Module 9 · Data Protection Act, Chap. 22:04
Data Protection
Collecting, storing and sharing employee personal data responsibly.
The Data Protection Act sets out general privacy principles for handling personal information. Employers hold a great deal of it: contact details, NIS and tax numbers, medical notes, disciplinary records and bank details.
Good practice for employee data
- Collect only what you need and tell workers why
- Restrict access to HR and payroll staff
- Store medical and disciplinary records securely and separately
- Do not share data with third parties without a lawful reason
- Set retention periods and securely destroy old records
Related legislation
- Data Protection & Privacy policy template
Last reviewed: October 2026
General guidance only, not legal advice.