The Data Protection Act 1998 applies to information about any living individual. It therefore covers information about job applicants and former employees as well as an employer's existing workforce, whether they are employees, contractors or agency workers.
In order to be covered by the legislation, the information at issue must be "personal data". Information is not personal data simply because it names an individual or records that the individual was involved in an event with no personal connotations. Information will be covered, on the other hand, if it consists of personal details about the individual and has the individual as its focus.
The Act covers all personal information that is held on computer. It also covers any information held in manual files that are structured so that specific information relating to a particular individual is readily accessible. This is likely to cover, for example, personnel files that are divided into sections on different aspects of an individual's employment, such as attendance record, holiday entitlement and employment history but will not include a personnel file containing documents arranged solely by chronological order. Health records produced by a health professional in connection with the care of an individual are also covered by the Act, whether or not they are in a structured filing system. This could cover, for example, the records kept by an occupational health adviser.
Some information, such as information held in unstructured personnel files may not be covered by the Act. But in practice it may be simpler and safer for a company to base its working practices and procedures on the assumption that the data protection principles apply to all the personal information it holds. This means that data protection principles should be observed in relation to:
- application forms;
- recruitment documentation, including interview notes and assessments;
- personal details such as addresses, telephone numbers, dates of birth and emergency contact numbers;
- payroll information;
- equal opportunities monitoring forms;
- medical records;
- sickness absence records;
- attendance records, including clocking cards;
- records of disciplinary and grievance proceedings, including notes of hearings; and
- personnel files relating to former employees.