\n Surely, everyone in the UK\u2014probably everyone in the whole world\u2014has watched a lion hunt on the TV? Look! There\u2019s the herd getting on with herd business, like scratching their friend\u2019s neck, eating grass, and swatting flies. There\u2019s the lioness and her prowling pride, slowly closing in. The threat is real. But the herd is lost in the daily grind\u2014too preoccupied to take much notice. And the lioness hasn\u2019t decided exactly what to\u2026. and boom! She bursts forth! The herd explodes! All is chaos and madness and mayhem and speed and drama\u2026 \n<\/p>\n
\n Now, instead of a herd of zebra, envisage millions of businesspeople. And instead of a lioness, imagine four little letters\u2014GDPR. Aaaaand that\u2019s a completely<\/s> fairly accurate portrait of the online business world between 2016, when the General Data Protection Regulation was adopted, and 2018, when it came into effect. \n<\/p>\n
\n Of course, there were more laptops and lattes, than Serengeti wildernesses and watering holes. And we got millions of alarming blog posts instead of David Attenborough\u2019s authoritative yet comforting voiceover\u2026 but you get the idea. It was wild! \n<\/p>\n
\n Things have changed a lot since then. For starters, most people have realised that the GDPR is more \u2018good cop\u2019\u2014there to protect and serve\u2014than bloodthirsty lioness\u2014there to eat everyone who can\u2019t keep up. And, of course, by 1st<\/sup> January 2021 the United Kingdom had formally exited the European Union and no longer had to conform with the GDPR (EU) at all. \n<\/p>\n \n So, what\u2019s the score with the GDPR in 2022? What are the obligations of organisations under UK GDPR laws<\/a>\u2014aka the Data Protection Act 2018? And how are HR managers supposed to keep on top of it all? \n<\/p>\n \n The good news\u2014or the bad news, depending on your point of view\u2014is that the UK decided to stick with the GDPR, now called the UK GDPR, which is now part of the Data Protection Act 2018 (DPA). As with its EU counterpart the UK GDPR governs data protection in the UK, how organisations gather, store, and use data, and how individuals can exercise their increasing rights of control over their own personal data. And that includes all the people in your organisation. \n<\/p>\n \n Combining both ethical and legal concerns, data protection laws impact most HR processes, from recruitment, and record keeping, to performance monitoring, and compensation. So, it\u2019s not something that organisations can brush aside or improvise. Data must be managed responsibly<\/a>, while legal principles and developments must be upheld. And we\u2019re not going to downplay it\u2014developments in data protection can feel overwhelming. \n<\/p>\n \n But don\u2019t start carving out the \u2018Abandon Hope All Ye Who Enter Here\u2019 signs just yet. We\u2019ve put together a \n UK data protection laws are made up of several central bodies, terms, regulations, and rights. It\u2019s best that any HR manager has a basic understanding of the main elements, so we\u2019ll take a quick look at them now. \n<\/p>\n \n The Information Commissioner\u2019s Office (ICO) <\/strong>\n<\/p>\n \n The ICO is an independent body charged with the promotion and enforcement of data protection legislation. And that includes issuing fines like the \u00a320 million data breach fine<\/a> issued to British Airways (reduced from an original \u00a3183 million), after a cyber-attack compromised the personal and financial data of over 400,000 customers. While the ICOs limits are yet to be tested, you can rest easy that fines are proportionate to turnover and the level of data loss\u2014data-driven business models be warned. So, although not many of us are likely to find a \u00a320 million bill on our doormat, fines can be up to 4% of total annual worldwide turnover for the most serious failures. \n<\/p>\n \n The General Data Protection Regulation (GDPR) <\/strong>\n<\/p>\n \n The GDPR is largely concerned with individuals\u2019 rights to access information about their own data, as well as data management obligations, and fines for misuse. \n<\/p>\n \n The Data Protection Act 2018 (DPA) <\/strong>\n<\/p>\n \n Together, the DPA and GDPR dictate the obligations of data controllers<\/strong> (those who decide how and why personal data is processed) and the rights of data subjects<\/strong> (those whose data is held or processed). In the context of HR, the employer would usually be the data controller<\/strong>, while workers, employees, past employees, and applicants would be data subjects<\/strong>. \n<\/p>\n \n According to the principles of the DPA, data controllers must make sure collected and stored information is: \n<\/p>\n \n Personal versus sensitive data <\/strong>\n<\/p>\n \n Personal data relates to personally identifiable information like name and location. Almost all HR records including absence records, performance tracking, and recruitment files can be classed as personal data. \n<\/p>\n \n Sensitive data<\/a> relates to data that could lead to discriminatory behaviours, reveals protected characteristics, or is singularly personally identifiable. This includes information on race, ethnic background, political opinions, religious beliefs, trade union membership, genetics, identifying biometrics, health, sex life or orientation, and criminal records. While there are stronger legal protections for sensitive data, it can be processed if necessary. For example, criminal records must be accessed for work with children or vulnerable adults. Or fits notes can be collected to prove genuine illness. Even diversity information can be collected if it is in the interest of social security and social protection law. However, any reasons must be fair, lawful, transparent, accurate, and properly recorded. \n<\/p>\n \n Individual rights<\/strong>\n<\/p>\n \n All individuals, including employees or anyone who has worked, is working, or has applied to work for an organisation, has the right to find out what information that organisation holds about them. \n<\/p>\n \n That includes the right to: \n<\/p>\n \n These rights extend to data used for: \n<\/p>\n \n HR teams are most likely to be impacted by data protection rights in the form of Data Subject Access Requests (DSARs). These can be either oral or written requests and can relate to general (all) or specific data. In increasingly intertwined workplaces, where one employee document can reference other employees, or performance data for one can reveal performance data for another, it is important that DSARs are handled with great care. Getting it wrong can lead to a data breach. \n<\/p>\n \n Now you have an idea of what data protection laws look like in 2022, you\u2019re probably wondering how they affect you and your organisation. Let\u2019s look at some examples. \n<\/p>\n \n Thanks to an adequacy decision<\/a> made by the European Commission in June 2021 relating to the GDPR, \u201cpersonal data can now flow freely from the European Union to the United Kingdom where it benefits from an essentially equivalent level of protection to that guaranteed under EU law\u201d. Although limited by a 4 year \u2018sunset clause\u2019, at which time it will be reviewed, the decision means that organisations that have operations in the EU as well as the UK can breathe a temporary sigh of relief. And we\u2019re not just talking about people or business activities. If a UK based organisation uses a cloud storage provider based in, for example, Germany, then data will need to flow freely between those two points. So, by 2025 we may all have to start thinking about where our cloud providers are based, and not just the security, privacy, and contents of the data. \n<\/p>\n \n Like cookies and Ts&Cs, privacy policies are an ever-present aspect of online life. And they need to be high on every HR professional\u2019s agenda too. Policies must be transparent, comprehensive, easily accessible for employees and other workers, and up to date. And any changes in data management policies must be communicated organisation wide. The best way to do this is by circulating a privacy notice\u2014here\u2019s a handy template<\/a> provided by the Ministry of Justice. \n<\/p>\n \n Providing staff with smart phones, laptops, tablets, and flexible working options is increasingly common and even expected. But spreading workforces and company assets beyond the four walls of HQ comes with its own data protection implications. Robust policies should cover cybersecurity, permitted uses for all devices and communication channels, and unobtrusive monitoring measures such as tracking traffic data. \n<\/p>\n \n Accountability requirements should be met by training, auditing, and comprehensive documenting of data processing activities, while consistently reviewing HR policies. For example, people must be able to recognise and avoid potential attacks like phishing and organisational data should be encrypted. \n<\/p>\n \n Although a governance update on the 23rd of June 2022 included proposals to replace requirements to appoint a DPO with an obligation to appoint a senior person who is responsible for data privacy management, it\u2019s still important to hire a DPO if your organisation meets certain criteria. For example, if you\u2019re a public authority or body, or work closely with public authorities or bodies, or perform large-scale monitoring or data processing. \n<\/p>\n \n Just because you\u2019re not selling employee data, doesn\u2019t mean that you\u2019re not sharing it. If you send data through third-party software integrations such as payroll software or HR software, or use external organisations like recruitment agencies, solicitors, or accountancy firms, you need to make sure that they\u2019re compliant too. \n<\/p>\n \n Data security obligations depend on the size of your organisation, the nature of the data being processed, and the potential harm that could result from a data breach. But risk assessments, up-to-date security systems and software, strict access restrictions, training, and security monitoring should be part of every organisation\u2019s data security practices. \n<\/p>\n \n If your organisation has over 250 employees, then clear, accessible records of all data processing activities must be kept. Smaller organisations only need to keep records for data that they process regularly, such as payroll data, as well as sensitive, potentially harmful, or intrusive data. \n<\/p>\n \n The TL;DR action plan is that every organisation\u2014no matter what size\u2014should audit information systems to find out where data is held and why; issue policies and guidelines regulating data management; ensure the security of all stored data; consider and properly manage international data transfer; keep on top of automated decision-making processes; and review and monitor policies, practices, and training on an ongoing and systematic basis. \n<\/p>\n \n And that\u2019s it. Phew! A comprehensive post-Brexit guide to UK GDPR. \n<\/p>\n \n But if you\u2019re still feeling a bit like an outlying Zebra with the lions closing in, then all is not lost, there\u2019s a reliable, hassle-free short cut that can save your hide\u2014HR Software. \n<\/p>\n \n 76% of HR professionals<\/a> have admitted that GDPR requirements have added a significant burden to their HR department. And with increasing numbers of DSARs, data-mapping requirements, data deletion and anonymisation requests, post-Brexit and post-pandemic considerations and regulations, and the ever-changing needs of an evolving workforce, the administrative burden is growing. But it doesn\u2019t have to. With the support of a good HR software, effectively managing GDRP compliance can be easy. \n<\/p>\n \n SenseHR GDPR-compliant software comes with lots of features to help your organisation stay ahead of legislative requirements. \n<\/p>\nWhat the GDPR do we do now?\u00a0<\/h2>\n
fun<\/s> practical guide for all things GDPR. \n<\/p>\nThe anatomy of UK data protection\u00a0<\/h2>\n
\n
\n
\n
\n
\n
\n
Data protection in action\u00a0<\/h2>\n
EU\/UK organisations\u00a0<\/h2>\n
Privacy policies\u00a0\u00a0<\/h2>\n
Internet, social media, communications, and remote working policies\u00a0<\/h2>\n
Data protection officers (DPOs)\u00a0<\/h2>\n
Third-party data transfers\u00a0<\/h2>\n
Data security\u00a0<\/h2>\n
Record keeping and correction\u00a0<\/h2>\n
A GDPR action plan\u00a0<\/h2>\n
HR software and GDPR compliance\u00a0<\/h2>\n
\n
\n
\n