YOUR WORKING OUTCOME
Follow the worker lifecycle and control who sees recruitment, pay, health and monitoring information.
Where to begin
Work through recruitment, employment, absence, performance, departure and post-employment retention. Bring HR, payroll, IT and the people who operate monitoring tools into the same review.
Employers, HR managers, payroll teams, recruitment leads and workplace-system owners.
Your first working session
Inventory the lifecycle
List the information collected at each employment stage and where it is copied or disclosed.
Bring back: A worker-information map with owners and repositories.
Review sensitive access
Check the actual permissions for absence, occupational health, adjustments and disciplinary records.
Bring back: A dated access review and a record of who needs each category.
List monitoring and automated tools
Include time recording, CCTV, productivity tools, recruitment scoring and any AI-assisted decisions.
Bring back: A change and monitoring register with screening owners.
Work through the evidence
Divide HR processing into real purposes
Separate recruitment decisions, pay, pensions, absence management, benefits, security and performance. Identify the information needed for each purpose and document the applicable basis and any extra sensitive-data condition.
Evidence: Forms, system fields, HR workflows, benefits disclosures and basis decisions.Your output: A lawful-basis register linked to the worker lifecycle.What useful evidence might look like
Illustrative: HR-02 separates statutory pay administration from an optional wellbeing survey.
ICO: current guide to lawful basis (opens in a new tab) · ICO: conditions for special-category processing (opens in a new tab)
Protect worker health information
Review who can access medical detail and whether managers can act using a narrower operational summary. Examine the circumstances before relying on consent, given the employment power imbalance. Record any required Schedule 1 safeguards and APD.
Evidence: Permission reports, occupational-health arrangements, purpose and necessity assessment.Your output: A documented access model and sensitive-data conditions record.What useful evidence might look like
Illustrative: ACCESS-08 records that a line manager receives adjustment requirements without unrestricted access to clinical reports.
ICO: conditions for special-category processing (opens in a new tab) · ICO: employment health-monitoring considerations (opens in a new tab)
Assess monitoring before deployment
Specify the monitoring purpose, alternatives, extent and effect on workers. Review fairness and transparency, screen for a DPIA and involve relevant stakeholders. Evaluate actual automated decision features and safeguards using the current legal framework.
Evidence: Monitoring specification, worker information, screening record and system settings.Your output: A reasoned deployment decision and a tested control list.What useful evidence might look like
Illustrative: MON-03 records why aggregate reporting was chosen over named-person activity tracking.
ICO: monitoring workers—purpose, proportionality and transparency (opens in a new tab) · ICO: when a DPIA is required (opens in a new tab) · ICO: current guide to lawful basis (opens in a new tab)
Control suppliers and workforce changes
Check payroll, recruitment, benefits and HR platform roles, contractual terms, support access and transfers. Test joiner, role-change and leaver permissions in each system, including shared folders and delegated mailboxes.
Evidence: Supplier pack, authorised-user sample, leaver checklist and transfer records.Your output: An owned supplier and access action list.What useful evidence might look like
Illustrative: LEAVER-05 records revocation from the HR platform and its separately managed reporting portal.
ICO: controller responsibilities when using a processor (opens in a new tab) · ICO: required processor contract terms (opens in a new tab) · ICO: international transfer test (opens in a new tab)
Prepare for access requests and disputes
Route requests from any channel promptly. Identify likely repositories and preserve relevant material. Review an employee request using a proportionate search and item-level third-party or exemption decisions; an employment dispute does not itself remove access rights.
Evidence: Request log, custodian list, search plan, redaction decisions and advice references.Your output: A sample response record with a defensible search and delivery check.What useful evidence might look like
Illustrative: SAR-09 records separate searches of payroll, case notes and relevant business messages.
ICO: guide to subject access (opens in a new tab) · ICO: third-party information in a subject access request (opens in a new tab) · ICO: data protection exemptions (opens in a new tab)
Close the retention and training loop
Give each recruitment and employment record class a justified trigger and period. Test deletion and holds across HR, payroll, email and supplier copies. Rehearse reporting a misdirected payslip or health attachment, then use the findings in role-specific training.
Evidence: Schedule, disposal evidence, legal-hold register, exercise and training records.Your output: A usable retention process and a tested HR incident route.What useful evidence might look like
Illustrative: EX-04 records that the payroll supplier's incident contact needed updating.
ICO: storage limitation (opens in a new tab) · ICO: personal data breaches guide (opens in a new tab)
Your completed starter pack
- Worker lifecycle ROPA and basis register
- Health-data conditions and access review
- Monitoring/DPIA decisions
- Supplier and leaver-control evidence
- Sample SAR search and redaction record
- Retention, hold and staff-training actions
When to escalate
- Treat proposed covert, intrusive or sensitive monitoring as a matter requiring careful specialist review before use.
- Keep normal management access to information proportionate to the role and purpose; seniority alone does not establish a need for unrestricted health detail.
- Manage the rights request and any employment dispute on their own applicable rules. Record the basis of each decision to disclose, redact, preserve or delete.
- Keep worker records out of the public-facing tools; use controlled evidence references.
Give the open actions an owner.
Use the assessment to organise your findings, then verify the underlying evidence before reporting assurance.
Start your reviewOfficial sources
- ICO: current guide to lawful basis (opens in a new tab)
- ICO: conditions for special-category processing (opens in a new tab)
- ICO: employment health-monitoring considerations (opens in a new tab)
- ICO: monitoring workers—purpose, proportionality and transparency (opens in a new tab)
- ICO: when a DPIA is required (opens in a new tab)
- ICO: controller responsibilities when using a processor (opens in a new tab)
- ICO: required processor contract terms (opens in a new tab)
- ICO: international transfer test (opens in a new tab)
- ICO: guide to subject access (opens in a new tab)
- ICO: third-party information in a subject access request (opens in a new tab)
- ICO: data protection exemptions (opens in a new tab)
- ICO: storage limitation (opens in a new tab)
- ICO: personal data breaches guide (opens in a new tab)