How to use this: fill in the highlighted [bracketed] details, then Print → Save as PDF and upload it to My Documents → Company documents → Policies so every member of staff can see it. Have it reviewed by a professional before relying on it. Not legal advice.

Employee Privacy Notice

[Company registered name] (“we”, “the Company”) · Data protection contact: [name / email] · Version 1.0 · Effective: [date]

This notice explains how we collect and use personal data about our workers, employees, contractors and job applicants, in line with the UK GDPR and the Data Protection Act 2018. We are the data controller for this information.

1. The data we hold about you

Identity & contact: name, address, phone, email, emergency contact, date of birth.
Recruitment: application, references, right-to-work documents.
Employment: job role, contract, start/leave dates, disciplinary & performance records.
Pay & benefits: bank details, salary/rate, tax code, National Insurance number, pension.
Working time: clock in/out, timesheets, shifts, holiday and absence.
Work activity: jobs attended, site visits, photos, signatures, vehicle & equipment use.
System & security: portal login, IP address, device information, activity logs.

Some data is “special category” (e.g. health information for sickness absence). We only process it where the law allows — usually to meet employment-law obligations.

2. Why we use it and our lawful basis

Purpose	Lawful basis
Managing your employment & paying you	Performance of your contract
Tax, NI, pension, statutory records	Legal obligation
Health & safety, sickness absence	Legal obligation / employment law
Running jobs, scheduling, security of our systems	Legitimate interests

3. Who we share it with

We share personal data only where necessary: HMRC, our pension provider, our accountant/payroll provider, and IT service providers who host our systems under contract. We do not sell your data. Our current processors include [Cloudflare, Resend, Google Maps, PDFShift, payroll provider, others]. Where data is processed outside the UK, we rely on an approved safeguard (UK adequacy or the International Data Transfer Agreement).

4. How long we keep it

We keep your data only as long as necessary and in line with our Data Protection & Retention Policy — generally the duration of your employment plus up to 6 years for payroll, tax and employment records. Security and login logs are kept for 12 months.

5. Your rights

You have the right to: be informed; access a copy of your data; have inaccurate data corrected; have data erased where there is no lawful reason to keep it; restrict or object to processing; and data portability. To exercise any of these, contact [contact email] — we will respond within one month. You can request a copy of your data at any time; we can produce this for you from our portal.

6. Automated decisions

We do not make decisions about you based solely on automated processing.

7. Complaints

If you are unhappy with how we handle your data, please contact us first. You also have the right to complain to the Information Commissioner’s Office (ICO) — ico.org.uk, or 0303 123 1113.

Issued by: [name] · Position: [role] · Date: [date]