Privacy Notice for Employees Template

1. Purpose and Scope

This policy details how [Organisation Name] collects, uses, and protects personal data across our workforce, including employees, workers, contractors, volunteers, and job applicants. Processing complies with applicable data protection laws, including the UK GDPR and the Data Protection Act 2018.

This document is for informational purposes. It does not form part of any employment contract and does not require employee agreement to take effect.

Working through related paperwork at the same time? See also our Privacy Policy Template, Subject Access Request Procedure Template and UK Code of Conduct Template.

2. Data Controller and Contact Information

[Organisation Name] is the data controller for personal information processed under this policy.

Direct all inquiries, concerns, or requests regarding data processing and privacy rights to the [Role] at [Email Address].

3. Personal Data Collected

The organisation holds and processes these categories of workforce data:

• Recruitment Records: Job applications, CVs, interview notes, candidate references, and right-to-work documentation.
• Contract and Identity Details: Name, residential address, personal contact details, date of birth, National Insurance number, and emergency contact details.
• Pay and Benefits: Salary details, bank account information, tax codes, pension enrolment details, and benefits records.
• Working Time and Attendance: Rotas, timesheets, annual leave records, sickness absence records, and medical fit notes.
• Performance and Conduct: Performance evaluations, training history, and disciplinary or grievance records.
• Health Information: Health data required to implement workplace adjustments, calculate statutory pay, or fulfill health and safety duties.
• Monitoring Data: CCTV footage captured at [Locations] and system access logs recorded on [Systems], where applicable.

4. Lawful Bases and Purposes of Processing

We collect and process personal data under these lawful bases and operational purposes:

• Contractual Necessity: Administering the working relationship, running payroll, managing leave and performance, and maintaining pension contributions.
• Legal Obligation: Meeting statutory duties, including tax and National Insurance reporting, right-to-work checks, statutory leave and pay administration, and health and safety requirements.
• Legitimate Interests: Operating, managing, and securing the organisation, including workforce planning, training, and site security, balanced against individual rights.
• Consent: Used when offering a clear choice, such as publishing employee photos in promotional materials. You can refuse or withdraw consent at any time without penalty.
• Special Category Data: Sensitive details, such as medical and health information, are processed under statutory safeguards. Access is restricted strictly to authorized [Roles].

5. Data Sharing and Disclosure

We share personal data only when necessary, under written contracts or legal duties. Recipients include:

• Designated payroll, pension, and benefit or insurance providers.
• Tax authorities and government bodies where required by law.
• Contracted IT and HR software vendors processing data on our behalf.
• Professional advisers, including accountants, legal counsel, and insurers.
• Prospective employers requesting references, following our standard reference procedures.
• We never sell workforce data to third parties.

6. Data Retention

• We retain personal data throughout employment and for [Retention Period] after employment ends.
• We retain records for unsuccessful job applicants for [Retention Period] following the recruitment decision.
• Financial, payroll, and tax records are kept in line with statutory requirements set out in the organisation’s retention schedule.

7. Individual Rights

Workforce members and job applicants have the following rights regarding their personal data:

• Right of Access: Request access to personal data held (Subject Access Request). We fulfill requests within one calendar month.
• Right to Rectification: Request corrections to inaccurate or incomplete records.
• Right to Erasure, Restriction, or Objection: Request deletion, restriction of processing, or object to specific data uses under defined legal conditions.
• Right to Withdraw Consent: Withdraw consent at any time where consent is the lawful basis for processing.
• Right to Complain: Raise concerns internally with the [Role] or submit a complaint to the Information Commissioner’s Office.

8. Notice Distribution Procedure

To ensure workforce transparency and operational compliance, follow these steps:

1. Audit physical and electronic storage locations (HR files, payroll systems, and digital drives) to catalogue all personal workforce data collected.
2. Verify monitoring activities. Update the policy to reflect active monitoring and delete non-applicable clauses.
3. Name active third-party payroll, pension, and software providers in organizational disclosures.
4. Align retention periods directly with the organisation’s formal data retention schedule.
5. Provide privacy disclosures to job candidates at the point of application.
6. Issue this Privacy Notice to new starters on or before their first day, alongside their written statement of employment particulars.
7. Maintain an administrative log confirming the date each person received the notice.

9. Review and Version Control

• Review this policy [Review Frequency, e.g. annually], or immediately after material changes to systems, data collection scope, or third-party processors.
• We will notify staff of any material updates to data processing practices.
• Policy Owner: [Role]
• Last Reviewed: [Date]