Data protection

What is data protection?

Protection of data encompasses the actions and measures implemented to ensure the security, confidentiality, integrity, and availability of data. Its primary aim is to reduce the risks of unauthorized access, manipulation, theft, loss, or damage to data.

Organizations are obligated to perpetually enhance the quality of their personal data protection processes, as well as safeguard other types of information (e.g., financial data of a company), adapting to evolving threats and regulatory demands.

What constitutes personal data?

Personal data encompasses information relating to either an identified or potentially identifiable living person. This category not only includes direct identifiers but also aggregates of information that, when pieced together, can reveal the identity of an individual.

Examples of personal data include:

• Identification data (full name, residential address, identification numbers, passport number, or ID card number, etc.);
• Demographic data (gender, marital status, nationality);
• Financial data (bank account number, credit card number, financial transaction history);
• Professional data (job position, employment history);
• Medical data (medical history);
• Biometric data (fingerprints, retina pattern, voice);
• Geolocation data (history of mobile device locations, etc.).

Please note:

• Encrypted or pseudonymized data that can lead to the re-identification of an individual still qualifies as personal data.
• Irreversibly anonymized data that effectively prevents the identification of an individual does not constitute personal data.

Personal data protection and GDPR

Within personal data, a particular subset known as special category or sensitive data stands out. Under Article 9 of the General Data Protection Regulation (GDPR), it includes data revealing:

• racial or ethnic origin;
• political opinions;
• religious or philosophical beliefs;
• trade union membership;
• genetic data;
• biometric data used to identify a person (fingerprints, iris scans);
• health data;
• a person's sex life or sexual orientation.

The GDPR requires both private and public organizations that handle personal data to adhere to its standards across all processing activities. Consequently, HR departments need to ensure that their personal data processing practices fully comply with legal requirements. Failure to do so can result in severe financial penalties for the company.

What are the data protection processes and regulations in a company?

Company data protection processes encompass measures to safeguard the security and confidentiality of personal data, among other types, that are collected, processed, and stored. These measures cover a range of actions, including:

• Encrypting data to make it unreadable to unauthorized individuals using mathematical algorithms;
• Managing access, i.e., controlling who has access to data by establishing a data administrator and checking what resources are shared;
• Security audits, i.e., analyzing logs and confirming compliance with security policies and legal regulations;
• Training employees on data security, including cybersecurity;
• Controlling and responding to security incidents (hacking attempts, data leaks, ransomware attacks);
• Adapting company processes to legal (GDPR) and industry security standards.

What is cybersecurity in data protection?

Cybersecurity involves various forms of protecting infrastructure, networks, IoT, cloud, and applications from cyberattacks. Since both individuals and organizations can be targets of cyberattacks, numerous protective measures have been developed, from simple password management to the use of advanced security tools supported by AI and ML.

Cybersecurity enables:

• Safe Internet use, such as shopping or banking transactions;
• Smooth provision of public sector services (medical services, rail transport, electricity transmission, etc.);
• Defense of internal networks in companies against hacker or hacktivist attacks;
• Protection of smart gadgets, production machines, routers, etc., against hacker attacks;
• Data protection in the cloud;
• Safe use of various types of software on different end devices.

Tools for ensuring cybersecurity include firewalls, antivirus and anti-malware software, encryption tools, Single Sign-On (SSO) systems, and two-factor authentication (2FA).

Data protection in the UK

In the UK, employee data is governed by the UK GDPR and the Data Protection Act 2018, and the Information Commissioner's Office (ICO) is the regulator. For HR, this means a few practical obligations:

• process employee and candidate data on a lawful basis, such as the employment contract or a legal obligation, and only as much as needed;
• tell people what data you hold and why in a privacy notice;
• respond to a data subject access request (DSAR) within one month;
• report personal data breaches that pose a risk to individuals to the ICO within 72 hours;
• treat health data and other special category data with extra safeguards.

How PeopleForce protects HR data

In Core HR, each role sees only the data it needs, and access to document folders can be restricted by profile fields. The employee profile keeps a history of changes, so you can see who changed what and when. In Recruit, you can ask candidates for consent in the application form, link your privacy policy and set how long their data is kept. Single Sign-On (SSO) via SAML helps control who can access the system.

Summary

Maintaining accurate data processing and secure storage is a significant challenge for every organization. The security of candidate and employee information directly affects a company's reputation, and legal violations or data breaches can make it harder to attract and retain top talent. To reduce these risks, HR teams should use two-factor authentication, role-based access control and clear data retention rules.

FAQ

What is employee personal data?

Any information that can identify an employee, such as their name, address, national insurance or tax number, bank details, salary, performance reviews and sickness records.

Do employers need consent to process employee data?

Usually not. Most HR processing relies on the employment contract or a legal obligation, such as running payroll. Consent is rarely appropriate in employment because of the imbalance of power, and is reserved for optional uses like publishing an employee's photo.

How long should HR keep employee data?

Only as long as needed for the purpose it was collected for, plus any legal retention period. Payroll records, for example, must be kept for years, while unsuccessful candidates' data should usually be deleted within months.