GDPR & Data Protection Solicitors

Data protection, privacy and GDPR at work

Crushell & Co advises employers and employees on workplace data protection. The service covers how personal information is collected and used, employee access rights, employer obligations and disputes about the handling of workplace information.

Employer data obligations

Employers handle personal information throughout recruitment, employment and departure. We advise on workplace policies, privacy information and the practical handling of employee records. A review may consider who has access to information, why it is used, how it is shared and how long it is retained.

Questions often arise around HR files, investigations, health information, email records and workplace monitoring. The appropriate approach depends on the type of information and the purpose for which it is being processed. We help employers identify the issue and consider the steps needed to respond.

Employee privacy and access rights

Employees may wish to understand what information their employer holds, how it has been used or whether it has been shared appropriately. We assist with identifying the concern, making a focused request and reviewing the response. A subject access request concerns personal data; it is not an automatic right to every document held by an employer.

Access rights must also be considered alongside the rights of other people and applicable restrictions. We advise on concerns about missing information, redactions and the explanation supplied by an organisation.

Responding to access requests

We support employers in assessing the scope of a request, identifying relevant records and preparing a response. For employees, we review the correspondence and the information supplied to consider whether further clarification or action may be appropriate.

The Data Protection Commission explains that an access request should normally receive a response within one month, with a possible extension in specified circumstances. Whether a particular response complies requires consideration of the request and the organisation’s explanation.

Complaints and disputes

Where a concern cannot be resolved directly, we advise on the available options, including bringing or responding to a complaint to the Data Protection Commission. The firm also advises on potential compensation claims and the evidence relevant to them. A complaint and a claim for compensation are distinct processes; we will discuss the route relevant to your circumstances.

What to bring

• The request or complaint you made or received.
• The employer’s response and relevant dates.
• The privacy notice or workplace policy, if available.
• A brief explanation of the information or use of data that concerns you.

Explore our workplace data protection guide or arrange a consultation. The Data Protection Commission’s access guidance explains the regulatory framework.