Data protection, surveillance and privacy at work: UK employment law

Essential points 

• Data protection is about safeguarding important information and making sure it is used properly and legally.  
• Employers can keep a range of personal information about their employees without seeking their permission including their name, address, date of birth, sex, National Insurance number, emergency contact details and any disciplinary action taken against them. 
• Organisations need their employees’ consent to keep sensitive information on them such as their race or ethnicity, religion, trade union membership, health and medical conditions and sexual orientation. 
• Employers must keep employees’ personal data secure and up to date and have extra security in place to protect their sensitive personal data. 
• Organisations must notify the ICO of all data breaches without undue delay and, where possible, within 72 hours. 
• Employees have the right to be told what records are being kept on them, how they are used, and how their confidentiality is preserved.