Internal Employee Data Sharing in the UK: What Is Allowed

Summary

Employers can share employee personal data with colleagues when they have a lawful basis, the sharing is necessary for a stated purpose, and employees have been told about it. Managers should see only what their role needs. Health, trade union, and other special category data require an additional Article 9 condition and tighter access controls. Consent is rarely the right basis in employment.

This guide covers when internal sharing is lawful, what can and cannot be shared, employees’ rights, sharing outside the organisation, and how to keep the process under control. It follows the ICO’s guidance on keeping employment records.

Key Takeaways

• Every internal disclosure of employee data needs a lawful basis, has to be necessary for its purpose, and has to be explained in a privacy notice. Contract, legal obligation, and legitimate interests cover most cases, and the ICO says consent is hard to rely on because of the employer’s power imbalance.

• Health information, trade union membership and other special category data needs a condition under Article 9 as well as an Article 6 basis. For most employment uses, that is the employment law condition in Schedule 1 of the Data Protection Act 2018, with an appropriate policy document.

• Employees can ask who has seen their data, can object where sharing relies on legitimate interests, and can complain. Since 19 June 2026, every organisation must also have a process for handling data protection complaints.

Employers Can Share Employee Data Internally with a Lawful Basis

Sharing employee data is lawful when three conditions are met:

• a valid lawful basis exists under the UK GDPR;

• the disclosure is necessary for that purpose; and

• the employee has been informed, usually through a privacy notice.

The same test applies to forwarding an email to a colleague and to giving a manager access to performance records.

Under the UK GDPR and the Data Protection Act 2018, employers are data controllers and need a lawful basis before sharing personal data. The ICO’s employment records guidance says an employer must have a lawful basis to share, share only what’s necessary, send it securely to the right person, and tell workers who receives their information and why.

Four bases cover most employment situations:

• Contract: the sharing is needed to carry out the employment contract, such as sending payroll data to finance. The ICO says to use this basis once an offer has been accepted.

• Legal obligation: a statutory or common law duty requires it, such as providing details to HMRC. Contractual obligations do not count.

• Legitimate interests: the business has a legitimate purpose, the sharing is necessary, and the employee’s interests do not override it.

• Vital interests: a life is at immediate risk. The ICO says this basis is very limited and generally applies to life-or-death situations.

Consent Is Difficult to Rely On in Employment

The ICO says an employer is generally in a position of power over its workers, who may feel they cannot refuse. In that setting, consent is unlikely to be freely given.

The ICO also says you cannot rely on consent if the worker has no genuine choice, or if you would keep using the information on another basis when they refused. It can work for voluntary extras. The ICO’s example is a cycle-to-work scheme, where taking part is optional and refusing has no penalty.

Our guide to writing a consent request covers the wording where consent does apply.

Special Category Data Needs an Additional Condition

Health information, trade union membership, religious beliefs and ethnic origin are special category data under Article 9 of the UK GDPR. Sharing them internally needs an Article 9 condition as well as an Article 6 basis. The ICO says to decide and document the condition before you start keeping the records.

For most employment records, the relevant condition is employment, social security and social protection law. The ICO says you must keep the information to comply with employment law, and you must be able to justify why holding that specific information is necessary and proportionate. You must also meet the related condition in Part 1 of Schedule 1 of the Data Protection Act 2018, which requires an appropriate policy document.

The legal claims condition may apply if you need the information to establish, exercise or defend a claim, such as an employment tribunal case.

In practice, you can’t put sickness absence information related to a medical condition in a team email. Limit access to people with a genuine need to know. The ICO has separate guidance on workers’ health information.

Most Internal Sharing Follows Four Common Patterns

HR Shares Disciplinary Information with Line Managers

HR can share relevant information with the manager running the process, limited to what the manager needs for their role. Circulating witness statements, medical details or unproven allegations to uninvolved colleagues breaches data minimisation and confidentiality.

Occupational Health Recommendations Reach Managers

Managers may need recommendations to make workplace adjustments. Share the recommendations and not the underlying medical conditions, unless the specific details are needed for safety.

Contact Details Support Business Continuity

Emergency rotas often need mobile numbers or personal email addresses. Limit them to staff with an operational need and state the use in your privacy notice.

Performance Records Inform Promotions

Promotion panels need performance history. They should rely on standardised records, not informal observations or speculation about someone’s private life.

Basic Professional Details Can Usually Be Shared

Work email addresses, job titles, reporting lines, work phone numbers, professional qualifications and project involvement can generally be shared internally. Cover this in your privacy notice and record it in your records of processing activities.

Employees need to know their details appear in staff directories or shared calendars. Attendance patterns for scheduling and role-related training certificates belong in the same category. You can share them for operational purposes if you document the sharing and disclose it in advance.

Sensitive Details Need Justification and Named Recipients

Some categories need a documented lawful basis, a clear necessity and, in most cases, a short list of named recipients:

• medical records and specific health conditions;

• salary, bonuses and compensation;

• disciplinary actions, grievances and HR file contents;

• personal mobile numbers and home addresses;

• trade union membership; and

• family circumstances and caring responsibilities.

Even within HR, share only what the recipient needs. A recruitment administrator does not need disciplinary records, and a receptionist should not see salary details.

Before sharing anything in this group, record two answers. Can you achieve the goal without sharing it? Would the employee reasonably expect this use?

Employees Have Rights When Their Data Is Shared

Employees have these rights under UK data protection law:

• Right to be informed: the privacy notice must say which roles or departments receive the data and why. A phrase such as “relevant personnel” is too vague.

• Right of access: employees can request copies of their data, including internal emails about them and records of who viewed their file.

• Right to object: where sharing relies on legitimate interests, the employee can object, and you must show compelling grounds that override their interests to continue.

• Right to complain: employees can complain to the employer and to the regulator.

Employers generally have one month to respond to a subject access request, with a possible extension of up to two further months for complex requests. The ICO says the Data (Use and Access) Act 2025 confirms that you only need to carry out reasonable and proportionate searches.

Employers Must Now Have a Data Protection Complaints Process

The complaints provision of the Data (Use and Access) Act came into force on 19 June 2026. The ICO’s guidance on handling data protection complaints says every organisation must have a process for handling them, with no exemptions. You must acknowledge a complaint within 30 days, respond without undue delay and tell the person the outcome.

An employee who believes their information was shared unlawfully can use this route first. The regulator is now the Information Commission, which took over the ICO’s functions on 30 September 2026. The ICO’s published guidance remains the reference point.

Sharing Outside the Organisation Uses the Same Test

The ICO says an employer does not have to share workers’ information just because someone asks. Where there is a legal obligation, such as a request from HMRC, you must respond. In other cases, weigh the benefits and harms, and share only when you are satisfied it is right.

Three common external situations are:

• References: the ICO says the employer can rely on legitimate interests, should share only what the new employer needs, and may give a neutral reference with the job title and dates.

• Outsourced HR or payroll: the employer stays the controller and needs a written contract with the processor. Our guide to sub-processors explains the contract chain.

• Emergencies: the ICO says you can and should share information if it may save someone’s life or protect them or others from serious harm. For mental health situations, see its guidance on sharing information in mental health emergencies at work.

Policies, Training and Access Controls Keep Sharing Compliant

Six practical controls address the usual failure points:

• Written policies: set out what managers can access and when, so sharing does not depend on individual judgement.

• Training: give annual training to anyone who handles employee records, covering confidentiality and secure channels.

• Privacy notices: issue them at the start of employment, name the internal recipients and update them when practice changes.

• Documented lawful bases: record the basis and the reasoning for each category of sharing.

• Technical controls: use role-based access, audit trails and encryption.

• Regular reviews: run an annual check of policy against practice, and reassess when systems or structures change.

Informal channels need their own rules. A WhatsApp group can be end-to-end encrypted, and messages can still be forwarded or screenshotted, and they remain on devices of people who later leave the group. Use controlled internal systems for sensitive data.

Unlawful Sharing Creates Regulatory, Employment and Reputational Risk

The regulator can investigate, issue enforcement notices and take further action. The risks do not stop there:

• staff who share colleagues’ data improperly may face disciplinary action;

• a breach damages trust among employees; and

• disclosing confidential employee information may breach the implied duty of trust and confidence, which can support a constructive dismissal claim.

If an internal disclosure creates a personal data breach, see our guide to data breach reporting.

Complex or High-Risk Sharing Needs Specialist Input

Seek advice when several departments or systems are involved, the sharing serves an unusual purpose, or processing is likely to be high risk. A data protection impact assessment is needed for processing likely to result in high risk, and systematic employee monitoring or large-scale special category processing typically triggers one.

Larger employers and those processing sensitive data at scale should consider a data protection officer. Smaller employers benefit from a named person responsible for compliance, in-house or outsourced.

Conclusion

Internal sharing of employee data is lawful when each disclosure has a basis, serves a stated purpose and reaches only the people who need it. Special category data requires an additional condition, and employees must be told who receives their information.

We are updating this guide because the Data (Use and Access) Act added a mandatory complaints process, clarified search duties for access requests and moved the regulator to the Information Commission. Review your privacy notice and sharing rules against these changes, and speak to our GDPR consultants if you want them checked.

Frequently Asked Questions

Can HR Discuss Disciplinary Matters with Other Managers?

Only with those directly involved in running the process or managing the individual. Do not share a grievance against one manager with peers for general discussion; the need-to-know principle applies throughout.

Do Employers Need Consent to Share Employee Data?

Usually not. Contract, legal obligation, and legitimate interests cover most internal sharing, and the ICO says consent is hard to rely on because of the power imbalance between employer and worker. Special category data also needs an Article 9 condition.

Can Employers Share Personal Phone Numbers in an Emergency?

Yes, where someone’s life may be at risk, or they may suffer serious harm. The ICO says employers can and should share information in that case. Routine business continuity planning does not meet that threshold, so use work contact details where possible.

Disclaimer: This blog post is intended solely for informational purposes. It does not offer legal advice or opinions. This article is not a guide for resolving legal issues or managing litigation on your own. It should not be considered a replacement for professional legal counsel and does not provide legal advice for any specific situation or employer.