{"id":198951,"date":"2026-07-23T04:06:01","date_gmt":"2026-07-23T03:06:01","guid":{"rendered":"https:\/\/legalvision.co.uk\/?p=198951"},"modified":"2026-07-23T04:06:08","modified_gmt":"2026-07-23T03:06:08","slug":"employee-data-theft-uk","status":"publish","type":"post","link":"https:\/\/legalvision.co.uk\/data-privacy-it\/employee-data-theft-uk\/","title":{"rendered":"Dealing With Employee Data Theft In The UK"},"content":{"rendered":"\n

Employee data theft happens when a member of staff takes personal data, such as customer lists or contact details, without the employer\u2019s authorisation, often when leaving for a new role. Under the UK GDPR<\/em> and the Data Protection Act 2018<\/em>, the employer, as data controller, must protect that data and may need to report the incident to the Information Commissioner\u2019s Office within 72 hours where it poses a risk to people\u2019s rights. The employee can face criminal liability under section 170 of the Data Protection Act 2018<\/em> for knowingly obtaining or retaining personal data without consent. Employers can also be liable where the misuse is closely connected to the employee\u2019s role. While data theft is a very broad concept, this article explores key data protection law issues arising when employees take personal data without authorisation when leaving their employer.\u00a0<\/p>\n\n\n\n

Risk Arising From Employees Taking Personal Data<\/h2>\n\n\n\n

Employees can often access a broad range of sensitive, confidential, and personal information in their everyday roles. But if an employee takes data, such as customer lists, when they leave, the business could face significant legal and commercial risks.<\/p>\n\n\n\n

\n

However, staff who steal or misuse any type of company information or data, including confidential and non-personal business data, can trigger broader and serious legal and financial consequences beyond the scope of this article. Employers should seek tailored legal advice on those.<\/p>\n<\/div>\n\n\n\n

Insider threats are increasingly prevalent in the digital age, as many staff work remotely and have easy access to copy and download information. The risk is higher because much data is now electronic, which makes it far easier to copy or transfer large volumes quickly.<\/p>\n\n\n\n

Employees may take personal data for various reasons. Some may mistakenly believe that taking customer contact details will help them in a new role, without realising the legal risks and consequences. Others can act out of spite if they feel unfairly treated and seek to cause deliberate harm by taking information on their departure.<\/p>\n\n\n\n

\n

A case involving Morrisons in 2020<\/a> shows this: an employee who felt mistreated during a disciplinary process leaked the data of around 100,000 staff.<\/p>\n

The Supreme Court confirmed that Morrisons was not vicariously liable, because the employee acted far outside the course of his employment. But the court also made clear that employers can be liable where an employee misuses personal data as part of their job duties, depending on whether the conduct is closely connected to their role.<\/p>\n

So employers need to understand that any misuse of employee data can carry serious consequences.<\/p>\n<\/div>\n\n\n\n

Potential Data Protection Consequences Resulting From Data Theft<\/h2>\n\n\n\n
Risk<\/th>What it means<\/th><\/tr><\/thead>
Data breach<\/td>Unauthorised access to, copying or sharing personal data may amount to a data breach.<\/td><\/tr>
Employer liability<\/td>Employers must protect personal data and may need to notify the ICO and affected individuals. Serious breaches generally must be reported within 72 hours.<\/td><\/tr>
Regulatory action<\/td>The ICO may investigate and take enforcement action if an employer failed to protect personal data.<\/td><\/tr>
Employee liability<\/td>Employees may face criminal liability under section 170 of the Data Protection Act 2018<\/em> for knowingly or recklessly taking, sharing or retaining personal data without consent.<\/a><\/td><\/tr>
Workplace consequences<\/td>Employees may also face disciplinary action, dismissal or a breach of contract claim for breaking workplace policies or taking data when they leave.<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n\n\n Continue reading this article below the form\n <\/i>\n<\/a>\n
\n
\n Need legal advice?\n
\n \n Call 0808 196 8584<\/a> for urgent assistance.\n
\n Otherwise, complete this form, and we will contact you within one business day.\n <\/span>\n <\/div>\n\n \n\n
\n