Employee privacy notice: what it must say and when to give it

The rule: Articles 12, 13 and 14 of the UK GDPR, as amended in 2026

An employer's duty to tell its staff how it uses their personal data comes from Articles 12 to 14 of the UK GDPR, and it applies across the UK. Article 13 covers what the employer collects from the member of staff themselves – the application form, the new starter form, bank details, a sickness self-certificate – and the information is due “at the time when personal data are obtained”. Article 14 covers what comes from someone else, and the information is due “within a reasonable period after obtaining the personal data, but at the latest within one month”, or sooner: at the first communication with the person if the data is used to contact them, or when it is first disclosed to another recipient.

For an employer, Article 14 data includes an occupational health provider's report, a candidate's details passed on by a recruitment agency, the records that arrive from a previous employer when staff transfer under TUPE, and a status check made through the DBS Update Service. A confidential reference is not an example. Paragraph 24 of Schedule 2 to the Data Protection Act 2018 says the listed provisions “do not apply to personal data consisting of a reference given (or to be given) in confidence” for a person's education, training or employment, a placement as a volunteer, an appointment to an office or the provision of a service, and paragraph 18 lists Article 13(1) to (3) and Article 14(1) to (4) among them.

Article 12(1) sets the standard for both: the information must be given “in a concise, transparent, intelligible and easily accessible form, using clear and plain language”, in writing or by other means, including, where appropriate, electronically. A staff intranet page, a printed copy in the induction pack and a link in the contract can all meet that; a forty-page policy nobody can find does not.

The Data (Use and Access) Act 2025 and the regulations made under it changed the law behind the notice three times in 2026:

• 5 February 2026. Article 6(1) gained point (ea), “processing is necessary for the purposes of a recognised legitimate interest”, and the automated decision-making item in Article 13(2)(f) now refers to decisions “subject to the requirement to provide safeguards under Article 22C”. The one-month clock for responding to rights requests moved into Article 12A on the same date.
• 19 June 2026. Article 13(2)(ca) requires the notice to state “the right to make a complaint to the controller under section 164A of the 2018 Act”, and Article 14(2)(da) says the same for data obtained from others. Under section 164A of the Data Protection Act 2018 the employer must make complaints easy to make, “by taking steps such as providing a complaint form which can be completed electronically and by other means”, must “acknowledge receipt of the complaint within the period of 30 days beginning when the complaint is received”, and must “without undue delay” take appropriate steps to respond and tell the complainant the outcome. Regulation 7 of S.I. 2026/82 applies the acknowledgement and response duties to complaints received on or after 19 June 2026.
• 30 September 2026. Article 13(2)(d) now reads “the right to make a complaint to the Commission under section 165 of the 2018 Act”. The regulator is the Information Commission, still known as the ICO, and a notice that names the Information Commissioner or the Information Commissioner's Office as the place to complain is out of date.

A staff notice written before 2026, or copied from a template that predates these changes, therefore needs checking line by line against the revised text of Articles 13 and 14.

Who the notice is for, and when to give it

The notice is owed to everyone whose personal data the organisation holds as an employer:

• Employees and workers, including part-time, sessional, bank and casual staff and apprentices.
• Agency workers placed with you. Their agency employs them, but you collect and hold information about them – shifts worked, induction records, any concern raised about their conduct – and what you receive from the agency is Article 14 data.
• Applicants, who give you their data at application. Many employers give a short recruitment notice with the application form and the full staff notice on appointment.
• Former staff whose records you keep after they leave.
• Volunteers, governors and trustees are usually better served by their own notices, because what you hold and why is different. Our charity privacy notice guide covers volunteers, and the Department for Education's privacy notice model documents include “Privacy notice: suggested text for school and trust governance roles” alongside “Privacy notice: suggested text for the school workforce”.

When. Article 13(1) ties the notice to the moment of collection, so in practice it is given at application and again on joining, when the bulk of a member of staff's data is collected. Article 13(4) says the duty does not apply “to the extent that the data subject already has the information”, so it need not be reissued every time a form is filled in. What does trigger it is a new use: under Article 13(3), before processing staff data “for a purpose other than that for which the personal data were collected”, the employer must tell staff about that purpose first. Introducing a new monitoring tool, an HR system that scores absence or a new sharing arrangement is that kind of change.

For schools in England, the DfE's Issuing privacy notices: guidance for schools and local authorities (updated 13 August 2026) lists the moments for staff: “when they apply for a role, accept a contract, are appraised, or leave the school”, adds “making sure you make existing staff members aware of the privacy notice at the start of each school year” and “making the notice visible on the staff notice board and intranet”, and says the data protection officer should review notices “at least annually” and “whenever you make a significant change to how you process personal data”. Charities and care providers have no equivalent rule, but the same rhythm works for them.

Keeping it true. The notice must describe what the organisation actually does, so it should be checked against the record of processing activities whenever either changes. The Information Commission's guidance on monitoring workers says “You should regularly review your monitoring practices and you must keep privacy information up-to-date. You must also tell workers when you introduce changes.” Keep each version with its date, so that if a member of staff later asks what they were told in a given year, you can show them.

What an employee privacy notice must say, item by item

Articles 13 and 14 set the contents. Applied to staff, the notice needs:

• Who the employer is and how to contact it (Article 13(1)(a)). In an academy trust the employer is the trust, not the school; in a group of care homes it is the legal entity that employs the staff, usually the registered provider.
• The data protection officer's contact details, where there is one (Article 13(1)(b)). Article 37(1)(a) requires one where “the processing is carried out by a public authority or body”, which includes maintained schools and academy trusts.
• What data you hold: identity and contact details, emergency contacts and next of kin, bank, tax and pension details, right to work and qualification records, the contract, pay and hours, absence and leave, performance and training, disciplinary and grievance records, health and occupational health information, DBS checks, equality monitoring, and information from monitoring email, devices, messaging and CCTV. Article 14(1)(d) requires “the categories of personal data concerned” for data from other sources, and the staff notice is clearer if it lists them for all.
• The purposes and the lawful basis for each (Article 13(1)(c)), and where the basis is legitimate interests under Article 6(1)(f), what those interests are (Article 13(1)(d)). The next section sets out which bases employers use.
• Who you share it with (Article 13(1)(e)), which typically means HMRC, the pension scheme, the payroll, HR and rota software providers that process data for you, the occupational health provider, insurers and legal advisers, a regulator that asks for staff information, the local authority (in England, its designated officer) or the Disclosure and Barring Service where a safeguarding concern about a member of staff is referred, and for schools in England the local authority and the DfE.
• Transfers outside the UK (Article 13(1)(f)), for example where an HR or payroll system is hosted abroad, and the safeguards relied on.
• How long you keep it: Article 13(2)(a) asks for “the period for which the personal data will be stored, or if that is not possible, the criteria used to determine that period”. Refer to the retention schedule rather than writing “as long as necessary”; our guide to how long to keep employee records covers the statutory periods.
• Staff rights (Article 13(2)(b)): access, rectification, erasure, restriction, objection and portability, and how to use them. Under Article 12A a request is answered within one month of “the relevant time”, usually when it is received, and the employer may extend that by two further months where the complexity or number of requests makes it necessary; see the subject access request policy guide.
• The right to withdraw consent (Article 13(2)(c)), only for anything that genuinely rests on consent.
• The right to complain to the employer (Article 13(2)(ca)), with the route: section 164A gives as its example “a complaint form which can be completed electronically and by other means”, and the notice can say complaints are acknowledged within 30 days.
• The right to complain to the Information Commission (Article 13(2)(d)).
• Whether staff have to provide the data (Article 13(2)(e)): “whether the provision of personal data is a statutory or contractual requirement” and “the possible consequences of failure to provide such data”, such as being unable to pay someone without bank details or to employ them without the checks the law requires.
• Automated decision-making (Article 13(2)(f)), for example a recruitment tool that sifts applications or a rota system that allocates shifts with no person involved.
• Where data came from, for Article 14 data: “from which source the personal data originate” (Article 14(2)(f)).

The purposes usually take up the most room. A staff notice typically lists them in plain words: paying staff and managing pension and other benefits, recruitment and right to work checks, training and development, performance management, managing sickness absence and medical information, health and safety, meeting legal obligations under employment law and to regulators, and bringing or defending legal claims. It then names the third parties that receive staff data, such as the payroll bureau, the pension provider and occupational health, and says how the organisation will protect that data and when it will delete it.

Lawful bases, health information and DBS checks

Consent is rarely the basis for employment processing. Recital 43 of the UK GDPR says “consent should not provide a valid legal ground for the processing of personal data in a specific case where there is a clear imbalance between the data subject and the controller, in particular where the controller is a public authority”. Staff cannot freely refuse to have their pay processed, so a notice that asks them to “consent to GDPR” misdescribes the law. Nothing in Articles 12 to 14 requires staff to sign the notice either: the duty is the employer's, to provide the information. Keep consent for things that are genuinely optional, such as a staff photograph on the website.

The bases an employer normally uses are in Article 6(1):

• (b) contract: processing “necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract” – pay, hours, leave, the contract itself, and the recruitment steps before it.
• (c) legal obligation: processing “necessary for compliance with a legal obligation to which the controller is subject” – tax, statutory pay, the checks the law requires before someone starts work, and for schools in England the school workforce census. The DfE's school workforce model notice gives the wording: “We are required to share information about our school employees with the Department for Education (DfE) under section 5 of the Education (Supply of Information about the School Workforce) (England) Regulations 2007 and amendments.”
• (e) public task: “a task of the controller carried out in the public interest”, for maintained schools and academy trusts.
• (f) legitimate interests, for example for CCTV or IT security, and since 5 February 2026 (ea) recognised legitimate interests, which covers only the conditions listed in Annex 1, such as preventing crime or safeguarding a vulnerable individual: both are available to independent schools, charities and care providers. Article 6(1) says both “shall not apply to processing carried out by public authorities in the performance of their tasks”. Under section 7 of the Data Protection Act 2018 a public authority includes one defined by the Freedom of Information Act 2000, which covers the governing body of a maintained school and the proprietor of an academy, and it counts as one only “when performing a task carried out in the public interest or in the exercise of official authority vested in it”.

Health, trade union and other special category information needs a condition under Article 9 as well as an Article 6 basis. For sickness absence, statutory sick pay, occupational health and reasonable adjustments, the condition is usually Article 9(2)(b), processing “in the field of employment and social security and social protection law”, which section 10(2) of the Data Protection Act 2018 makes depend on a condition in Part 1 of Schedule 1. Paragraph 1 of Schedule 1 is met only if, “when the processing is carried out, the controller has an appropriate policy document in place”, and paragraph 39 says that document explains how the employer complies with the principles and its policies on “the retention and erasure of personal data processed in reliance on the condition”. The notice names the condition; the policy document is a separate paper.

Equality monitoring of ethnic origin, religion or belief, health and sexual orientation can rest on paragraph 8 of Schedule 1, equality of opportunity or treatment, a Part 2 condition that under paragraph 5 also needs an appropriate policy document. That condition does not cover “measures or decisions with respect to a particular data subject”, and it stops applying once a member of staff gives written notice requiring the employer not to process their data and the reasonable period given in the notice has ended. Say both in the notice, and keep the questions optional.

DBS checks and other criminal records information fall under Article 10: outside official authority they need authorisation by law, which section 10(5) gives only where the processing “meets a condition in Part 1, 2 or 3 of Schedule 1”. Where the law requires the check for the role, that can be the employment condition in paragraph 1, again with an appropriate policy document. Say in the notice what level of check the role needs, who sees the result and what is kept; the DBS record keeping guide covers what may be kept and for how long.

What most staff privacy notices miss

• Monitoring. Email, internet use, phones and laptops, door entry, CCTV and work messaging are all processing of staff data, and the notice is where staff learn about it. The Information Commission's Data protection and monitoring workers says “you must tell workers about monitoring in a way that is accessible and easy to understand” and “You must make sure workers are aware of how and what personal information you are collecting during any monitoring”. The guidance is marked as under review following the Data (Use and Access) Act. Our guide to monitoring staff communications covers what an employer may check and the tests it must meet.
• Work messaging. Name the systems that carry staff messages – email, Teams, the staff messaging app – and for each say what is kept, for how long and who can see it. A notice can only be accurate about systems the employer runs; it cannot say how long messages in a group on staff's personal phones are kept, because the employer does not hold them.
• References. The notice duties do not apply to a reference given in confidence (Schedule 2 paragraph 24, above), and the same exemption reaches the right of access in Article 15(1) to (3). A notice can still tell staff, as good practice, that the employer takes up references before appointment and gives them when staff leave; it should not promise them a copy of a confidential reference.
• Occupational health and sickness. Say who the provider is, what the employer receives back and the Schedule 1 condition relied on. The provider's report is Article 14 data, so its source belongs in the notice.
• Safeguarding records about staff. Schools, care providers and charities working with children or adults at risk keep records of allegations and concerns about staff and may share them with the local authority (in England, its designated officer), the Disclosure and Barring Service or a regulator. The notice should say so in plain terms; the periods are in how long to keep employee records.
• Automated decisions in recruitment and rota tools. Since 5 February 2026, Article 13(2)(f) asks about automated decision-making “which is subject to the requirement to provide safeguards under Article 22C”. Older templates that cite “Article 22(1) and (4)” use superseded wording.

The DfE school workforce model is out of date on both 2026 changes. The DfE's “Privacy notice: suggested text for the school workforce”, updated for 2026 to 2027 on 13 August 2026, still lists “the right to complain to the Information Commissioner if you feel we have not used your information in the right way” and tells staff to “raise your concern with us in the first instance or directly to the Information Commissioner’s Office”. It does not set out the right to complain to the school under section 164A, the complaint route or the 30-day acknowledgement, and it does not name the Information Commission. A school that adopts it unchanged has a notice that does not state the Article 13(2)(ca) right in terms and misnames the regulator under Article 13(2)(d). The model itself says “You must review and amend to reflect local needs and circumstances”; amend those two lines as well. The issuing guidance adds that “Your school’s privacy notice must include what personal data your school shares with DfE”, which the model's census wording does. For pupils and parents, see privacy notice for schools.

Where ComplyChat fits, and where it does not

Start with what it is not. ComplyChat does not write, check or replace your privacy notice, and it is not an HR, payroll or rota system. It is not end-to-end encrypted, by design: the organisation has to be able to hold the record. ComplyChat is working towards Cyber Essentials and ISO 27001 certification and holds neither yet.

Where it helps is the messaging line in the notice, the one most employers find hardest to write truthfully. A notice can describe a channel the organisation runs: who is in it, that everyone added to a channel is told it is on the record and can object or leave at any time, that messages are recorded on the server as they are sent rather than gathered from handsets afterwards, and, on paid plans once the organisation's tenant is connected, that conversations are kept under the retention schedules within its own Microsoft 365 subscription. A mobile number verified by SMS is the identity, so bank and agency staff and others without a work account can be in the same channel and covered by the same sentence of the notice. A staff group on personal phones can be described only as something the employer does not hold.

Free is for personal conversations: one private group channel, direct messages, up to 25 people and three calendar months of recent history, with no Microsoft 365 archive, so it cannot meet a retention duty or be the system a staff notice describes as the record.

A question for the next leadership or board meeting: could your staff privacy notice say, accurately, where last month's work messages are kept and who can see them?

Questions people ask

What are the legal requirements for a privacy notice?

Articles 13 and 14 of the UK GDPR list what a privacy notice must contain, and Article 12(1) requires it to be given “in a concise, transparent, intelligible and easily accessible form, using clear and plain language”. For staff it is due “at the time when personal data are obtained” (Article 13(1)), or, where the data comes from someone else such as an occupational health provider or an agency, within a reasonable period and at the latest within one month (Article 14(3)). Since 19 June 2026 it must include the right to complain to the employer, and since 30 September 2026 it must name the Information Commission as the regulator.

When should a staff privacy notice be given?

At the time the data is collected, which for staff means at application and on joining, and again before the employer uses their data for any new purpose (Article 13(3)). For schools in England, the DfE adds “when they apply for a role, accept a contract, are appraised, or leave the school”, and making existing staff aware of the notice “at the start of each school year”.

Is there an example or template employee privacy notice?

For schools in England, the DfE publishes “Privacy notice: suggested text for the school workforce”, updated on 13 August 2026; it still names the Information Commissioner and does not set out the right to complain to the school under section 164A, so amend both before using it. Charities and care providers have no sector model like the DfE's. Whatever the starting point, check it against the current Articles 13 and 14, which changed on 5 February, 19 June and 30 September 2026; the outline in section 03 of this guide covers every item.

Do employees have to sign or consent to a privacy notice?

No. Articles 12 to 14 of the UK GDPR require the employer to provide the information; they do not require staff to sign it or agree to it. Consent is rarely the right basis for employment processing: recital 43 says consent should not be a valid legal ground “where there is a clear imbalance between the data subject and the controller”, so most staff data rests on contract, legal obligation, public task or legitimate interests.

Is it illegal to use CCTV on staff?

CCTV that records staff is not unlawful in itself, but the employer needs a lawful basis under Article 6 of the UK GDPR and must tell staff about it, including its purposes and legal basis, under Article 13(1)(c). A public authority such as a maintained school or academy trust cannot rely on legitimate interests for its public tasks. The Information Commission's monitoring workers guidance sets out the further tests; our monitoring staff communications guide covers them.

Official guidance and your next step

The rules are in Article 13 and Article 14 of the UK GDPR as revised, with Article 12, Article 12A, Article 6, Article 9 and Article 10; section 164A of the Data Protection Act 2018, its Schedule 1 conditions and the Schedule 2 exemption for confidential references. Quotations from legislation.gov.uk are from the revised text as published on 3 November 2026. For schools in England, the DfE's privacy notice model documents and issuing guidance were updated on 13 August 2026. The Information Commission's monitoring workers guidance, quoted as published on 1 November 2026, is under review following the Data (Use and Access) Act, so check any regulator guidance against the Articles themselves.

This guide covers the UK and is not legal advice. The DfE models and issuing guidance apply to schools in England.

Then do one thing: open your current staff privacy notice and check four lines – the right to complain to you and how, the Information Commission named as the regulator, what you tell staff about monitoring and messaging, and the date of the version. If any of the four is missing, that is the first edit.