This is part 4 of a 7 part series exploring the far-reaching subject of GDPR. If you’ve missed the first part, you can find it here.

GDPR Session 4

Once you have concluded your HR Audit and identified all of your HR activities in detail, record these on a Data Protection Impact Assessment (DPIA) plan.  This doesn’t need to be an onerous or complicated document, a simple spreadsheet will suffice providing the following information:-

  • Identify your ‘data subjects’ who’s information is being processed (e.g. your employees);
  • The type of personal data being held (e.g. CV, employment contract, passport, absence records);
  • What is the frequency and volume of data being processed? (e.g. weekly, 20 employees);
  • The Company’s role (e.g. processor, controller, joint data controller);
  • Who has access to the data (e.g. internally: payroll, marketing, finance, or externally: a 3rd party provider; HR Consultant, IFA, outsourced payroll);
  • How you are processing the data (e.g. collecting, transmitting, storage, access, deleting);
  • The purpose of processing the data (e.g. pensions administration);
  • The category of lawful reason for processing the data category;
  • How long the information will be retained (e.g. 6 years post-employment);
  • How the data will be stored (e.g. paper, video, electronic, digital, audio, picture);
  • How the data will be transmitted (e.g. post, email, USB, mobile, courier, visual inspection);
  • Location of processing (e.g. your London office) and if any processing will take place in the EU or otherwise);
  • Identify the level of privacy risks and what you need to reduce or mitigate these;
  • Who in the organisation is responsible for ensuring compliance for each identified risk.

The content of this document refers to GDPR compliance in relation to HR data and employees only.  Therefore it is recommended that further guidance is sought for GDPR compliance in other business areas.  Unsurprisingly we’ve been unable to cover all HR-related topics in this Blog, please contact us if you would like to receive a copy of the full document by sending an email to: jannine@nullb2phr.co.uk. 

We have also compiled an HR GDPR pack (please note these documents only relate to HR-activities) consisting of the following templates:-

  • Data Protection Impact Assessment (DPIA) spreadsheet;
  • Employee Privacy Notice Template (individual employee notification letters)
  • Privacy Notice (General to be issued to employees explaining how HR-related activities will be processed in-line with GDPR)
  • Privacy Notice (Candidate version for potential job applicants explaining how HR-related activities will be processed in-line with GDPR)
  • Data Protection Policy (template)

We would be very happy to share these with you for a small one-off fee of £150 + VAT (to cover research / development time and costs).