international employment law firm alliance L&E Global
United Kingdom

UK: Guidance on Data Protection

Authors: Frances Ross and Corinna Harris

The first part of the guidance on processing workers’ health data explains the key rules relating to: 

  • Complying with the stricter statutory requirements for processing special category data 
  • Providing employees with information about the processing of their data 
  • Performing a data protection impact assessment before processing any health data 
  • Data minimisation and security 

The second part focuses on how data protection law applies to specific workplace scenarios, including sickness absence records and occupational health schemes, conducting drugs and alcohol testing, and how to approach sharing employee health data. The ICO sets out recommended good practices that it expects employers to adopt in order to comply with legal requirements. The guidance also contains a set of checklists. 

Practical Point

The ICO’s guidance on email and security has been published to help organisations understand the law and good practices around protecting personal information when sending bulk emails.  

In addition, the ICO has published the first phase of draft guidance on biometric data. This explains how data protection law applies when biometric data is used in biometric recognition systems. The consultation on the first phase of this guidance closes on 20 October 2023, with the second phase opening for a call of evidence in 2024.