The concept of personal data protection sometimes appears to be abused by authorities who use it as an excuse for refusing to reveal information that could embarrass them or cause them extra work, but regrettably many organizations fail to protect their employees' data sufficiently. Every employer therefore needs to understand its responsibilities in this area and also ensure that its managers handle employee data correctly. The legislation governing this topic is quite specific and rather complex and accordingly, someone in the organization must be responsible for its compliance.

You must safeguard employees' personal data for three good reasons. First, common decency suggests that, if you learn during a recruitment interview that a person has a medical complaint or came bottom in math at junior school, you should not spread that around the workforce. Second, the employer has a duty of care to its employees, which includes safeguarding private and confidential information. And third, the law in the form of the Data Protection Act and its attendant Codes of Practice, demands that you do so.

Personal data is any information held on an individual in manual or electronic form, and the employees concerned must be made aware of what data is kept on them, where and how it is stored, who has access to it and for what specific purposes. Sensitive data is information about their ethnicity, politics, belief, trade union membership, sex life, health and criminal history, and this may be retained and processed only with their permission - though permission need not be sought to record ethnic origin solely for monitoring purposes. Even so, there is little need to obtain or keep much of this information in the first place. The less information kept, the safer is the employer and its management.

Most documents are likely held in a central repository, such as the Personnel Department, though some information - medical reports, for example - should be kept separately, ideally by medical personnel. There is seldom a valid reason for line managers to hold data about their employees either in written notes, or on their computers, iPads or mobile phones.

Your organization needs to have a data protection policy. In addition, it should specify how long data is retained and incorporate a system for regularly destroying data that is no longer of use.

These notes are addressed to everyone in your organization, from chief executive to the office junior - with one exception. Someone, or indeed more than one person, must be given responsibility for the organization's data protection policy. He or she needs to fully understand the role, be properly trained, ensure that everyone understands their responsibilities, and carries out regular audits to ensure that the policy is complied with at all times. If you do not have such a person appointed, you are highly vulnerable and the penalties for non-compliance with data protection law are severe. So take action now. 

Reprinted from www.payroll-help.com