What an employee privacy notice must cover
- Who you are and how to contact you about data protection (and your data protection officer, if you have one)1.
- What personal data you hold, including special category data such as health records.
- Why you hold it, purpose by purpose, and the lawful basis for each1.
- Who you share it with: HMRC, your payroll provider, pension scheme, accountant.
- Any transfer outside the UK and the safeguard used.
- How long you keep it, or how you decide1.
- Their rights: access, correction, erasure, restriction, objection and portability, and their right to complain to the ICO1.
- Whether giving the data is a legal or contractual requirement, and what happens if they don't1.
Lawful bases for employee data
| Purpose | Usual lawful basis |
|---|---|
| Paying them, providing benefits, managing their work | Contract |
| PAYE, right to work, auto-enrolment, statutory pay, health and safety | Legal obligation |
| Performance management, records, protecting systems and property | Legitimate interests |
Don't ask staff to "consent" to the notice. Consent has to be freely given and the imbalance between employer and employee makes that hard to show. You're informing them, not asking permission: record the date you gave it to them rather than asking for a signature of agreement.
Health data (for example sick notes used to pay sick pay) is special category data. It needs an extra condition, usually your obligations in employment law, and the ICO expects a short appropriate policy document for it.
New since 19 June 2026: complaints come to you first
Under the Data (Use and Access) Act 2025, people can complain to you about how you use their data. You must make it easy to complain, for example with a complaint form, acknowledge each complaint within 30 days, look into it, and tell them the outcome without undue delay3. The template below includes this.
How long to keep employee records
| Record | Keep for |
|---|---|
| Payroll (PAYE) records | At least 3 years after the end of the tax year they relate to |
| Right to work copies | The employment plus 2 years after it ends |
| Personnel file | Your choice; many employers use 6 years after employment ends, matching the time limit for contract claims |
Sources: payroll records4; right to work5. Whatever periods you choose, state them in the notice and apply them.
Free employee privacy notice template
Copy this into your own document, replace everything in [square brackets] and delete what doesn't apply. Give it with the contract, then record the date you gave it.
[Business name] privacy notice for staff Last updated: [date] This notice explains what personal information we hold about you, why, and your rights. We are the controller of this information. Contact us about anything in this notice at [email address or contact form], or write to [address]. [If you have one: our data protection officer is [name, contact].] What we hold During your employment we collect and hold: - your name, address, contact details, date of birth and National Insurance number; - bank details, pay, pension contributions, tax code and student loan information; - right to work documents and immigration status; - emergency contact details you give us; - employment records: contract, role, hours, absence, holiday, reviews, and any disciplinary or grievance matters; - health information, where needed to pay sick pay, consider adjustments or meet health and safety duties; - [CCTV, vehicle tracking, IT and email monitoring records, or anything else specific to your business; delete if not applicable]. Why we hold it, and our lawful basis - To perform your contract: paying you, providing benefits, managing your work. Basis: contract. - To meet legal duties: PAYE, right to work checks, pension auto-enrolment, statutory pay, health and safety. Basis: legal obligation. - To run the business properly: managing performance, keeping records, protecting our property and systems. Basis: our legitimate interests in operating and safeguarding the business. - Health information is also processed because it is necessary for our obligations and rights in employment law and, where relevant, to assess your fitness to work. Who we share it with Only where needed: HM Revenue and Customs and other public bodies where the law requires it; our payroll provider [name]; our pension scheme [name]; our accountant [name]; [any other service provider, such as an HR system or occupational health]. Transfers We do not transfer your information outside the UK [or: we use [provider] in [country], protected by [safeguard]]. How long we keep it Personnel records: [six] years after your employment ends. Payroll records: at least three years after the end of the tax year they relate to. Right to work copies: for your employment and two years after it ends. [Other periods, for example CCTV: 30 days.] We then delete or securely destroy the information. Your rights You can ask us to: - give you a copy of the information we hold about you; - correct information that is wrong or incomplete; - delete information where there is no good reason to keep it; - restrict how we use it while a concern is resolved; - stop using it where we rely on legitimate interests, unless we have compelling grounds; - transfer information you gave us to you or another organisation. Some rights are limited where we have a legal duty to keep information; if so we will explain. To make a request, contact [name or role, and contact details]. We will respond within one month. Complaints If you are unhappy with how we use your information, please tell [name or role] at [contact], or use our complaint form at [where to find it]. We will acknowledge your complaint within 30 days, look into it, and tell you the outcome. You also have the right to complain to the UK data protection regulator, the ICO: ico.org.uk, 0303 123 1113. If you don't give us information Some information is needed to meet legal duties or perform your contract. Without it we may not be able to pay you correctly, enrol you in the pension scheme, or, for right to work, continue to employ you. We will tell you at the time. Automated decisions We do not make decisions about you by automated means alone. [Amend if you do.] Changes We will tell you if this notice changes in a way that affects you.
This template is Form 6 of the New Starter Pack, where it sits with the other day-one paperwork and an issue log for recording the date you gave it.
Also check
- Whether you need to pay the ICO data protection fee6.
- If you monitor staff (CCTV, email, vehicle tracking), tell them specifically and read the ICO's monitoring guidance before you start.