From identity card details and payroll records to fingerprints used for attendance tracking, businesses hold substantial amounts of employee information. As information security and personal data protection requirements become stricter, every organisation should consider these four principles.

1. Obtain clear consent

Before collecting data, businesses should explain what information they will collect, how it will be used and how long it will be kept, and ensure that employees have confirmed their consent. These matters may be covered in the employment contract or a suitable separate agreement.

2. Minimise collection and observe retention periods

  • Collect only data directly required for work, tax, insurance and related lawful obligations.
  • Do not collect private information that is unnecessary for the employment relationship.
  • Set periods for deleting or destroying records, such as unsuccessful applicants' files or former employees' data once the mandatory retention periods under employment, accounting and other relevant laws have expired.

3. Control access and secure data

  • Apply strict access controls within the business.
  • Encrypt digital data held on systems and store paper records securely.
  • Take measures to prevent data leaks, unauthorised access and cyberattacks, particularly when using technology platforms or AI tools.

4. Respect employee rights

Employees have the right to access their data and request correction of inaccurate information. In appropriate cases, they may request deletion after leaving employment, except where the business is legally required to retain the data.

Businesses should adopt internal data protection policies, review how they collect and retain employee data, and prepare personal data processing impact assessment documentation where required. These steps support compliance and help protect the business against legal risks and information security incidents.

This article provides general legal information. Its application depends on the types of data, the processing purposes and each business's specific activities.