Data Protection Clauses in Employment Contracts

Employment contracts should address data protection obligations under UK GDPR and the Data Protection Act 2018.

Legal Framework

Key Principles

Employers must:

• Process data lawfully, fairly, and transparently
• Collect only necessary data
• Keep data accurate and up to date
• Retain data only as long as necessary
• Keep data secure
• Be accountable for compliance

Lawful Bases for Employment Data

Basis	When Used
Contract	Paying wages, administering benefits
Legal obligation	Tax, pension, right to work
Legitimate interests	Performance management, security
Consent	Rarely appropriate in employment

Contract Clause Elements

Basic Data Protection Clause

"The Company will process your personal data in accordance with its Data Protection Policy and Privacy Notice, which are available from HR. By entering into this contract, you acknowledge receipt of the Privacy Notice and understand how your data will be used."

Collection and Use

"The Company collects and processes personal data about you for purposes including:

• Administering your employment and benefits
• Paying your salary and complying with tax obligations
• Managing performance and conduct
• Ensuring workplace health and safety
• Complying with legal obligations"

Special Category Data

"Where necessary, the Company may process special category data (such as health information) for purposes including:

• Managing sickness absence
• Making reasonable adjustments for disability
• Complying with health and safety obligations
• Equal opportunities monitoring (on an anonymised basis)"

Employee Obligations

Duty to Provide Accurate Data

"You must provide accurate personal information when requested and notify the Company promptly of any changes to your personal details, including address, bank details, and emergency contacts."

Confidentiality of Data

"In the course of your employment, you may have access to personal data about colleagues, customers, or other individuals. You must:

• Keep such data confidential
• Only access data necessary for your role
• Comply with the Company's data protection policies
• Report any data breaches immediately"

Monitoring

Monitoring Clause

"The Company may monitor the use of its IT systems, including email, internet, and telephone, for legitimate business purposes including:

• Ensuring compliance with policies
• Investigating misconduct
• Detecting unauthorized use
• Protecting confidential information

You should not have any expectation of privacy when using Company systems."

Key Requirements

For lawful monitoring:

• Clear policy communicated to employees
• Legitimate purpose
• Proportionate to the aim
• As least intrusive as possible
• Regular review of necessity

Data Subject Rights

Employee Rights

Employees have the right to:

• Access their personal data (Subject Access Request)
• Rectification of inaccurate data
• Erasure in certain circumstances
• Restrict processing
• Data portability
• Object to processing

Contract Acknowledgment

"You have rights under data protection legislation including the right to access your personal data. Details of how to exercise these rights are in the Company's Privacy Notice."

Retention

Retention Clause

"The Company will retain your personal data during employment and for [6 years] after termination for purposes including responding to legal claims and providing references. Some data may be retained longer where required by law."

Typical Retention Periods

Data Type	Retention Period
Payroll records	6 years from end of tax year
Personnel files	6 years after leaving
Pension records	12 years after benefits cease
Accident records	3 years (40 years for serious incidents)
Recruitment records (unsuccessful)	6-12 months

Data Security

Employee Obligations

"You must:

• Keep passwords confidential
• Lock your computer when leaving your desk
• Not share confidential information via unsecured channels
• Follow the Company's information security policies
• Report any suspected data breaches immediately"

Breach Reporting

"If you become aware of any actual or suspected personal data breach, you must report it immediately to [IT / DPO / manager]. Failure to report a breach may result in disciplinary action."

International Transfers

If Applicable

"Your personal data may be transferred to and stored in countries outside the UK for purposes such as [global HR systems / group company administration]. Appropriate safeguards are in place for such transfers."

References

Providing References

"When providing references for former employees, the Company will only disclose factual information and will comply with data protection requirements."

Receiving References

"The Company may obtain references about you from previous employers. By providing referee details, you consent to us contacting them."

Privacy Notice

The contract clause should point to a separate, detailed privacy notice covering:

• Identity of data controller
• Contact details for DPO (if applicable)
• Categories of data processed
• Purposes and legal bases
• Recipients of data
• Retention periods
• Individual rights
• Complaints process