-Why HR teams may be in breach of data protection regulations

About the role

Despite 87% of UK firms claiming to be "fully compliant" with GDPR, a recent study by HRCIP found one-third of HR departments admitting breaches by failing to delete personal data after retention periods expire.

Key findings

• Of 137 HR bodies surveyed, 83% claimed to have set retention periods for employee, leaver and candidate data as per GDPR guidelines, but only 69% have put these into practice — meaning 31% are not deleting personal information efficiently following the expiry of retention periods
• Only 31% of respondents enabled employees' access to their own data, falling to 7% for job candidates and 4% for ex-staff
• 51% of HR teams are relying on calendar alerts or sticky notes to remind them to update data, rather than using automated systems
• 87% of respondents previously said they were "very" or "somewhat" confident their HR departments were fully compliant — suggesting underlying confusion about what exactly is required under the new legislation

Regulatory context

The EU General Data Protection Regulation (GDPR) came into force on 25th May 2018, imposing strict requirements on how personal information can be handled and stored. A big focus is 'data minimisation' — the rule that you cannot hold an individual's personal data for longer than necessary, nor can you hold information beyond the purpose for which you have collected it.

Under the GDPR, "personal data shall be kept for no longer than is necessary for the purposes for which it is being processed," and storage "should be limited to a strict minimum." The study suggests more clarity is needed on what constitutes a "strict minimum" for employee, applicant and leaver data to assist HR teams in becoming more compliant.

Outlook

According to another HRCIP study looking into HR professionals' top priorities for the new year, 89% of respondents said GDPR is top of their agenda, suggesting further improvements in compliance may follow.