Following Brexit, data processing provisions in the UK have changed. The UK GDPR regime consists of retained provisions from the EU General Data Protection Regulation and the Data Protection Act 2018. If you are processing personal data of your employees, your employees have a right to be informed under the UK GDPR regime and you should update your privacy notices to reflect this change. To comply with these provisions, you should have provided your employees with a Privacy Notice. We also recommend you providing a Privacy Notice to job applicants and interviewees even if they are unsuccessful in their application as you will be processing their personal data.

Under the UK GDPR regime, your Privacy Notice should contain specific information about the processing of personal data, including the purposes for which you are processing it, who you will be sharing the data with, and how long it will be kept for. Your Privacy Notice should be concise, transparent and easily accessible for your employees, in addition to being clear and in plain language. Your Privacy Notice will also need to state the legal basis for processing the data of your employees and your employees’ rights in connection with this.

You should review your Privacy Notice regularly to ensure that this is up to date to comply with the legislation. The Data Protection Act came into force in 2018, and if you have not updated or reviewed your Privacy Notice since then, we recommend that you do so. In addition to checking that your Privacy Notice is legally compliant, you will also need to update your Privacy Notice if you have changed the way in which you process data received from your employees, or the information that you process.

If you think you need to update your Privacy Notice or require any guidance on complying with the legal requirements, please do get in touch with one of the Employment Team.