UK GDPR for HR: fewer copies, clearer reasons.
Employee data is not ordinary admin. Know why you hold it, who can see it, how long it stays and how a person can exercise their rights.
How does UK GDPR apply to employee records?
UK GDPR applies to employee records because they identify people and can include special-category information such as health data. Employers need a lawful basis, clear purpose, appropriate access, security, retention and a way to handle data-rights requests.
Consent is often the wrong default in employment because the power relationship can make it difficult to regard as freely given.
What matters
Start with the rule
UK GDPR applies to employee records because they identify people and can include special-category information such as health data. Employers need a lawful basis, clear purpose, appropriate access, security, retention and a way to handle data-rights requests.
Write down the decision
Keep the policy, dates, calculation inputs and decision together so another person can understand what happened.
Check the current source
The lawful basis and retention answer depends on the record and context. Use the ICO's employment-practices guidance and obtain advice for complex monitoring or special-category processing.
A practical checklist
For a small team, a short repeatable process beats an impressive policy nobody follows.
- Inventory the employee data you actually hold
- Name the purpose and lawful basis
- Restrict health, pay and identity evidence more tightly
- Set and follow retention rules
- Document processors and international transfers
- Test DSAR, correction and erasure routes before a request arrives
Where software helps — and where it does not
HollyHR can keep the relevant people record, dates, documents, leave and working pattern in one place. It cannot decide a legal, medical or employee-relations question for you.
The lawful basis and retention answer depends on the record and context. Use the ICO's employment-practices guidance and obtain advice for complex monitoring or special-category processing.
Check the source, not just our summary
Rules and product pages change. These are the first-party references behind this page.
Questions people ask
Is this legal advice?
No. It is a practical summary for UK small teams. Check the linked official guidance and take qualified advice for a specific or disputed case.
Why keep the source with the calculation?
Rates and rules change. Recording the inputs, date and source makes the answer reviewable instead of becoming an unexplained number in a spreadsheet.
Can HollyHR track this?
HollyHR can hold the underlying employee, working-pattern, leave and document records. It does not present itself as a legal-advice engine.
Proper HR, without the big-system palaver.
HollyHR is free for up to 10 active people. We're onboarding early-access teams one at a time.
Keep reading: Security at HollyHR · Privacy policy · DSAR meaning