Data Protection Act (2018)

In an increasingly digital world conversations surrounding the use of personal data have never been more prevalent.

Meaning businesses have a greater responsibility to uphold data protection best practices, to provide answers to customers, clients and staff when handling data, but to also stay compliant with current data protection laws.

In this article we delve deeper into the details of the Data Protection Act 2018 and GDPR in the UK. Read on to ensure that you understand how to stay compliant.

The law

The Data Protection Act 2018 strengthened data protection laws in the UK. Making sure the nation’s laws are fit for the evolving technological advancements of the 21st century.

The Act covers:

• The implementation of GDPR in the UK post-Brexit

• An individual’s right to control the use of their personal data

• Who and how data protection laws are enforced

• How long individuals’ data can be retained by businesses

• Who is responsible for handling and processing data

• How organisations should keep personal data up to date

Under the Data Protection Act 2018, employees have more rights over the control and processing of their personal data. Which means, as an employer you must:

• Inform employees of how personal data is being used

• Provide employees with access to their personal data

• Ensure personal is kept up to date

• Erase personal data that is no longer required or out of date

• Give employees the opportunity to consent to how certain data is being used, processed, and stored.

According to data protection laws, it is your responsibility to keep your employees’ personal data safe and secure. This will include making sure you have correct contact details for your employees.

Data such as:

• Names

• Addresses

• Dates of birth

• Education history and qualifications

• Emergency contact details

• National Insurance numbers

• Sex

• Tax codes

• Employment terms and conditions

• Training completed and required

Can all be kept by your organisation without consent from your employees, however other types of data, labelled ‘sensitive data’, legally known as ‘special category data’, must be stored with the consent of the employee. Other conditions can also be relied on.

But, while you don’t need require their consent your business still needs a lawful basis to process personal data.

Data with stronger legal protections:

While all employee data should be handled with care, certain types of data is considered more sensitive by law. Therefore, stricter safeguarding protections are in place to prevent data losses and breaches of data which specifies information about the following:

• Race and ethnicity

• Political beliefs

• Sexual orientation

• Genetics

• Biometric data

• Religious beliefs

• Physical and mental health information

• Trade union membership status

Much of this sensitive data will be gathered during the onboarding process of your employees. Storing this within your employee records. Despite how easily accessible this may be, mishandling data of this nature could result in fines from the ICO.

It is therefore incredibly important that this data is handled correctly, stored safely and securely and is accessible only to those with a requirement for this information.

What does GDPR mean for UK businesses?

In the UK, the EU GDPR has been adopted as the UK GDPR and works in conjunction with the Data Protection Act 2018 (DPA 2018).  

These regulations outline the rules for collecting, managing, and storing personal data.

GDPR stands for General Data Protection Regulation, which was introduced to give individuals greater control over the use of their personal data. Since the introduction of GDPR, businesses across both the EU and the UK have had to tighten their approach to data collection, storage and processing. 

This now means that employers must provide information to an employee regarding what data is stored about them. if an employee requests a copy of their personal data, you must respond without delay and within one month of receipt of the request.

You should also not store data for longer than is required. More on this can be found in our article about storing HR records.

How to handle personal data within your organisation

To handle personal data in the most secure way, we have highlighted some top tips for data protection best practice.

Best practice top tips:

A good first step is to complete a data audit. Which is simply a process of reviewing your current data, how you process it, and your compliance with regulations.

Consider the following questions to help you determine how effective your current data storage and processing is.

Identify the different types of data you collect and process

• What types of data does your organisation collect?

• How do you intend to process this data

• How much of this information falls under the ‘special data’ category?  

Determine the accuracy of your data

• Is the information up to date?

• Do you still require this information?

• Are you missing important information from your data storage?

Ensure the security of your data storage solution

• What systems do you use to store data?

• Do you use digital storage solutions?

• What data security measures are in place, or do you need to implement them?

Once you have reviewed your current processes, you can begin to implement best practices for data handling, ensuring that you are compliant with data protection laws:

• Keep data up to date

• Ensure your data is stored securely. If stored digitally, there’s a few things you need to consider such as,

  • Strong password management

  • Two-factor authentication

  • Access controls to limit access to only those who are required to see this data

  • Encryption

  • Regular software updates

• Cleanse your data before entering your system

• Train your employees on proper data handling and security

• Create a Data Protection Policy and relevant privacy notices

• Remove data when no longer needed

Who enforces data protection laws?

The ICO (the Information Commissioner Office) is an independent authority responsible for the regulation of data protection in the UK.

Individuals can make a data protection complaint to the ICO if they believe their data is being mishandled.

The ICO have several ways in which they can intervene and act against an organisation including:

• Educating organisations on how best to store and handle data

• Requesting an organisation reviews their policies and procedures

• Record complaints (if multiple) to use as a case regarding an organisation not following the law

• Take regulatory action

• Data protection fines with a higher maximum of £17.5 million or 4% of the total annual worldwide turnover in the preceding financial year, whichever is higher.

• Reprimands

• Enforcement notices

For more serious data breaches, individuals may even take legal action against an organisation which could result in reputational damage to a business and hefty legal fees.

But despite the ICO having authority, they’re also available to organisations requiring support and guidance.

Securely store employee records with BrightHR

Keep confidential and sensitive information secure with cloud-based HR document storage with our award-winning HR software.

Our unlimited document storage feature allows you to store as many documents as you may need safely and securely.

With all your important information stored within the cloud, you won’t have to worry about filing paperwork or juggling between different desktop files. Everything can be accessed by those with authorisation in just a few clicks. In one handy place you and your employees will be able to access, edit, and download files such as employment contracts, return-to-work notes, HR policies and more.

See what BrightHR’s document storage can do for you and ensure legal compliance with the GDPR and Data Protection legislation with support from our in-house employment law advice line. Book a free demo today.