising privacy policies shows why the notice is only credible when the underlying process actually works.
When the risk is higher
Employee data becomes more sensitive, and more likely to need extra scrutiny, when you process health data, monitor staff activity, use biometrics, collect disciplinary evidence, or share worker information with multiple suppliers. Those are the cases where a DPIA, stronger approval rules, and tighter retention controls are usually worth the effort.
The point is simple: if the record can affect pay, employment status, health, or reputation, treat it as high-risk data rather than routine admin.
What managers should do this week
- Map what employee data you hold and where it lives.
- Check the lawful basis for each major processing purpose.
- Confirm which records include special category data and who can access them.
- Review retention periods and delete what you no longer need.
- Make sure worker privacy information matches actual practice.
- Refresh training for HR, line managers, and anyone with access to worker records.
For teams that want a practical baseline, the GDPR Essentials course is the simplest way to get managers aligned on lawful basis, retention, access, and security before employee-data problems start.
Sources
- ICO: Employment practices and data protection – keeping employment records
- ICO: Employment practices and data protection – recruitment and selection
- ICO: Employment practices and data protection – information about workers’ health
- ICO: What are the conditions for processing special category data?
- Regulation (EU) 2016/679, Articles 6, 9 and 88
