---
title: "HR Data Protection: Hidden Compliance Risks | Trust Keith"
description: HR handles your most sensitive data. Learn how to get lawful bases, special category data, employee DSARs, suppliers and retention right under UK GDPR.
image: https://resources.trustkeith.co/hubfs/Resources%20Card%20template%2c%20Guides%20(59)-1.png
---

[![642bcbad7735490755580d8d\_trust-keith-logo](https://resources.trustkeith.co/hubfs/642bcbad7735490755580d8d_trust-keith-logo.svg "642bcbad7735490755580d8d_trust-keith-logo")](https://www.trustkeith.co/)

- Product 
    - [Privacy OS](https://www.trustkeith.co/product/privacy-os)
    - [Dedicated DPO](https://www.trustkeith.co/product/dedicated-dpo)
    - [Automated Data Discovery](https://www.trustkeith.co/product/automated-data-discovery)
    - [Intelligent Workflows](https://www.trustkeith.co/product/intelligent-workflows)
    - [Staff Training](https://www.trustkeith.co/product/staff-training)
    - [Global Risks & Controls](https://www.trustkeith.co/product/global-risks-controls)
    - [Proportional Policies](https://www.trustkeith.co/product/proportional-policies)
    - [Monitoring & Reporting](https://www.trustkeith.co/product/monitoring-reporting)
- Solutions 
    - [By Industry](https://www.trustkeith.co/solutions/industry)
    - [By Team](https://www.trustkeith.co/solutions/team)
    - [By Use Case](https://www.trustkeith.co/solutions/use-case)
    - [By Privacy Regulation](https://www.trustkeith.co/solutions/regulations)
- [How it works](https://www.trustkeith.co/how-it-works)
- [Customers](https://www.trustkeith.co/customers)
- [Pricing](https://www.trustkeith.co/pricing)
- [Resources](https://resources.trustkeith.co)
- [Company](https://www.trustkeith.co/company)

[![Talk to an expert](https://hubspot-no-cache-eu1-prod.s3.amazonaws.com/cta/default/24879685/859c2149-73c5-4ae5-a465-6c639d24614f.png)](https://hubspot-cta-redirect-eu1-prod.s3.amazonaws.com/cta/redirect/24879685/859c2149-73c5-4ae5-a465-6c639d24614f)

[![Trust Keith](https://resources.trustkeith.co/hs-fs/hubfs/raw_assets/public/Trustkeith_March2023/images/trust_keith.png?width=500&name=trust_keith.png "Trust Keith")](https://www.trustkeith.co/)

- Product 
    - [Privacy OS](https://www.trustkeith.co/product/privacy-os)
    - [Dedicated DPO](https://www.trustkeith.co/product/dedicated-dpo)
    - [Automated Data Discovery](https://www.trustkeith.co/product/automated-data-discovery)
    - [Intelligent Workflows](https://www.trustkeith.co/product/intelligent-workflows)
    - [Staff Training](https://www.trustkeith.co/product/staff-training)
    - [Global Risks & Controls](https://www.trustkeith.co/product/global-risks-controls)
    - [Proportional Policies](https://www.trustkeith.co/product/proportional-policies)
    - [Monitoring & Reporting](https://www.trustkeith.co/product/monitoring-reporting)
- Solutions 
    - [By Industry](https://www.trustkeith.co/solutions/industry)
    - [By Team](https://www.trustkeith.co/solutions/team)
    - [By Use Case](https://www.trustkeith.co/solutions/use-case)
    - [By Privacy Regulation](https://www.trustkeith.co/solutions/regulations)
- [How it works](https://www.trustkeith.co/how-it-works)
- [Customers](https://www.trustkeith.co/customers)
- [Pricing](https://www.trustkeith.co/pricing)
- [Resources](https://resources.trustkeith.co)
- [Company](https://www.trustkeith.co/company)

[![Talk to an expert](https://hubspot-no-cache-eu1-prod.s3.amazonaws.com/cta/default/24879685/859c2149-73c5-4ae5-a465-6c639d24614f.png)](https://hubspot-cta-redirect-eu1-prod.s3.amazonaws.com/cta/redirect/24879685/859c2149-73c5-4ae5-a465-6c639d24614f)

[![Talk to an expert](https://hubspot-no-cache-eu1-prod.s3.amazonaws.com/cta/default/24879685/859c2149-73c5-4ae5-a465-6c639d24614f.png)](https://hubspot-cta-redirect-eu1-prod.s3.amazonaws.com/cta/redirect/24879685/859c2149-73c5-4ae5-a465-6c639d24614f)

![Menu Icon](https://resources.trustkeith.co/hubfs/raw_assets/public/Trustkeith_March2023/images/icon-menu.svg) ![Menu close](https://resources.trustkeith.co/hubfs/raw_assets/public/Trustkeith_March2023/images/icon-x.svg)

![](https://resources.trustkeith.co/hubfs/Resources%20Card%20template%2c%20Guides%20(59)-1.png)

# Data Protection for HR Teams: The Hidden Compliance Risks You Might Be Missing

 Published by [Trust Keith](https://resources.trustkeith.co/author/trust-keith) on  Oct 23, 2026, 4:28:44 PM

**Quick answer:** HR is one of the highest-risk functions for data protection because it handles the most sensitive information about the most people, every single day. The biggest compliance risks are special category data, shaky lawful basis choices, slow employee subject access requests, loose supplier arrangements and records kept for far too long. Get those five right and most of your HR data protection risk goes with them.

**Contents**

- •  [Why HR Is One of the Highest-Risk Functions](https://resources.trustkeith.co/hr-data-protection-hidden-compliance-risks-trust-keith#why-hr-is-one-of-the-highest-risk-functions)
- •  [What Personal Data HR Teams Typically Process](https://resources.trustkeith.co/hr-data-protection-hidden-compliance-risks-trust-keith#what-personal-data-hr-teams-typically-process)
- •  [Lawful Bases HR Can Rely On (and the One It Shouldn't)](https://resources.trustkeith.co/hr-data-protection-hidden-compliance-risks-trust-keith#lawful-bases-hr-can-rely-on)
- •  [Special Category Data in HR](https://resources.trustkeith.co/hr-data-protection-hidden-compliance-risks-trust-keith#special-category-data-in-hr)
- •  [Employee Subject Access Requests (DSARs)](https://resources.trustkeith.co/hr-data-protection-hidden-compliance-risks-trust-keith#employee-subject-access-requests)
- •  [Third-Party HR Tools, Data Sharing and Retention](https://resources.trustkeith.co/hr-data-protection-hidden-compliance-risks-trust-keith#third-party-hr-tools-and-retention)
- •  [Common HR Data Breaches and How to Prevent Them](https://resources.trustkeith.co/hr-data-protection-hidden-compliance-risks-trust-keith#common-hr-data-breaches-and-how-to-prevent-them)
- •  [Frequently Asked Questions](https://resources.trustkeith.co/hr-data-protection-hidden-compliance-risks-trust-keith#faq)

---

## **Why HR Is One of the Highest-Risk Functions**

Quick test. Which team in your business knows the most private things about the most people?

It's HR. Salaries, sick notes, disciplinary history, bank details, next of kin. All sitting in one place.

That's what makes HR data protection different from, say, marketing data. The information is more sensitive. The people it's about (your own employees) see you every day and know exactly who to ask when something goes wrong. And they have rights under UK GDPR that they're increasingly happy to use.

Growth makes it harder. What worked at 30 people rarely survives the jump to 150. A handful of systems and a tidy set of folders can be perfectly manageable at that size. Now there are more systems, more inboxes and more people with access.

The good news? HR compliance isn't mysterious. It comes down to a handful of areas, and we'll take them in turn.

---

## **What Personal Data HR Teams Typically Process**

“HR data” covers a lot more than payroll and contracts. You've got:

- **Recruitment data**: CVs, cover letters, interview notes, right to work checks, references and assessment scores, including from candidates you never hired.
- **Employment records**: contracts, job history, performance reviews, training records, grievances and disciplinary files.
- **Payroll and benefits data**: bank details, tax codes, pension information, salary, expenses and bonus data.
- **Absence and wellbeing data**: sickness records, fit notes, occupational health reports, adjustments and parental leave.
- **Monitoring data**: system logs, badge access, device usage and, in some businesses, CCTV or productivity tracking.
- **Leaver data**: exit interviews, final pay, references and anything you're holding "just in case".

Notice how much of that is also about other people. Emergency contacts, dependants, referees. They're data subjects too, and they've never heard of you.

If you haven't mapped all this, start there. A proper record of processing tells you what you hold, why, where it lives and who sees it. Everything else in this post gets easier once that exists.

[![Trust Keith Office Hours](https://resources.trustkeith.co/hs-fs/hubfs/Blog%20Banners%20(21).png?width=2048&height=400&name=Blog%20Banners%20(21).png)](https://resources.trustkeith.co/office-hours)

---

## **Lawful Bases HR Can Rely On (and the One It Shouldn't)**

So, which lawful basis covers all this? Short answer: usually not the one people reach for first.

Most HR processing sits comfortably under one of three bases:

- **Contract**: paying people, managing their employment terms, providing agreed benefits. This covers the bread and butter.
- **Legal obligation**: right to work checks, tax reporting, health and safety records, statutory sick pay.
- **Legitimate interests**: things like internal reporting, security monitoring or investigating misconduct, as long as you've done and documented the balancing test.

Now the one it shouldn't lean on. Consent.

It feels like the safe, friendly option. It isn't. Consent has to be freely given, and when the person asking is the one who signs your pay cheque, that's hard to argue. Employees can't really say no. If you can't offer a genuine choice, and a way to withdraw without consequences, consent probably isn't valid.

There are sensible exceptions, such as an optional wellbeing programme or a photo for the company website. But if consent is the backbone of how HR processes data, that's worth a second look.

Whatever you pick, write it down, and make sure it matches what your privacy notice for staff says. Mismatches between the two are one of the first things people spot.

---

## **Special Category Data in HR**

This is where HR gets a bit spicy.

Health information, trade union membership, ethnicity, religion, sexual orientation. UK GDPR calls these "special category" data, and [Article 9](https://gdpr-info.eu/art-9-gdpr/) says you can't process them unless you've got both a normal lawful basis and a separate Article 9 condition. For HR, the usual condition is employment, social security and social protection law, which in practice sits alongside the Data Protection Act 2018.

In practice, HR touches this data constantly:

- **Sickness and fit notes**, plus occupational health reports.
- **Diversity and inclusion monitoring**, which includes ethnicity, disability and sexual orientation.
- **Criminal record checks**, which have their own extra rules and need a specific condition on top.
- **Union membership**, often visible via payroll deductions.

Three habits help a lot. First, collect less. Do you need the diagnosis, or just the fact that someone's unwell and for how long? Second, restrict access tightly, so a line manager doesn't see more than they need. Third, keep an appropriate policy document where the law requires one.

It's worth saying plainly: a casual "just so you know, she's off with a health thing" in a team chat is a data protection problem. Small habits, big consequences.

---

## **Employee Subject Access Requests (DSARs)**

Here's the one that catches HR out most often. An employee, or an ex-employee, asks for a copy of everything you hold on them.

It's often not a friendly curiosity request, either. Subject access requests regularly land in the middle of a grievance, a dismissal or a settlement negotiation. The person asking knows what they're looking for, and the clock is already ticking.

The [ICO's guide to subject access](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/subject-access-requests/a-guide-to-subject-access/) is clear that you generally have one month to respond. That's one month from receipt, not from when someone in HR finally spots it. Requests can arrive by email, in a Slack message, or in the middle of an exit interview. They don't need a special form or magic words.

What makes these hard is the scatter. Relevant data may sit in:

- HR systems and payroll
- Email inboxes and chat threads, including managers' notes about the person
- Performance and investigation documents
- Third-party platforms run by your suppliers

Prepare before the first one lands. Agree who owns the process, how requests get logged, where you'll search, and how you'll handle other people's data in the same documents (redaction, in other words). A simple, rehearsed process beats a heroic scramble every time.

[![Trust Keith Resources](https://resources.trustkeith.co/hs-fs/hubfs/Blog%20Banners%20(12).png?width=3584&height=700&name=Blog%20Banners%20(12).png)](https://www.trustkeith.co/resources)

---

## **Third-Party HR Tools, Data Sharing and Retention**

### **Your HR tech stack is a data-sharing arrangement**

Every HR tool you plug in is another organisation handling your employees' data. Payroll provider, recruitment platform, benefits portal, e-signature tool, background check service. Most of them act as your processor.

That matters because [Article 28](https://gdpr-info.eu/art-28-gdpr/) requires a written contract with each processor, covering what they can do with the data, what security they must maintain, and what happens when the relationship ends. "We clicked accept on the terms" is rarely enough.

Ask a few boring but useful questions before you buy anything new. Where's the data hosted? Does it leave the UK? Who are the sub-processors? Can you export and delete records easily? And has someone checked whether a data protection impact assessment is needed, especially for monitoring or automated screening tools?

### **Retention: the risk sitting in every HR folder**

Nobody sets out to hoard employee data, it just piles up.

UK GDPR says you shouldn't keep personal data longer than you need it. There's no single magic number for HR, because different records have different reasons for being kept. Payroll and tax records follow statutory rules. Unsuccessful candidate data should go much sooner than employee files. Disciplinary records often have a set life after they've been spent.

The fix is a retention schedule that says, record type by record type, how long you keep it and why. Then actually delete things. Set a reminder, automate it where your systems allow, and treat leaver offboarding as a data task as well as an IT one.

---

## **Common HR Data Breaches and How to Prevent Them**

Most HR breaches aren't dramatic hacks. They're human.

- **Misdirected emails**: a payslip, offer letter or investigation outcome sent to the wrong person. Autocomplete has a lot to answer for.
- **Over-shared files**: a salary spreadsheet with "anyone with the link" access, or an HR folder open to the whole company.
- **Lost or unlocked devices**: a laptop with local copies of employee records.
- **Former staff access**: leavers whose accounts stay active for weeks.
- **Supplier incidents**: your payroll or benefits provider has the breach, and you're the one who has to tell people.

How common is this? The government's [Cyber Security Breaches Survey](https://www.gov.uk/government/statistics/cyber-security-breaches-survey-20252026/cyber-security-breaches-survey-20252026) found that a large share of UK businesses reported a breach or attack in the previous 12 months. HR data is exactly what attackers and careless clicks tend to expose.

- Prevention is mostly dull and effective:
- Limit access by role.
- Use proper permission settings on shared drives.
- Turn on multi-factor authentication.
- Switch off leaver access on their last day.

And train the people handling the data, because the best control in the world loses to one rushed email.

Finally, have a plan for when it still goes wrong. You'll want to know who decides whether a breach is reportable, how fast you can assess it, and who talks to affected employees. The ICO expects reportable breaches within 72 hours, so that plan needs to exist before you need it.

---

## **Frequently Asked Questions**

### **Does UK GDPR apply to employee data?**

Yes. Employees are data subjects with the same rights as customers, including access, rectification and erasure in the right circumstances. The employment context adds extra considerations because of the imbalance of power between employer and employee.

### **What lawful basis should HR use for employee data?**

Usually contract, legal obligation or legitimate interests, depending on the activity. Consent is rarely appropriate for core HR processing because employees often can't freely refuse. Document the basis for each activity.

### **How long do we have to respond to an employee subject access request?**

Generally one month from receiving the request. In some complex or multiple-request cases it can be extended, but you should tell the person within the first month and explain why.

### **How long should HR keep employee records?**

There's no single period. Keep each type of record only as long as you have a documented reason, such as a legal requirement or a realistic need to defend a claim. A retention schedule makes this concrete.

### **Do we need a DPO to handle HR data protection?**

Not automatically. A DPO is required in specific circumstances, such as large-scale processing of special category data. Even when you're not required to appoint one, someone should own data protection for HR so that decisions don't fall between teams.

 

HR data protection isn't about making HR's life harder. It's about making sure the most sensitive information in the business is handled like it matters, because it does. Do the basics well, document them, and you'll be in a strong position when an employee, a regulator or a prospective investor starts asking questions.

If any of this still feels uncertain, or you'd like to talk it through with someone who's handled it before, you're welcome to book some time with our team. We're happy to see how we can help. 

[![chat to an expert](https://resources.trustkeith.co/hs-fs/hubfs/chat%20to%20an%20expert.png?width=220&height=55&name=chat%20to%20an%20expert.png)](https://www.trustkeith.co/talk-to-us)

[![Trust Keith - take data protection off your plate, for good](https://resources.trustkeith.co/hs-fs/hubfs/blog%20cta%20(5).png?width=3450&height=1150&name=blog%20cta%20(5).png)](https://www.trustkeith.co/)

 

[![Trust Keith](https://resources.trustkeith.co/hs-fs/hubfs/raw_assets/public/Trustkeith_March2023/images/trust_keith01.png?width=268&name=trust_keith01.png "Trust Keith")](https://www.trustkeith.co/)

[![Talk to an expert](https://hubspot-no-cache-eu1-prod.s3.amazonaws.com/cta/default/24879685/859c2149-73c5-4ae5-a465-6c639d24614f.png)](https://hubspot-cta-redirect-eu1-prod.s3.amazonaws.com/cta/redirect/24879685/859c2149-73c5-4ae5-a465-6c639d24614f)

- Features 
    - [Comply with data regulations](https://www.trustkeith.co/product/comply-with-regulations)
    - [Discover your data risks](https://www.trustkeith.co/product/discover-data-risks)
    - [Expert Advice](https://www.trustkeith.co/product/expert-advice)
    - [Govern your data protection programme](https://www.trustkeith.co/product/govern-data-protection)
    - [Manage breaches and incidents](https://www.trustkeith.co/product/manage-breaches-and-incidents)
    - [Train your staff](https://www.trustkeith.co/product/train-your-staff)
- Product 
    - [How it works](https://www.trustkeith.co/how-it-works)
    - [Marketplace](https://www.trustkeith.co/marketplace)
    - [Pricing](https://www.trustkeith.co/pricing)
    - [Customers](https://www.trustkeith.co/customers)
- Trust Keith 
    - [Company](https://www.trustkeith.co/company)
    - [Talk to us](https://www.trustkeith.co/talk-to-us)
    - [LinkedIn](https://www.linkedin.com/company/trustkeith/)
    - [Privacy policy](https://trustkeith.trustkeith.co/)

© Trust Keith 2026. Trust Keith Ltd is a company registered in England and Wales number 12283797.

```json
{
  "@context" : "https://schema.org",
  "@id" : "https://resources.trustkeith.co/hr-data-protection-hidden-compliance-risks-trust-keith#blogposting",
  "@type" : "BlogPosting",
  "author" : {
    "@type" : "Person",
    "name" : "Trust Keith"
  },
  "dateModified" : "2026-10-23T15:28:44+0000",
  "datePublished" : "2026-10-23T15:28:44+0000",
  "description" : "HR handles your most sensitive data. Learn how to get lawful bases, special category data, employee DSARs, suppliers and retention right under UK GDPR.",
  "headline" : "Data Protection for HR Teams: The Hidden Compliance Risks You Might Be Missing",
  "inLanguage" : "en-GB",
  "isPartOf" : {
    "@id" : "https://resources.trustkeith.co/#blog",
    "@type" : "Blog",
    "name" : "Trust Keith Resources Blog",
    "publisher" : {
      "@id" : "https://www.trustkeith.co/#organization"
    }
  },
  "mainEntityOfPage" : {
    "@id" : "https://resources.trustkeith.co/hr-data-protection-hidden-compliance-risks-trust-keith",
    "@type" : "WebPage"
  },
  "publisher" : {
    "@id" : "https://www.trustkeith.co/#organization",
    "@type" : "Organization",
    "logo" : {
      "@type" : "ImageObject",
      "url" : "https://cdn.prod.website-files.com/5f462e8160aa877216f7d4b7/642bcbad7735490755580d8d_trust-keith-logo.svg"
    },
    "name" : "Trust Keith",
    "url" : "https://www.trustkeith.co/"
  }
}
```