Invariably the management of workers and employees necessitates the creation of personnel records and a degree of monitoring of the workforce. On 25 May 2018, the EU General Data Protection Regulation (GDPR) came into force. This is supplemented by the UK Data Protection Act 2018 (DPA 2018).

The Information Commissioner is responsible for enforcement of the GDPR. The Commissioner also has a duty to publish codes to promote good practice. These do not have the force of law but may be referred to in enforcement proceedings and reflect the Commissioner’s views. Employers are therefore strongly advised to familiarise themselves with the codes. The Information Commissioner has not yet published a GDPR-specific Code on employment and protection. However, the Code issued under the DPA 1998 (legislation prior to the introduction of GDPR) still provides helpful guidance. See the Employment Practices Code and the Employment Practices Code Supplementary Guidance, both of which can be downloaded from the Information Commissioner’s Office website. The Information Commissioner has also produced a useful general