GDPR basics for HR teams in the UK

What GDPR means for employee data in a small business

GDPR applies to the personal data you hold about employees, workers, candidates, contractors, and sometimes former staff. In HR, this can include names, addresses, dates of birth, emergency contacts, bank details, performance notes, absence records, appraisal forms, right to work information, and payroll data.

It also covers digital and paper records. If a document or system can identify a person directly or indirectly, it is likely to count as personal data. For many SME owners, the key point is simple: if the information relates to someone in your team, treat it carefully and only use it for a clear business reason.

• Employee contact details and next-of-kin information
• Contracts, job offers, and onboarding forms
• Attendance, sickness, holiday, and payroll records
• Performance notes, grievances, and disciplinary files
• Medical information, DBS records, and other sensitive HR data

The key GDPR principles HR teams need to follow

UK GDPR is built around a few core principles that should guide how you collect, store, share, and delete employee data. You do not need to become a data protection expert, but you do need a consistent process that fits the way your business works.

These principles are especially important in HR because people data is often sensitive, widely shared, and kept for long periods. A good starting point is to make sure every record has a purpose, every access point is controlled, and every retention period is documented. If you want a broader view of what small businesses should already have in place, our HR compliance checklist for UK small businesses is a useful companion read.

• Lawfulness, fairness, and transparency
• Purpose limitation: use data for clear HR reasons only
• Data minimisation: collect only what you need
• Accuracy: keep records up to date
• Storage limitation: do not keep data longer than necessary
• Integrity and confidentiality: protect data from loss, misuse, or unauthorised access

Lawful bases for processing employee data

Under GDPR, you need a lawful basis to process employee personal data. In an HR setting, this is often one of the following: performance of a contract, legal obligation, legitimate interests, or consent in limited situations. The right basis depends on what you are doing with the data.

For example, you will usually process payroll data because you need it to perform the employment contract and meet legal duties. You may keep sickness records because you need them for HR management and statutory obligations. Consent is often a weak basis in employment because employees may not feel free to refuse, so it should not be your default choice.

Special category data and criminal records data need extra care. Special category data includes health information, ethnicity, trade union membership, religion, and biometric data. In HR, this often appears in absence management, reasonable adjustments, occupational health notes, or equality monitoring. Criminal records data may arise during vetting or screening and should be handled with particular caution. If you are reviewing contracts and starter paperwork at the same time, our contract of employment checklist UK guide can help you make sure the core documents are joined up.

• Contractual necessity for pay, benefits, and employment administration
• Legal obligation for tax, right to work, and employment records
• Legitimate interests for many day-to-day HR and management tasks
• Consent only where it is genuinely appropriate and freely given
• Extra safeguards for health data, diversity data, and other special category information

Common HR data risks in everyday people management

The biggest GDPR issues in small businesses usually come from routine habits rather than major incidents. For example, sending confidential HR information to the wrong person, sharing more detail than necessary in a team email, or keeping old personnel files indefinitely can all create avoidable risk.

Other common problems include weak password practices, unclear access rights, storing employee information across too many spreadsheets, and using personal email accounts for work-related HR files. These are easy mistakes to make when there is no in-house HR function, which is why simple rules and consistent ownership matter.

It is also worth checking how new starter data is collected. If onboarding forms ask for too much information too early, or if sensitive data is stored before there is a clear reason to keep it, your process may need tightening. A well-structured onboarding process and clear records can reduce these risks quickly.

• Accidentally sharing sensitive employee data by email or message
• Using outdated spreadsheets or duplicate records
• Keeping personnel files with no retention schedule
• Collecting more data than the business actually needs
• Not limiting access to HR files and systems
• Lack of clarity about who updates, reviews, and deletes records

HR documents, policies, and records that support compliance

You do not need a huge policy library to manage HR data well, but you do need the right basics. A clear privacy notice for employees, a data retention schedule, and a simple process for handling subject access requests will go a long way. So will good onboarding documents, secure storage, and defined approval routes for sensitive information.

This is where many small businesses benefit from a practical review of their HR paperwork. Our employee handbook checklist UK article shows how policies and handbook content support day-to-day consistency, while our guide on what HR policies a small business needs helps you focus on the essentials rather than overcomplicating things.

At a minimum, it helps to have a documented process for collecting employee data, a privacy notice, a retention and deletion approach, access controls for HR files, and a record of who is responsible for HR administration. If you are still building your people processes, these documents can sit alongside your contract templates, handbook, and onboarding steps.

• Employee privacy notice
• Retention schedule for HR records
• Data breach reporting process
• Subject access request process
• Access controls for HR systems and files
• HR handbook or policies covering confidentiality and data handling

When to get help with HR data protection and compliance

If your business is growing, onboarding more people, or handling sensitive employee issues, it can be difficult to keep HR data management tidy while also running the company. That is usually the point where outside support becomes valuable. A good HR partner can help you review documents, simplify processes, and put sensible controls in place without making the business feel overburdened.

Flora HR works with UK small businesses that need practical, plain-English help with outsourced HR support, HR consultancy, and HR documentation. If you want support setting up your records, policies, and day-to-day people processes, you can explore Flora HR's HR services or contact Flora HR for straightforward advice. The aim is to make compliance feel manageable, not overwhelming.