Important things HR needs to know about GDPR
As of March 2025, regulators doled out 2,245 GDPR fines—amounting to around €5.65 billion (£5 billion) in total. If that wasn’t enough to get HR and business leaders’ attention, data shows that the value of these fines is increasing, with the highest penalty to date (an eyewatering €1.2 billion) being issued to Meta Platforms Ireland Limited in 2023 for having insufficient legal basis for data processing.
GDPR is hugely important for businesses and their HR departments. It governshow companies handle data protection and lays out strict requirements to ensure everyone’s data, including employees’ and customers’, is secure, used responsibly and safe from misuse.
There is plenty of legislation that HR professionals need to be mindful of, but UK GDPR is essential. As the hefty fines above demonstrate, businesses that don’t uphold GDPR compliance laws run a considerable financial risk, not to mention a tainted image and loss of trust from clients, partners and customers.
In this guide, we’ll discuss what GDPR is and why it’s important for businesses in the UK. We’ll also highlight various GPDR regulations that you need to abide by. Learn more with BambooHR below.
What is GDPR?
GDPR refers to UK General Data Protection Regulation, a piece of legislation in the UK. This legislation controls how personal information is used by organisations and aims to protect this data from misuse.
It’s essential that your business handles all personal information in line with the Data Protection Act 2018 (DPA). To do this, all personal data must be:
- used in a fair, lawful and transparent manner
- used for specified, explicit reasons
- used adequately, relevantly and only for what is necessary
- accurate and up to date
- kept for no longer than necessary
- handled securely and protected against unlawful or unauthorised processing, access, loss, destruction or damage.
What personal data can I keep about an employee?
As an employer, there are various types of information you’ll collect about your employees. From identification details to employment and payroll, there are plenty of details your staff trust you with and it’s important that you keep them safe.
Let’s look at the different types of personal data employers typically keep about employees:
Data employers can hold without permission
Under GDPR, employers can collect and hold certain pieces of personal data about employees without their permission. This kind of information is deemed necessary for managing employment.
This can include:
- name
- date of birth
- address
- sex
- education and qualifications
- work experience
- National Insurance number
- tax code
- emergency contacts
- employment history
- employment terms and conditions
- work-related accidents
- training information
- disciplinary action.
Data employers need permission to keep
There are also certain details about employees that employers need permission to keep. This can include sensitive personal information such as a team member’s:
- race
- ethnicity
- religion
- political membership or opinions
- trade union membership
- genetic information
- biometrics
- health and medical conditions
- sexual history or orientation.
Employers are advised to keep sensitive data more securely than other kinds of details.
What do employers have to tell an employee about their data?
Employers should take time to communicate clearly with employees about the data they collect and what they do with it. This will help to establish an open, trustworthy relationship between employer and employee.
Team members have a right to know:
- The records being kept
- How the information is used
- The levels of confidentiality for the records
- How the data stored contributes to training and development.
Should an employee wish to know about the data kept on them, you have 30 days to give them a copy of the information.
Always ensure you don’t keep data any longer than necessary, as this could violate data protection law.
Do employers have to treat health related data differently?
Information about the health of your employees is some of the most sensitive data you hold as an employer, so it requires a higher level of protection. If you run a business in an industry where you need to access data related to employee health, it’s vital that you protect staff’s details in line with GDPR principles.
Here are a few examples of the type of instances where you might need to process information about a member of staff’s health:
- Sickness absence forms
- Information regarding a disability or impairment
- Eye-test results for an employee who uses display screens
- Blood tests records to check they haven’t been exposed to hazardous substances
- Alcohol or drugs test results
- Fitness to work assessment results to determine eligibility for certain benefits or continued employment
- Vaccination and immunisation results, status and history.
Always be clear about why you’re collecting and storing employee health information. This can provide your staff with added peace of mind.
Check that you’re GDPR compliant
Now you’re more aware of GDPR regulation and what you need to do to stay compliant, you can take the necessary steps to ensure your business handles all employee data in line with the law. Following the government’s guidelines provided can help you protect your staff’s data from misuse and help you avoid facing penalties from regulators. This can all help you build an open, safe and compliant environment for your team.