Who it is for
Employers who need to tell applicants, employees, workers and contractors how their personal data is used.
What it covers
- What data you collect, where it comes from, and what people have to give you.
- Why you process it, including automated decisions.
- Lawful bases, including recognised legitimate interests, and the conditions for health and other special category data.
- Who you share data with, and international transfers.
- How long you keep it, with a guide retention schedule.
- People's rights, how you respond, data security, breaches and complaints.
The law it reflects
Checked against the law in Great Britain (England, Wales and Scotland) as at 19 October 2026.
- It reflects the UK GDPR and the Data Protection Act 2018 as amended by the Data (Use and Access) Act 2025, including recognised legitimate interests and the rules on automated decision-making (both in force since 5 February 2026).
- Since 19 June 2026, organisations must have a process for handling data protection complaints, and acknowledge a complaint within 30 days.
- The Information Commissioner's Office became the Information Commission on 30 September 2026. The notice uses the new name.
- Subject access requests: one month to respond, extendable by two months for complex requests, with the clock paused while you wait for a clarification you need.
Before you use it
It is a starting point, not legal advice. Fill in the placeholders, set your own timescales, and check it fits how your organisation actually works. Take advice if a case is complex, could involve discrimination, or may end up at a tribunal. Northern Ireland has different rules in several areas.
Need more? See the Employment Contract Pack. 9 documents for the start of employment: the contract, an offer letter, a right to work check record, a new starter checklist and a contract variation letter. £199 + VAT, one-off.