Employee privacy notice: what UK law makes you tell your staff

Most employers have a staff privacy notice somewhere. Fewer can say when it was last given to anyone, which lawful basis it claims for each thing they do, or what happened to it when the Data (Use and Access) Act 2025 amended the provision it was written from. It surfaces in an onboarding pack, gets a signature, and is never read again.

That signature is the clearest sign the document has been misunderstood. A privacy notice is not an agreement. It is a disclosure you owe people before you start, and its content is fixed by a provision you can read rather than by a template you can buy.

This article covers what the notice must contain, when it has to reach a candidate and an existing employee, why consent is almost never the right basis, what changes for health and ethnicity data, and what the 2025 Act altered. It describes the position in the United Kingdom and is general information rather than legal advice.

The notice is only true if the collection it describes is the collection that happens. See how New Dynamics onboarding keeps the list of what you ask a new joiner for in one place, so the document and the practice do not drift apart.

Where the duty comes from

The obligation is the right to be informed. For information you collect from the person themselves it lives in Article 13 of the UK GDPR, titled "Information to be provided where personal data are collected from the data subject". Its opening words set the trigger and the timing together: the controller "shall, at the time when personal data are obtained, provide the data subject with all of the following information".

The ICO calls the output "privacy information" rather than a notice, which is a useful correction. The document is the delivery mechanism. The duty is the content.

What an employee privacy notice must contain

Article 13 lists twelve items, not a tone of voice. Paragraph 1 requires the controller's identity and contact details, those of its representative and of "the data protection officer, where applicable", "the purposes of the processing for which the personal data are intended as well as the legal basis for the processing", the legitimate interests pursued where that is your basis, "the recipients or categories of recipients of the personal data, if any", and any transfer to a third country with the safeguards relied on.

Paragraph 2 adds "further information necessary to ensure fair and transparent processing":

• "the period for which the personal data will be stored, or if that is not possible, the criteria used to determine that period";
• the rights of access, rectification, erasure, restriction and objection, and the right to data portability;
• where consent is the basis, the right to withdraw it "at any time, without affecting the lawfulness of processing based on consent before its withdrawal";
• the right to complain, which since 2026 means two routes rather than one;
• "whether the provision of personal data is a statutory or contractual requirement, or a requirement necessary to enter into a contract", and "the possible consequences of failure to provide such data";
• automated decision-making, including profiling, with "meaningful information about the logic involved".

Two are routinely missing. The retention line has to be a period or the criteria, not a promise to keep nothing longer than necessary. And the statutory-or-contractual line means saying which fields you need by law, such as a National Insurance number, which you need under the contract, such as bank details, and which are optional, such as an ethnicity monitoring answer.

When it has to be given

For a candidate, the answer is the point of collection. The ICO's recruitment guidance, still in draft while its closed consultation is processed, is direct: "You must provide privacy information at the time you collect personal information from the candidate. For example, in your job advert or in your application form." You must do so "even if you think it's obvious how you will use the person's information", and a link will satisfy the requirement.

For someone already employed there is no separate re-issuing deadline, because the trigger is collection rather than status. The ICO's final employment records guidance says: "If you are collecting personal information directly from your workers, you must give them the privacy information at the time you collect their information." So the employee notice belongs where the employment record starts, when an offer is accepted rather than on day one, and each later collection of a new kind of information carries its own obligation.

Where information comes from somewhere other than the person, such as a reference or a background check, the deadline is "within a reasonable period, but at the latest within one month of obtaining it".

When a purpose changes, Article 13(3) governs: the controller "shall provide the data subject prior to that further processing with information on that other purpose". Prior, not alongside and not afterwards. The ICO puts it in one line: "You must bring any new uses of workers' personal information to their attention before you start the processing."

The lawful basis question, and why consent rarely works

Article 13(1)(c) makes the legal basis part of the notice, so a notice listing purposes without bases is incomplete on its face. The temptation is to write "consent" against everything, because the signature page seems to supply it. The regulator closes that route.

The ICO states that "consent will not usually be appropriate if there is a clear imbalance of power between you and the individual", that this "will be a particular issue for public authorities and employers", and that "if you are a public authority or are processing employee data, or are in any other position of power over an individual, you should look for another basis for processing". Its employment guidance gives the reason: workers "may fear adverse consequences and may feel they have no choice but to agree", and "in such circumstances, consent is not considered freely given".

Consent also fails where "you would still keep records of the information using a different lawful basis or condition if the worker refused or withdrew consent". Payroll does not stop because someone withdraws consent, which tells you consent was never the basis.

It is not banned. The ICO is clear that "this does not mean that, as an employer, you can never use consent", and its example is a voluntary cycle-to-work scheme where "there are no penalties for not participating". The test is whether refusal costs the person anything. For the core record the ICO points instead at contract, legal obligation and legitimate interests, noting that the contract basis "should only be used once an offer of employment has been accepted".

Health, ethnicity monitoring and the appropriate policy document

Health data, ethnic origin, religious belief, trade union membership and biometric data used for identification are special category data, and the notice has more to carry. The ICO is explicit: "in addition to a lawful basis, you must identify a special category condition (under Article 9 of the UK GDPR). You may also need to satisfy a condition in Schedule 1 of the DPA 2018." The employment condition "also requires you to have an appropriate policy document in place".

That document is defined in statute, not left to judgement. Paragraph 39 of Part 4 of Schedule 1 to the Data Protection Act 2018 says you have one if you have produced a document which "explains the controller's procedures for securing compliance with the principles in Article 5 of the UK GDPR" for that condition, and which "explains the controller's policies as regards the retention and erasure of personal data processed in reliance on the condition, giving an indication of how long such personal data is likely to be retained". Paragraph 40 requires you to keep it, "review and (if appropriate) update it from time to time", and give it to the regulator on request without charge, until six months after you stop that processing. Part 4 came into force on 25 May 2018, and on the day this was checked legislation.gov.uk recorded it as "up to date with all changes known to be in force on or before 07 November 2026".

Ethnicity monitoring deserves its own line, because its footing is uneven across the United Kingdom. The ICO states that in Northern Ireland, under the Fair Employment (Monitoring) Regulations 1999, "employers with 10 or more employees who each work more than 16 hours a week must collect information about workers' religious backgrounds and share this with the Equality Commission", while "in England, Wales and Scotland there is no general legal obligation to collect information about your workers for equality of opportunity monitoring purposes". It also warns that "you must make sure you do not use information you collect to monitor equality of opportunity for any other purpose". Put that purpose limit in the notice. People answer those questions more honestly when it is there.

Asking an employee to sign it achieves nothing

Article 13 imposes one verb on the controller: provide. It requires no signature, no acknowledgement and no acceptance, and nothing in it gives a signature any effect. A privacy notice states what you do. It is not a term you negotiate, and nobody can sign away a transparency duty or the rights the notice describes.

No official source says a signature is required, and none says it is forbidden. A signature proves delivery and nothing more. Keep an evidence trail of when and how the notice was issued, which is what the signature stood in for, and drop any wording that frames it as something the employee accepts.

How it sits with the contract and the handbook

Keep the notice separate from both, for structural reasons rather than stylistic ones.

Put it in the employment contract and you tie a document that must change whenever your processing changes to one that cannot change without agreement. Our post on the employment contract covers what belongs there instead. Put it in the handbook and it inherits the handbook's revision cycle, when Article 13(3) requires the update to precede the new purpose. The ICO does list a handbook as an acceptable route, alongside "your staff privacy notice on your organisation's intranet", a general data protection policy and "'just in time' notices". So it is not a wrong place to find the notice, only a poor place for the canonical version to live. A short handbook reference pointing at a dated notice you control separately gives you both.

The retention periods in the notice also have to match the ones you actually run, which is where our post on employee records retention picks up, and the sharing line has to match who can really see what, the subject of our post on access levels for HR data.

One document for candidates and employees, or two?

Nothing in Article 13 requires either arrangement, and the ICO does not prescribe one. What it does require is that the information be "easily accessible to your workers, easy to understand, and in clear and plain language", and accurate for whoever is reading it.

That usually argues for two. A candidate notice covers assessment, verification, agencies, automated sifting and a short retention period for unsuccessful applicants. An employee notice covers pay, pension, absence, performance, monitoring and years of retention. A reader who cannot tell which half applies has not really been informed. If you do merge them, label the sections by stage. Our post on the candidate portal covers where the recruitment-stage version belongs.

What the Data (Use and Access) Act 2025 changed

It changed Article 13 itself. The legislation.gov.uk record carries five dated amendments traceable to the Act, commenced by S.I. 2026/82 and S.I. 2026/386.

On 19 June 2026, Schedule 10 inserted Article 13(2)(ca), "the right to make a complaint to the controller under section 164A of the 2018 Act", and amended Article 13(2)(d) to refer to a complaint "under section 165 of the 2018 Act". On 30 September 2026, consequential regulations substituted "Commission" in Article 13(2)(d).

On 5 February 2026, Article 13(1)(f) began referring to "regulations under Article 45A" and "the safeguards relied on" for international transfers, Article 13(2)(f) tied the automated decision-making disclosure to processing "which is subject to the requirement to provide safeguards under Article 22C", and Article 13(4) was rewritten so the exemption where the person already has the information applies "to the extent that" they have it rather than as an all-or-nothing switch. New paragraphs 13(5) to 13(7) arrived the same day, narrowly relieving the duty to notify a change of purpose for research, public-interest archiving and statistical purposes.

For an HR team the operative change is 13(2)(ca). A staff privacy notice written before 19 June 2026 lists one complaint route, to the regulator. The provision now requires two, and the first is to you. No official body publishes figures on how many employers have updated a notice since these amendments, so there is no number to quote here. Treat the dates as the review trigger instead.

Frequently asked questions

What is an employee privacy notice?

It is the document through which an employer meets the right to be informed for its workers. The ICO calls the content "privacy information": your purposes, your lawful basis, your condition for special category or criminal offence information, your retention periods, who you share with, workers' rights, and where you obtained the information.

Do employees have to sign a privacy notice?

No. Article 13 requires the controller to provide the information, and nothing in it gives a signature any effect. A privacy notice is a disclosure rather than a contract term, so signing it changes nothing legally. If you collect one, treat it only as evidence the notice was issued.

When must we give a candidate a privacy notice?

At the point you collect it. The ICO's recruitment guidance says to provide it "at the time you collect personal information from the candidate", giving the job advert and the application form as examples, and allows a link. If you obtain information about a candidate from elsewhere, the deadline is a reasonable period and at the latest one month.

Can we rely on consent in an employee privacy notice?

Rarely, and almost never for the core employment record. The ICO says consent is unlikely to be valid where there is an imbalance of power, which applies to employers, and that it fails anyway where you would process the data even if it were refused. Contract, legal obligation and legitimate interests are the usual bases.

Does the notice need to mention health or ethnicity data separately?

Yes, where you process it. Special category data needs an Article 9 condition on top of your lawful basis, often with a Schedule 1 condition under the Data Protection Act 2018, and the employment condition requires an appropriate policy document. Name the condition, and state the purpose limit for equality monitoring, which the ICO says must not be used for anything else.

Did the Data (Use and Access) Act 2025 change what the notice must say?

Yes. Article 13(2)(ca) was inserted on 19 June 2026 and adds the right to complain to the controller itself under section 164A of the Data Protection Act 2018, so notices now need two complaint routes rather than one. Wording on international transfers and automated decision-making changed on 5 February 2026, and the complaint wording changed again on 30 September 2026.

Can one document cover both candidates and employees?

Nothing requires either arrangement. The information has to be accurate for the reader and given in clear, plain, easily accessible language. Because purposes, recipients and retention periods differ sharply between recruitment and employment, two documents usually read better. If you use one, split it by stage.

Your next step: date the notice and check two lines

1. Find the date on your current staff notice. If it predates 19 June 2026, it is missing the right to complain to you under section 164A.
2. Read the retention section. If it says "no longer than necessary" and nothing else, replace it with periods or the criteria that set them.
3. Write a lawful basis against each purpose. Delete the word consent anywhere refusal would change nothing.
4. For health and equality monitoring data, confirm an appropriate policy document exists covering both Article 5 compliance and retention, as paragraph 39 requires.
5. Decide where the canonical version lives, reference it from the handbook, and record how issue is evidenced.

For the policy this notice sits inside, read and download our employee data protection guide. The guide is free to read, and the PDF uses our short download form. Our HR compliance post covers the wider duties around it.

Want the collection your notice describes to match the collection that happens, with one record per person and access set by role? Book a New Dynamics demo and bring your current notice. You can also email contact@new-dynamics.com.