Updated to reflect that "recognised legitimate interests" has been added as a seventh potential legal ground for processing, by the Data (Use and Access) Act 2025. The most relevant grounds for employers remain performance of a contract, legal obligations or the employer's legitimate interests.
Updated to reflect the provisions of the Data (Use and Access) Act 2025 in force from 5 February 2026. In particular, the relaxation of rules on automated decision-making.