📱

Best viewed in landscape & full screen

Rotate your phone sideways, then tap the button below for the best experience. You can also swipe left/right to navigate slides.

Continue without full screen

📋 Toolbox Talk · Employment Rights

Data Protection
at Work

What your employer can collect and monitor, your right to access your data, UK GDPR at work, and how to raise a complaint with the ICO.

📅 Last reviewed: August 2026📚 UK GDPR · Data Protection Act 2018🇬🇧 Applies across the UKukworkrights.co.uk

⬇ Download free PDF

Your rights

Your data protection rights at work

Right of access (SAR): you can request a copy of all personal data your employer holds about you — free of charge, within 1 month
Right to rectification: incorrect personal data must be corrected
Right to erasure: in some circumstances you can request deletion of your data
Right to object: you can object to certain types of processing
Right to restrict processing: you can ask for data use to be limited while a dispute is resolved
Special category data (health, biometrics, trade union membership, ethnicity) gets stronger protection — your employer needs a lawful basis and additional justification to process it

💡 Subject Access Request

You can request everything — emails about you, performance notes, HR records, CCTV footage. Your employer has 1 month to respond. No charge unless the request is excessive.

Monitoring at work

What can your employer monitor?

✅ Lawful monitoring (with transparency)

Email and internet use on work devices — if clearly disclosed in policy
CCTV in communal/public areas — must be signposted
Call recording for training or quality purposes — must be disclosed
Access logs, timekeeping systems

⚠ Generally unlawful

Covert monitoring of personal devices
Surveillance in changing rooms or toilets
Monitoring without telling employees — proportionality required
Accessing private emails or messages without consent

✅ Key principle

Monitoring must be proportionate, transparent and necessary. Your employer must have a monitoring policy and tell you what they monitor.

Taking action

What to do if your data rights are breached

Submit a Subject Access Request (SAR)

Send it in writing to HR. Your employer must respond within 1 month. If they refuse or delay, that is itself a breach.

Raise it internally

If data has been misused or shared without lawful basis, raise a formal grievance with HR or your employer's Data Protection Officer (DPO).

Report to the ICO

The Information Commissioner's Office investigates data protection breaches. Report at ico.org.uk or call 0303 123 1113. Free and confidential.

Claim compensation

You can bring a claim in the courts for compensation if you've suffered damage (financial or non-financial) from a data protection breach. Seek legal advice.

Common questions

Frequently asked questions

Can my employer share my data with third parties?

Only with a lawful basis — for example, your consent, a legal obligation, or a legitimate interest that outweighs your privacy rights. They must tell you about third-party sharing in their privacy notice. Sharing for any other purpose is likely unlawful.

Can I be monitored working from home?

Your employer can monitor work devices and work systems at home — but must tell you what they monitor. Covert monitoring of your home or personal devices is not lawful. Any monitoring must be proportionate and documented in a clear policy.

What is a Data Protection Officer (DPO)?

Larger employers and those processing sensitive data must appoint a DPO. You can contact your DPO directly with data protection concerns — they must respond and are independent of your employer.

Can my employer keep my data after I leave?

Yes, but only for as long as necessary and for a legitimate purpose (e.g. legal obligation to retain payroll records for 6 years). After that, it must be deleted. You can request deletion once the retention period has passed.

Free rights guidance

Check your data
protection rights

Get plain-English guidance on your rights and your employer's legal duties.

ICO — Data protection

0303 123 1113

ico.org.uk

ACAS

0300 123 1100

acas.org.uk

Citizens Advice

0800 144 8848

citizensadvice.org.uk

UK Work Rights — Free guide

How Do I Make a Subject Access Request? 2026 UK Guide

ukworkrights.co.uk/guide-subject-access-requests.html

General rights guidance only — not legal advice · © UK Work Rights Ltd · Company No. 17228507 · ICO Registration No. ZC239465 · Registered office: 71–75 Shelton Street, Covent Garden, London, WC2H 9JQ · hello@ukworkrights.co.uk
Published by UK Work Rights Ltd
Drafted with AI assistance, using official sources.
Contains public sector information licensed under the Open Government Licence v3.0.

Keep going