← More Toolbox Talks
📱
Best viewed in landscape & full screen
Rotate your phone sideways, then tap the button below for the best experience. You can also swipe left/right to navigate slides.
Continue without full screen
📋 Toolbox Talk  ·  Employment Rights

Data Protection
at Work

What your employer can collect and monitor, your right to access your data, UK GDPR at work, and how to raise a complaint with the ICO.

✅ Verified August 2026📚 UK GDPR · Data Protection Act 2018🇬🇧 Applies across the UKukworkrights.co.uk
Your rights

Your data protection rights at work

  • Right of access (SAR): you can request a copy of all personal data your employer holds about you — free of charge, within 1 month
  • Right to rectification: incorrect personal data must be corrected
  • Right to erasure: in some circumstances you can request deletion of your data
  • Right to object: you can object to certain types of processing
  • Right to restrict processing: you can ask for data use to be limited while a dispute is resolved
  • Special category data (health, biometrics, trade union membership, ethnicity) gets stronger protection — your employer needs a lawful basis and additional justification to process it

💡 Subject Access Request

You can request everything — emails about you, performance notes, HR records, CCTV footage. Your employer has 1 month to respond. No charge unless the request is excessive.
Monitoring at work

What can your employer monitor?

✅ Lawful monitoring (with transparency)

  • Email and internet use on work devices — if clearly disclosed in policy
  • CCTV in communal/public areas — must be signposted
  • Call recording for training or quality purposes — must be disclosed
  • Access logs, timekeeping systems

⚠ Generally unlawful

  • Covert monitoring of personal devices
  • Surveillance in changing rooms or toilets
  • Monitoring without telling employees — proportionality required
  • Accessing private emails or messages without consent

✅ Key principle

Monitoring must be proportionate, transparent and necessary. Your employer must have a monitoring policy and tell you what they monitor.
Taking action

What to do if your data rights are breached

1
Submit a Subject Access Request (SAR)

Send it in writing to HR. Your employer must respond within 1 month. If they refuse or delay, that is itself a breach.

2
Raise it internally

If data has been misused or shared without lawful basis, raise a formal grievance with HR or your employer's Data Protection Officer (DPO).

3
Report to the ICO

The Information Commissioner's Office investigates data protection breaches. Report at ico.org.uk or call 0303 123 1113. Free and confidential.

4
Claim compensation

You can bring a claim in the courts for compensation if you've suffered damage (financial or non-financial) from a data protection breach. Seek legal advice.

Common questions

Frequently asked questions

Can my employer share my data with third parties?
Only with a lawful basis — for example, your consent, a legal obligation, or a legitimate interest that outweighs your privacy rights. They must tell you about third-party sharing in their privacy notice. Sharing for any other purpose is likely unlawful.
Can I be monitored working from home?
Your employer can monitor work devices and work systems at home — but must tell you what they monitor. Covert monitoring of your home or personal devices is not lawful. Any monitoring must be proportionate and documented in a clear policy.
What is a Data Protection Officer (DPO)?
Larger employers and those processing sensitive data must appoint a DPO. You can contact your DPO directly with data protection concerns — they must respond and are independent of your employer.
Can my employer keep my data after I leave?
Yes, but only for as long as necessary and for a legitimate purpose (e.g. legal obligation to retain payroll records for 6 years). After that, it must be deleted. You can request deletion once the retention period has passed.
Free rights guidance

Check your data
protection rights

Get personalised guidance on SARs, monitoring, ICO complaints and data breaches at work.

ICO — Data protection
0303 123 1113
ico.org.uk
ACAS
0300 123 1100
acas.org.uk
Citizens Advice
0800 144 8848
citizensadvice.org.uk
UK Work Rights — Free checker
Data Protection Checker
ukworkrights.co.uk/dataprotection.html

General rights guidance only — not legal advice · Verified August 2026 · © UK Work Rights Ltd · Company No. 17228507 · ICO Registration No. ZC239465 · Registered office: 71–75 Shelton Street, Covent Garden, London, WC2H 9JQ  ·  hello@ukworkrights.co.uk
Directed and published by Matt Thompson, founder
Content is produced with AI assistance and checked against primary sources including GOV.UK, ACAS and legislation.gov.uk before publication.
Contains public sector information licensed under the Open Government Licence v3.0.