Employment is one of the 'legitimate uses' recognised in the Act - for purposes of employment or safeguarding the employer from loss or liability - so consent is often not the right tool for core HR processing.
What to document
- Which HR activities rely on the employment legitimate use.
- Activities that go beyond it (for example optional wellness programmes) and need consent.
- Payroll, benefits and background-check vendors as processors.
Recruitment
Candidates share CVs voluntarily for a specific purpose. Keep candidate data only as long as the recruitment purpose or a stated talent-pool period needs, and say so in the notice.
Security
HR files include identity numbers and bank details. Restrict access and avoid sharing through informal channels.
Frequently asked questions
Do employees have to consent to payroll processing?+
Payroll generally falls under employment-related legitimate use. Record that ground; consent is for processing outside it.
Relevant provisions
- Section 7Legitimate uses (alternative to consent)
- Section 8(2)Processors engaged under valid contract
- Section 8(5)Rule 6 · pending verificationReasonable security safeguards
- Section 8(7)Rule 8 · pending verificationErasure when purpose is served or consent withdrawn
Official sources
Legal reviewPending legal review · drafted 19 Oct 2026
See where your business stands.
Run a free evidence-based website scan or talk to a compliance specialist about implementation.