Employee privacy notice template (UK GDPR)
Also searched for as workforce privacy notice, staff privacy notice template UK, employee data protection notice.
UK GDPR requires you to tell the people whose personal data you hold what you hold, why, on what legal basis, who sees it, how long you keep it and what their rights are. For your workforce that is a privacy notice given to every employee, worker, contractor and job applicant at or before the point you collect their data. It is one of the few HR documents that is a straightforward legal requirement, and one of the most often missing.
This template is a plain-English workforce privacy notice under Articles 13 and 14, written so that people might actually read it, with the special category conditions for health and other sensitive data handled properly rather than waved at.
Why a separate notice for staff
The privacy notice on your website covers customers and visitors. Your staff are a different set of data subjects with different data: bank details, National Insurance numbers, right to work documents, sickness records, disciplinary files, GPS clock-in locations, occupational health reports. The lawful bases are different too: mostly contract, legal obligation and legitimate interests, almost never consent, because an employee cannot freely refuse their employer. Health and other special category data needs a condition under Article 9 as well, and an appropriate policy document under the Data Protection Act 2018.
What is in this template
- Who the controller is, the privacy contact and the data protection officer if you have one.
- Every category of workforce data with where it comes from: the person, referees, HMRC, the pension provider, monitoring systems.
- The lawful basis under Article 6 and, for special category data, the condition under Article 9, purpose by purpose.
- Who receives data: HMRC, pension scheme, payroll and HR software, occupational health, insurers, regulators, clients where site access requires it.
- International transfers and the safeguards used where a supplier stores data outside the UK.
- Retention periods aligned with ICO guidance and the statutory minimums for pay, tax, right to work and safety records.
- The eight data subject rights with their article references, and how to exercise them.
- How data is kept secure, how to complain, and the ICO's contact details.
How to use it
- Fill in the controller details and the retention table against your own retention schedule; the template gives the statutory floors.
- Add any monitoring you actually do: GPS clock-in, vehicle trackers, CCTV, email monitoring. Monitoring not described here is monitoring without notice.
- Give it to every existing employee now and to every new starter with the offer letter, and to applicants at the point they apply.
- Review it whenever you add a system that processes staff data or change a supplier. Work-Lynx holds the current version against each employee record.
Questions people ask
Is an employee privacy notice a legal requirement?
Yes. Articles 13 and 14 of UK GDPR require it for every individual whose personal data you process, and the ICO expects a specific workforce notice separate from your customer-facing one. Failing to provide one is a breach in itself.
Do I need consent to process staff data?
Almost never, and you should not rely on it. Consent an employee cannot freely refuse is not valid consent. Use contract, legal obligation and legitimate interests, and for health data the employment condition with an appropriate policy document.
Does GPS clock-in need to be in the notice?
Yes. Any location data you collect, when, why and for how long. Work-Lynx records location at the moment of clocking in and out, not continuously, and the notice should say exactly that.
How long do I keep staff records?
Different laws set different floors: six years for minimum wage records, three years after the tax year for PAYE and statutory payments, two years after leaving for right to work copies. Six years after leaving is the usual retention for the personnel file. The template carries a table you edit.
When you outgrow Word documents
Work-Lynx holds this and 48 other UK policies, records who has acknowledged each one, tracks holiday, absence and training, and answers the questions in between with Employ AI. £2.50 a month plus £1 per employee, 14 days free, no card. The template works without it.
Start free trial