New data protection guidance on keeping employment records

The Information Commissioner’s Office (ICO) is producing topic-specific guidance on employment practices and data protection as part of its resources on the UK GDPR. The ICO published finalised guidance on monitoring workers and information about workers’ health in 2023 and then it issued for consultation draft guidance covering keeping employment records and recruitment and selection. Those consultations closed back in March 2024 and the ICO has now published finalised guidance on keeping employment records. The finalised guidance on recruitment and selection is still outstanding.

The guidance on keeping employment records will help you understand your data protection obligations when keeping employment records about your workers. It covers:

• collecting and keeping employment records, e.g. how can you lawfully keep records of workers’ personal information, what lawful bases might apply to employment records, what conditions might apply for keeping records of special category information and how much information can you hold
• using employment records, e.g. when can you share workers’ personal information with other people or organisations, what are your obligations if you have outsourced some of your processing about your workers, can you collect workers’ information to use for equal opportunity monitoring and what do you need to consider when providing references.

Each of these two subjects are dealt with through a Q&A format, with the answer also providing examples and further reading links.

The guidance additionally includes a series of short checklists covering collecting and keeping employment records, outsourced employment functions, equality monitoring, pension and insurance schemes and mergers and acquisitions.