{"id":2630,"date":"2017-08-23T00:00:00","date_gmt":"2017-08-23T00:00:00","guid":{"rendered":"https:\/\/www.sage.com\/en-gb\/blog\/gdpr-what-employers-need-to-know\/"},"modified":"2026-08-13T13:28:02","modified_gmt":"2026-08-13T12:28:02","slug":"gdpr-what-employers-need-to-know","status":"publish","type":"post","link":"https:\/\/www.sage.com\/en-gb\/blog\/gdpr-what-employers-need-to-know\/","title":{"rendered":"GDPR: What employers need to know"},"content":{"rendered":"
\n\t
\n\t\t
\n\t\t\t
\n\t\t\t\t\t\t\t
\n\t\t\t\t\t\t\t\t\t\t
\n\t\t\t\t\t\t\tStrategy, Legal & Operations<\/a>\t\t\t\t\t\t<\/div>\n\t\t\t\t\n\t\t\t\t
\n\t\t\t\t\t

\n\t\t\t\t\t\tGDPR: What employers need to know\t\t\t\t\t<\/h1>\n\t\t\t\t<\/div>\n\n\t\t\t\t\t\t\t\t\t

\n\t\t\t\t\t\t\t\t\t\t\t<\/p>\n\t\t\t\t\n\t\t\t\t\n\t\t\t\t\n\t\t\t<\/div>\n\n\t\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t<\/div>\n\t\t

\n\t\t
\n\t\t\tPublished
\n\t
\n\t\t
\n\t\t\t\t\t\t\t
\n\t\t\t\t\t\n\t\t
\n\t\t\t\n\t\t\t\t\"\"\t\t\t\tKeir Thomas-Bryant<\/span>\n\t\t\t<\/a>\n\n\t\t\t\t\t<\/div>\n\n\t\t\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t<\/div>\n<\/div>\n\n\n\n
\n
<\/video><\/div><\/div>\n<\/div><\/figure>\n\n\n\n

The EU’s General Data Protection Regulation (GDPR) will come into force on 25 May 2018, bringing about a number of significant changes in how organisations process, manage and store personal data. The UK will still be a member of the EU, so British employers need to be prepared for the impact of the GDPR, despite Brexit.<\/p>\n\n\n\n

What is the GDPR?<\/h2>\n\n\n\n

The GDPR<\/a> is a major update to the EU’s existing data protection rules, designed to reflect some of the defining trends of recent years such as globalisation and accelerating growth in digital technology. Its intention is to strengthen and unify data protection for individuals within the EU.<\/p>\n\n\n\n

In addition to EU-based companies, it will apply to any company processing the personal data of EU citizens in relation to the delivery of goods or services or behaviour monitoring.<\/p>\n\n\n\n

What it means for employers<\/h2>\n\n\n\n

The GDPR will enforce a number of changes that employers – specifically HR departments – will need to be aware of when processing and handling employee data.<\/p>\n\n\n\n

Among these is the concept of ‘data protection by design’, which requires employers to make data protection risks a key part of the process of designing and operating policies, processes, products and services. The GDPR also mandates ‘data protection by default’, which states that only the personal data required for each specific purpose should be collected and processed.<\/p>\n\n\n\n

Another concept that falls under the umbrella of the GDPR is consent. Questions have been raised about the idea of employers processing personal data based on employee consent, given the imbalance of power in the employer\/employee relationship. When the GDPR takes effect, organisations will have to comply with stricter requirements to ensure that consent is “freely given, informed, specific and explicit”.<\/p>\n\n\n\n

As far as providing information for members of staff and job applicants is concerned, the new regulations will require employers to go into much more detail. From 25 May 2018, information that organisations will have to provide will include:<\/p>\n\n\n\n