Provisions the documents cite: data protection principles (personal data in site records); UK GDPR Article 6(1) (lawfulness of processing) and Article 9(1)–(2) (special category data), in particular Article 9(2)(b) (employment, social security and social protection law) and (h) (occupational medicine, working capacity); DPA 2018 s.10(1)–(3); Schedule 1 Part 1 para 1 (employment, social security and social protection condition) and para 2 (health or social care purposes); Schedule 1 Part 4 paras 38–41 (appropriate policy document, its retention, and the record of processing)
What it requires
Personal data recorded on site — accident entries, medical declarations, emergency contacts — is kept securely, seen only by those who need it, and retained no longer than necessary. UK GDPR Article 6(1) — processing is lawful only if at least one applies: consent; necessary for a contract with the data subject or steps at their request before one; necessary to comply with a legal obligation of the controller; necessary to protect vital interests; necessary for a public task or official authority; necessary for a recognised legitimate interest listed in Annex 1; or necessary for legitimate interests not overridden by the data subject's interests or rights ((ea) and (f) are not for public authorities performing their tasks). Article 9(1) prohibits processing personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs or trade union membership, and genetic data, biometric data for unique identification, data concerning health, sex life or sexual orientation, unless the processing is based on Article 6(1) and an Article 9(2) exception applies — including (b), necessary for carrying out obligations and exercising specific rights of the controller or data subject in the field of employment, social security and social protection law so far as authorised by domestic law providing appropriate safeguards, and (h), necessary for preventive or occupational medicine or the assessment of an employee's working capacity. DPA 2018 s.10(2) — the domestic law authorisation for Article 9(2)(b), (h), (i) and (j) is met only if a condition in Schedule 1 Part 1 is met; (g) needs a Part 2 condition (s.10(3)). Schedule 1 para 1 — the condition is met if the processing is necessary for performing or exercising obligations or rights imposed or conferred by law on the controller or the data subject in connection with employment, social security or social protection, and when it is carried out the controller has an appropriate policy document in place. Para 2 — health or social care purposes include preventive or occupational medicine and the assessment of an employee's working capacity. Part 4 — an appropriate policy document explains the controller's procedures for complying with the Article 5 principles for that processing and its retention and erasure policies, with an indication of how long the data is likely to be kept (para 39); the controller keeps it for the whole time it relies on the condition and six months afterwards, reviews and updates it, and gives it to the Information Commissioner free on request (para 40); and the Article 30 record of processing states the condition relied on, how Article 6 is satisfied, and whether the retention and erasure policies were followed, with reasons if not (para 41).
The instrument itself: https://www.legislation.gov.uk/ukpga/2018/12. The summary above is our plain-English reading, not the text of the instrument — always work from the source.
How this entry is kept current
- Citation status: read in full at the primary source.
- Watched by: legislation.gov.uk Changes to Legislation tab.
- Source last checked by the automated scan: not yet — first scan pending.
Every source is re-checked monthly and the result is published in the scan log. A change that alters what a document should say raises a revision, and past buyers of that document are told.
The 18 documents that cite it
Every KubitDocs document prints its statutory basis on the form itself, so the person signing can verify the citation rather than take our word for it.
Asbestos management
Company policies
- Cyber Security Policy
- DPIA and Individual Rights Request Log
- Data Protection Policy and Site Worker Privacy Notice
- Illegal Working Prevention Procedure
- Subcontractor Selection Policy
Employer records
Health and safety arrangements
Higher-risk buildings
Occupational health
- Drug and Alcohol Policy Statement and Testing Record
- Health Surveillance Register and Programme
- Occupational Health Referral and Fitness Certificate Record
- Skin Surveillance and Dermatitis Check Record
- Work-Related Stress Risk Assessment