Employee Privacy Policy

What is an employee privacy policy?

An employee privacy policy is a document that is used by an employer in the United Kingdom in order to notify its workforce of its data processing procedures.

Is it mandatory to have a privacy policy?

Yes. An employer has a duty to communicate information to employees regarding the use and processing of their personal data in a clear and accessible format. The simplest way to meet this requirement is to have a written policy document.

What is personal data?

Personal data means any information relating to an identified or identifiable natural person (a data subject). It is therefore information from which a person may be identified directly or indirectly. Examples of personal data include a person's:

• name
• address
• email address
• telephone number
• IP address
• health information
• criminal information

What are the prerequisites of a privacy policy?

If an employer formally recognises a trade union or staff association, they may wish to consult and agree on the terms of the policy with them. If a collective agreement is in place between the employer and the relevant union or association it may be a requirement to consult with them about the policy and/or agree upon the terms with them. A collective agreement is a written contract that is negotiated between a union and an employer on behalf of its union members.

What should be done after the privacy policy has been finalised?

It is not necessary to sign the privacy policy. Employees should be notified of the existence of the policy and it should placed in an easily accessible location so that employees can find it.

How long should a privacy policy last?

A privacy policy can remain in place indefinitely. However, it is important to make sure that the policy is reviewed and kept up to date, as appropriate.

In particular, an employer should ensure the policy is updated if it changes the way in which it collects, stores, shares or uses personal information. The employer should also ensure that the policy is generally updated and reviewed at regular intervals to ensure that the legal content is kept up-to-date. Typically, a policy of this nature will be reviewed at least annually.

What other documents might be used in conjunction with a privacy policy?

An employee may also hold other policy documents which should be read in conjunction with a privacy policy such as:

• a social media policy
• a code of conduct
• a grievance policy
• a disciplinary policy

What must a privacy policy contain?

A privacy policy will include information about:

• the employer – this will explain who the employer is
• the type(s) of personal data collected by the employer
• how the information is collected
• how the personal data is used
• the lawful basis relied upon for the data processing
• whether the information will be shared with any third parties
• how the information will be stored and for how long it will be stored
• information about employees' data protection rights, including how to make a complaint

What laws apply to a privacy policy?

The main legal provisions which apply to a privacy policy are:

• The Data Protection Act 2018
• The retained EU General Data Protection Regulation 2016/679 (UK GDPR). Article 12 explains how information should be provided to data subjects. Article 13 sets out the key rights of data subjects and the information they must be provided with.
• The governing/supervisory body for upholding data protection rights is the Information Commissioner's Office (the ICO).

Help from a lawyer

You can choose to consult a lawyer if you need help.

The lawyer can answer your questions or help you through the process. You will be offered this option when you complete the document.

How to modify the template?

You fill out a form. The document is created before your eyes as you respond to the questions.

At the end, you receive it in Word and PDF formats. You can modify it and reuse it.