GDPR Data processing modelMaintenance of Statutory Employee Registers and Relations with Employee Representative Bodies

PrivateHuman resourcesPublicMost common processing activities

Processing employee data to maintain statutory registers (personnel, accidents, rest periods), manage trade union/representative relations, record public health and safety alerts, and maintain workplace risk assessments.

Purposes (6)

A purpose is the objective pursued by the setting up of your file. It indicates what the processing of personal data will be used for, its purpose. This purpose must be clear and understandable

Personnel register

Legal obligation

Required under Regulation 9 of the Employment Rights Act 1996, and relevant payroll/employment record-keeping duties. HMRC requires records for 6 years.

Legal obligation

Equivalent under Reporting of Injuries, Diseases and Dangerous Occurrences Regulations 2013 (RIDDOR). Employers must keep records of reportable injuries.

trade union representatives registry

Legal obligation

TULR(C)A 1992, Employment Relations Act 1999, and Health and Safety (Consultation with Employees) Regulations 1996. Employee representation must be documented.

Legal obligation

Based on Working Time Regulations 1998, employers must record rest periods if not granted collectively.

Log of public health and environmental alerts

Legal obligation

Aligned with UK Health and Safety at Work Act 1974, and whistleblowing duties under Employment Rights Act 1996.

Management of the single risk assessment document

Legitimate interest

Supported under UK GDPR Art. 6(1)(f) and HSE regulations requiring risk assessments. Legitimate interest = employer compliance + worker protection.

Data categories (6)

Personal data is any information relating to an identified or identifiable natural person. A natural person can be identified either directly (eg surname and first name) or indirectly (eg phone number, social security number, email or postal address, but also voice or image)

Minor accidents

Data details

Name and address of third parties involved outside the establishmentrequired

Detailed circumstances of the accident

required

Location and nature of lesionsoptionalsensitive data

Name and surname of witnesses or first notified personrequired

Victim's first and last namerequired

Data conservation rules

Active base:

5 years after year-end

Destruction

Employee representatives or trade union representatives registry

Data details

Last name, first name of the members of the trade unionoptionalsensitive data

Names of employer representativesrequired

Data conservation rules

Active base:

End of term of office

Intermediate archiving:

+5 years

Destruction

Personnel register

Data details

Start and end dates of internship, location of internrequired

Contract type

required

Company entry and exit datesrequired

Qualificationsrequired

Job heldrequired

First namerequired

Date of birth

required

Nationalityrequired

Genderrequired

Type and serial number of work permit

required

name

optional

Work permit detailsrequired

internship detailsrequired

Data conservation rules

Active base:

Active: retained while employment/engagement is ongoing.

Retention justified under storage limitation (Art. 5(1)(e) UK GDPR).

Intermediate archiving:

Intermediate: 6 years after termination of employment

HMRC and Limitation Act 1980 – tax and employment claims.

Destruction

Public health alerts

Data details

Public health and environmental alert detailsrequired

Names of employee representatives recording the alertrequired

Names of employees raising concernsrequired

Names of employer representativesrequired

Data conservation rules

Active base:

5 years from year-end

Intermediate archiving:

None required

Destruction

Risk assessment documentation

Data details

First namerequired

name

required

Data conservation rules

Active base:

Updated yearly

Intermediate archiving:

As long as risks persist

Destruction

Weekly rest periods

Data details

Special rest arrangementrequired

First namerequired

Days offrequired

name

optional

Data conservation rules

Active base:

1 year

Intermediate archiving:

None required

Destruction

Data subject (3)

A data subject is any person whose data is collected, retained or processed by the data processing. e.g. In a recruitement process, any candidate for a position proposed in recruitement management process

Trade union representatives
Employees
Other

Created at:07/08/2023

Updated on:07/11/2025

Nb using:16

GDPR Data processing modelMaintenance of Statutory Employee Registers and Relations with Employee Representative Bodies

Purposes (6)

Data categories (6)

Minor accidents

Employee representatives or trade union representatives registry

Personnel register

Public health alerts

Risk assessment documentation

Weekly rest periods

Data subject (3)

Access the full processing template