Skip to content

Common Pitfalls in Staff Privacy Notices

Table of Contents

Businesses commonly collect a wide range of personal data from staff, such as bank details, email addresses, telephone numbers and national insurance numbers. Ensuring the protection of staff members’ personal data is vital for compliance with UK data protection law. A crucial way to ensure compliance is to issue staff a comprehensive Staff Privacy Notice, which transparently explains how a business will use staff data. However, a Staff Privacy Policy has common pitfalls that companies should avoid. This article will explore the purpose of a Staff Privacy Notice and the critical pitfalls to avoid.  

What is the Purpose of a Staff Privacy Notice?

When a business handles personal data affecting or relating to staff, complete transparency about using that data is essential under the UK GDPR and is one of the fundamental rights of data subjects. This requires providing detailed information to staff regarding the precise use of their data. Transparency is a vital principle under the UK GDPR, regardless of the nature of the employment relationship with the staff.

Issuing a Staff Privacy Notice to all staff members is the most customary and effective method of fulfilling the obligation to inform staff about how you use their data. This requirement extends beyond just employees and requires companies to provide information to staff they engage in various capacities, such as freelancers, contractors, volunteers, and interns. 

Your business may collect a range of personal data from all staff numbers, including but not limited to their name, date of birth, contact details, passport information, national insurance numbers, details from DBS checks, financial information, and even medical data. Given the sensitivity and risk of such information, staff need to comprehend how and why their employer plans to use it.

What are Common Pitfalls in a Staff Privacy Notice?

Stringent data protection rules require a Staff Privacy Notice to be detailed and comprehensive to comply fully with the transparency requirements under the UK GDPR. Further, a Staff Privacy Notice must be bespoke and specific to cover the operations of the relevant employer business. 

A Staff Privacy Notice should correctly address various points to ensure compliance with data protection laws. This includes carefully disclosing the types of personal data the business collects from staff and various disclosures about how the company will use it. 

Here are some common pitfalls to avoid in a Staff Privacy Notice: 

The Staff Privacy Notice Only Covers Employees 

A mistake in drafting Staff Privacy Notices is where there is a narrow focus solely on the company’s employees, neglecting other categories of staff such as freelancers, contractors, volunteers, and interns. While employees often constitute the primary workforce, overlooking these other staff members can lead to an incomplete and non-compliant Staff Privacy Notice. It is crucial to acknowledge that all individuals from whom an organisation collects or processes personal data as a controller, regardless of their employment status, are data subjects whose personal data requires protection and transparency under the UK data protection law. 


Failing to include all individuals and the data collected from them in the scope of a Staff Privacy Notice not only undermines legal compliance but also overlooks the rights and expectations of these staff members regarding their data privacy rights.


Staff Privacy Notices should be drafted carefully to consider all personal data collected from all staff members. Otherwise, this could lead to a gap in compliance and problem issues, such as self-employed contractors complaining that they need more transparent information regarding the use of their data. 

The Staff Privacy Notice Does Not Cover All Mandatory Information 

Under the UK GDPR rules, precise mandatory information must be set out in a Staff Privacy Notice to ensure compliance with data protection laws. Omitting these required disclosures is not an option and could lead to legal consequences. 

Front page of publication
GDPR Essentials Factsheet

This factsheet sets out how your business can become GDPR compliant.

Download Now

Your Staff Privacy Notice must include not only simple information about which data you collect from staff and why but also various other detailed and niche points, including:

  • information about third parties with whom your business shares staff members’ data, including third-party suppliers and affiliated companies and international transfers of personal data outside of the United Kingdom;
  • information about data retention criteria and periods;
  • an explanation of the relevant lawful basis to process staff personal data; and
  • information about whether staff data will be subject to automated decision-making. 

Overlooking the need to include these mandatory sections in a Staff Privacy Notice risks non-compliance with the UK GDPR. It also denies staff members knowledge of how your business will handle their data. 

The Staff Privacy Notice is Outdated 

A common mistake regarding Staff Privacy Notices is when they become outdated and inaccurate. As businesses change and grow, they may start collecting new data from staff or using staff data for new purposes. This development necessitates ensuring that the Staff Privacy Notice remains entirely up to date to reflect the company’s current data processing practices accurately. You must review and update a Staff Privacy Notice regularly to avoid gaps in the document that can result in it falling short of UK GDPR compliance, which can cause various risks for a business. 

These common pitfalls can result in various negative consequences for a business, including staff complaints and, in the worst case, regulatory action. If your business needs help preparing a compliant Staff Privacy Notice, you should seek advice from an experienced data protection lawyer. 

Continue reading this article below the form
Need legal advice?
Call 0808 196 8584 for urgent assistance.
Otherwise, complete this form and we will contact you within one business day.

Key Takeaways

Drafting an accurate and compliant Staff Privacy Notice is vital for businesses to comply with UK data protection laws and maintain transparency about using staff members’ data. 

However, several common pitfalls can undermine its effectiveness and fall short of compliance. These include the document overlooking non-employee staff members, omitting mandatory information required by the UK GDPR, and needing to be updated. Seeking support from a data protection lawyer can help businesses navigate these challenges and ensure their Staff Privacy Notices remain up-to-date and legally compliant.

If you help with a Staff Privacy Notice, our experienced data, privacy, and IT lawyers can assist you as part of our LegalVision membership. For a low monthly fee, you will have unlimited access to lawyers to answer your questions and draft and review your documents. Call us today on 0808 196 8584 or visit our membership page.

Register for our free webinars

Understanding Your Business’ New Employment Law Obligations

Ensure your business is compliant with the new employment law changes. Register for our free webinar to learn more.
Register Now

A Roadmap to Business Success: How to Franchise in the UK

Learn the formula for successfully franchising your UK business. Register for our free webinar today.
Register Now
See more webinars >
Sej Lamba

Sej Lamba

Read all articles by Sej

About LegalVision

LegalVision is an innovative commercial law firm that provides businesses with affordable, unlimited and ongoing legal assistance through our membership. We operate in Australia, the United Kingdom and New Zealand.

Learn more

We’re an award-winning law firm

  • Award

    2023 Economic Innovator of the Year Finalist - The Spectator

  • Award

    2023 Law Company of the Year Finalist - The Lawyer Awards

  • Award

    2023 Future of Legal Services Innovation - Legal Innovation Awards

  • Award

    2021 Fastest Growing Law Firm in APAC - Financial Times