Data Protection and GDPR Compliance

Governing personal data within HR technology systems sits at the heart of this video, which addresses Assessment Criterion 2.3 from the FREE02 People Professional Technologies unit. The video works through the UK GDPR as it operates alongside the Data Protection Act 2018, establishing the legislative context that applies to every HR system handling employee information. Rather than treating compliance as a one-time implementation task, the video positions ongoing governance as the mechanism through which organisations use people technology responsibly and confidently.

A substantial portion of the video is dedicated to the six lawful bases for processing personal data — consent, contract, legal obligation, vital interests, public task, and legitimate interests — with particular attention to how each applies in employment contexts. The video examines why consent presents specific challenges given the inherent power imbalance between employer and employee, and how contract and legitimate interests function as the more common bases for routine HR processing. Legitimate interests is examined alongside the Legitimate Interests Assessment as a tool for documenting and justifying that basis. The video also addresses the core GDPR principles — including purpose limitation, data minimisation, accuracy, storage limitation, and integrity and confidentiality — framing them as practical guides for configuring and managing people technology systems.

Data retention receives dedicated coverage, with the video referencing concrete timeframes across different categories of employee data: payroll records, recruitment records for unsuccessful candidates, working time records under the Working Time Regulations, and occupational health records in certain industries. The governance implications of over-retention are addressed directly, connecting the storage limitation principle to the practical risk exposure that arises when systems hold data beyond what is necessary. Retention schedules, automated deletion, archiving processes, and the configuration of people technology systems to support compliant data management are all covered as components of effective governance under AC 2.3.