make your free employee privacy notice
what we'll cover
what is an employee privacy notice?
an employee privacy notice explains to staff the ‘what, how, where, why and when?’ of how a data controller (ie the employer) processes (eg collects and stores) staff personal data (eg contact details and medical information). in other words, employee privacy notices are statements detailing how employers collect, use, retain and disclose staff personal information.
this document is gdpr compliant.
when should i use an employee privacy notice?
use this employee privacy notice:
-
if you employ staff and are based in england, wales or scotland
-
to inform staff about your use of their personal data
-
to help comply with your duty to protect the security of staff personal data
sample employee privacy notice
the terms in your document will update based on the information you provide
about employee privacy notices
learn more about making your employee privacy notice
-
how to make an employee privacy notice
making an employee privacy notice online is simple. just answer a few questions and 2022世界杯32强抽签时间 will build your document for you. when you have all of the details prepared in advance, making your document is a quick and easy process.
to make your employee privacy notice you will need the following information:
employer details
-
what is the name of the employer’s business?
-
what email address should employees contact about their data rights?
data transfers
-
will personal data be transferred outside of the uk and the european economic area (eea)?
data retention
-
is information on how data is stored securely set out in:
-
can a copy of the relevant policy be obtained from the employer (eg from the dpo or hr manager) and/or online? if the policy is available online, what is its url?
-
-
common terms in an employee privacy notice
employee privacy notices help employers comply with their legal obligation to inform staff about how they collect, use, retain and disclose staff personal data. to do this, the privacy notice template covers:
statement and purpose of notice
the start of the notice sets out why the employer is adopting the employee privacy notice and explains the employer’s commitment to transparency when processing staff personal data.
what information do we collect?
this section covers the types of personal data the employer collects. as various types of personal data may be collected, this section provides examples, including staff member names and addresses, bank account details and information about nationalities and entitlements to work in the uk.
this section also explains that these types of personal data may be collected and stored in various ways, providing examples.
why do we process personal data?
this section explains the reasons for processing the personal data. the reasons are set out in a simple, easy-to-understand manner so that staff members can easily understand why their employer is processing their personal data.
who has access to data?
this section explains that staff members’ personal data will be shared internally. it also details when personal data may be shared with and disclosed to third parties and why.
choice
this section clarifies that the employer doesn’t currently share staff personal data with third parties other than service providers who act on the employer’s behalf. it also explains that, if the employer decides to share staff personal data with any other third parties, staff members will be given a choice regarding this disclosure. in other words, the employee can opt out of having their personal data shared with such third parties.
transfers outside the united kingdom and european economic area (eea)
this section is only included in the employee privacy notice if staff members’ personal data will be transferred outside the uk and eea. if this is the case, this section sets out the safeguarding requirements that the employer must have in place and comply with for such international transfers.
how do we protect data?
this section explains that the employer takes the security of personal data seriously and details the relevant security measures (including data protection policies) that are in place. this also extends to how data security and protection are ensured when third parties are engaged to process personal data on the employer’s behalf.
for how long do we keep data?
this section sets out the time periods the employer will keep staff members’ personal data for. this will always be at least for the duration of their employment. for any post-employment data retention periods, this section encourages staff members to check the relevant data protection policies.
your rights
this section details staff members’ data protection rights (ie the rights they have in relation to their personal data). it also provides the details of the person staff members should contact if they wish to exercise their data protection rights.
complaint resolution
this section covers how staff members can raise a complaint about their employer’s processing of their personal data. while this includes complaining directly to the ico, the employee privacy notice encourages staff members to first attempt to resolve issues internally with the employer.
what if you do not provide personal data?
this section explains that staff members have to provide their employer with certain information under their employment contract. it clarifies that without this information the employer won’t be able to properly manage and administer staff member engagements.
changes to this privacy notice
this section explains that the employee privacy notice can be changed by the employer whenever it is considered necessary. it also clarifies that staff members will be provided with an updated copy of the employee privacy notice in due course.
if you want your employee privacy notice to include further or more detailed provisions, you can edit your document. however, if you do this, you may want a lawyer to review or change the privacy notice for you, to make sure it complies with all relevant laws and meets your specific needs. ask a lawyer for assistance.
-
legal tips for making an employee privacy notice
ensure that you have a legal basis for processing personal data
whenever you process personal data, you must have a legal ground for doing so. the data protection act 2018 sets out specific legal bases for data processing. examples include data processing in compliance with a legal obligation, data processing with the consent of the data subject (ie the person to whom the data relates, like a member of staff), or the employer having a legitimate interest in the processing.
follows all relevant data protection obligations and procedures
informing your staff members how you will be processing their personal data using an employee privacy notice is just one part of meeting your data protection obligations as an employer and as a business. not only do you need to make sure that you actually implement your employee privacy notice and comply with the information set out in it, you also need to consider what further steps you need to take. this may involve adopting further policies or procedures (more on this below) and making sure they are implemented and followed, or changing internal processes within your business.
for more information, read data protection, data protection for businesses and data protection and employees. if you need help with data protection compliance, seek gdpr compliance advice.
determine which additional data protection documents you should adopt
data protection compliance is a crucial aspect of running a business. to ensure that you comply with all relevant data protection laws, you should consider adopting various further documents to bolster data protection compliance. examples include:
-
data protection and data security policies - to notify staff and clients about how you process their personal data and otherwise comply with data protection obligations. employee privacy notices act as simplified versions of data protection policies
-
consultant privacy notices - these are similar to employee privacy notices but apply consultants instead of employees and workers
-
privacy policies - used to inform website users about the types of personal data website owners collect, the reasons for collection and how such data can be accessed
-
data protection impact assessments (dpias) - dpias must be carried out whenever any personal data processing is likely to result in a high risk to individuals’ rights and freedoms
-
data processing agreements (dpas) - if data controllers (ie the parties who control how data is processed) transfer personal data to third parties (ie data processors) for them to process the data on behalf of the data controllers (eg cloud storage service providers)
follow our how to make a business gdpr-compliant checklist to ensure your business meets its data protection obligations and read data protection for businesses for more information.
understand when to seek advice from a lawyer
ask a lawyer for:
-
advice on the use of covert monitoring in the workplace
-
advice when the employer's use of staff data may infringe on staff members’ rights to privacy or relates to information about what staff members do outside work
-
help changing an existing employee privacy notice
-
assistance if this document doesn’t meet your needs
-
employee privacy notice faqs
-
what is included in an employee privacy notice?
this employee privacy notice template covers:
-
employer details
-
the types of staff personal data collected by the employer
-
the purposes for processing the personal data
-
the uses the employer makes of staff personal data
-
who has access to staff personal data
-
transfers of data outside of the uk or european economic area (eea)
-
measures to protect the security of personal data
-
staff members’ rights relating to their personal data
-
-
why do i need an employee privacy notice?
the uk general data protection regulation (gdpr) and data protection act 2018 (dpa) require employers to be transparent and open about the information they collect from staff. employers should tell staff the types of data they might collect about them and what they do with it. an employee privacy notice can be used to do this. for more information, read data protection and employees.
-
how do i implement an employee privacy notice?
creating an employee privacy notice and making sure it is readily available for staff will enable the notice to be incorporated into your business. it should be readily available to staff to provide them with an overview of the personal data collected, used, retained and disclosed by their employer.
you can also include it in your employee handbook for staff to read.
it is also crucial that your staff members know to whom to address any questions or concerns about personal data processing. this person (eg a data protection officer (dpo)) should be clearly identified in your employee privacy notice.
-
how long can staff personal data be stored?
the gdpr and dpa don’t set out minimum or maximum time limits for keeping staff data; however, employers should not keep personal data for longer than necessary. staff personal data can generally be stored for the duration of employment. after employment ends, staff personal data should be retained for no longer than necessary, based on the individual circumstances of the situation.
data retention periods should be set out by the employer in internal policies (eg a data retention policy).
for more information, read data retention and document destruction and data protection principles.
-
can data be transferred outside of the uk or european economic area (eea)?
the transfer of personal data to recipients outside of the uk (ie recipients in 'third countries') is prohibited under the law on data protection unless certain safeguards are in place. an international transfer of personal data may, for example, be permitted:
-
if the third country the recipient is in has an adequate level of data protection, as determined by the information commissioner's office (ico). this includes the eea
-
on the basis of standard data protection clauses approved by the uk
for more information, read international transfers of personal data.
-
-
what rights do staff members have in relation to their personal data?
staff members have certain rights relating to personal data held about them, including:
-
the right to access their data and be informed about how their data is being processed
-
the right to have their data rectified if it's inaccurate or incomplete
-
the right to object to the processing
-
the right to have their data erased in certain circumstances
for more information, read data protection requests and data protection and privacy.
-
our quality guarantee
we guarantee our service is safe and secure, and that properly signed 2022世界杯32强抽签时间 documents are legally enforceable under uk laws.
need help? no problem!
ask a question for free or get affordable legal advice from our lawyer.