It’s easy to only think about data protection and GDPR in terms of customers or contacts, but what about the people who work for you – your employees, contractors or associates?
Personnel and HR records fall within the data protection regulations, and there are specific rules around processing employee personal information where an employer must protect the employee’s fundamental rights. In addition, it is an employer’s responsibility to make sure that all employees and contractors understand what is expected of them when it comes to the customer and contact information in your business.
But this need not be complicated! As I often explain to clients, the basic rules of GDPR are to be open, honest and responsible.
Here are the top 3 areas that you need to think about:
- Be transparent about personal and sensitive information
The first step is simply to be clear about how you will use employee and contractor information. Ensure that they know what information you will collect, why you need it, and what you will do with it.
If you carry out any background checks on potential and existing employees including checking social networking sites, verifying education background, and DBS checks, make this clear in your recruitment and employee information.
Let staff know about the lawful bases you have identified for the processing of information - these could be:
- Contractual - to enable you to fulfil your obligations as an employer;
- Legitimate interest – so that you can meet other requirements such as ensuring worker safety or securing company property;
- Legal obligation - to enable you to meet your legal obligations to HMRC for tax and National Insurance.
As an employer, you can also use consent as a lawful basis, but it’s important to point out that as employees do not have genuine free choice to give consent to share their personal information and they are not able to withdraw it, to rely on consent as the only lawful basis for processing employee information is not valid.
- Inform your employees or contractors about the use of their data
This information needs to be clear, upfront and easily accessible; sending it to staff and contractors with an offer letter or contract is a useful way of bringing it to their attention at the start of their working relationship with you. It’s also a good idea to include it in a staff handbook, or on an employee intranet site for easy reference.
Make sure you detail your data protection policy that covers what is expected when handling customer and contact information. Include policies on working from home, bringing your own device, and acceptable use such as for social media, internet and email. Enforcement measures around any policy breach should be clear.
Let your employees know about their rights to access their own personal data and tell existing staff and applicants about your retention policy for personal information.
If you plan to carry out workplace monitoring, whether CCTV, phone, email or internet usage, you must let staff know.
- Educate about data responsibilities
It’s important that everyone in your organisation knows how to handle data responsibly and in a way that meets GDPR and your business’s requirements and standards.
Every individual must understand and follow your internal procedures and processes, and know who to report breaches and request for information to. Frequent and role-based training that covers Data Subject Access Requests (DSARs), data breaches and cyber security is a great way of keeping staff up to speed.
With more and more staff working from home, it’s important they handle data within their home environment in the same way they would if they were on work premises. Stress the importance of physical security of personal information, i.e. taking files home, or printing documents from a home printer; make sure that it’s not possible to create local copies of personal information records/documents, and provide screen covers so that information can’t be overseen by others who don’t have consent to see it.