ARCHIVED: This archived Practice Note provides information on the data protection regime before 25 May 2018 and reflects the position under the Data Protection Act 1998. This Practice Note is for background information only and is not maintained.

Under the GDPR, it is even less likely than it was under Data Protection Directive, Directive 95/46/EC that an employer will be able to rely on employee consent as the legal basis for data processing at work and given the serious consequences of failing to comply with obligations under the GDPR, employers should therefore avoid relying on consent as a lawful processing condition.

In most cases, it is likely that the employer will instead be able to rely on ‘legitimate interests’ condition, provided:

1. •

   the processing is necessary for the purposes of the employer’s legitimate interests

2. •

   those interests are not overridden by the employee’s interests or fundamental rights and freedoms

3. •

   the processing is proportionate and cannot be achieved by other, less intrusive means

4. •

   the data being processed are adequate, relevant and