# Employee privacy notice template

> What HR data you keep, why, who sees it, how long and people’s rights. A complete policy to adapt with your own rules.

Category: Policies

Canonical: https://shuffl.ai/templates/employee-privacy-notice

**A starting point, not legal advice. Leave, pay and expense rules differ by country, state and city. Use the checks on this page to see what to look up where your people work, and have someone qualified review your policy before you publish it.**

## When to use it

An employee privacy notice tells people what HR information you keep about them, why, who it is shared with, how long it is kept and their rights.

In the UK and EU it is a legal requirement, and it is good practice everywhere.

## Employee privacy notice

Words in [square brackets] are for you to fill in. The policy has every section a real handbook policy has, but no allowances, dates or amounts of its own.

```markdown
# Employee privacy notice

## Purpose
This notice explains what personal information the company keeps about you as someone who works here, why, who sees it, how long we keep it and what rights you have.

## Who this covers
Employees, contractors, interns, job applicants and former employees.

## Who is responsible for your data
[Company legal name], [address], is responsible for your personal information. Contact [privacy contact or data protection officer] at [email] with any question.

## What we collect
| Kind of information | Examples |
| --- | --- |
| Identity and contact | Name, address, phone, emergency contacts |
| Employment | Role, manager, start date, contract, location |
| Pay and tax | Salary, bank details, tax and social security numbers |
| Time off and absence | Holidays, sick time, leave |
| Performance and development | Reviews, goals, training, disciplinary records |
| Health | [Only what is needed, for example fit notes or adjustments] |
| Use of company systems | [Sign-in records, device and security logs] |
| [Other category] | [examples] |

## Why we use it
- To employ and pay you, and to meet legal duties such as tax and right to work checks.
- To manage the business, for example planning, security and answering your questions.
- [Any other purpose, for example diversity monitoring, which is optional.]

We use your information only where the law allows, for example to perform your contract, to meet a legal duty, or for a legitimate business need that does not override your rights. We do not sell it.

## Who we share it with
[Payroll provider, benefits providers, HR and IT systems, professional advisers], and authorities where the law requires it. Each one may use it only for the purpose we give.

## Transfers to other countries
[Whether information goes to other countries, and the safeguards used.]

## How long we keep it
| Information | How long |
| --- | --- |
| [Personnel file] | [period after you leave] |
| [Pay and tax records] | [period] |
| [Applicant records] | [period after the decision] |

## Your rights
You can ask to see the information we hold about you, to correct it, and in some cases to delete it, limit its use or receive a copy to take elsewhere. Ask [privacy contact]. We reply within [number] days. You can also complain to [the data protection regulator where you work].

## Security
Only people who need your information can see it, and we protect it with [the main safeguards, for example access controls and encryption].

## Where local law differs
If the law where you work gives you more privacy rights, the law applies. These places have their own rules: [list them, or "none"].

## Related policies
Acceptable use of company systems and Raising a concern.

## About this policy
Owned by [team or person]. Applies in [countries or states]. We may update this policy and will tell you at least [number] days before a change takes effect. This policy is not part of your employment contract.

## Questions
Contact [team or person] at [email or channel].
```

## Check before you publish

Rules that often catch teams out, by place. They are not part of the policy, and not legal advice.

- United Kingdom: UK GDPR requires this information when you collect data. Consent is rarely the right legal basis for employee data, because of the imbalance of power, so name the actual basis for each purpose. The regulator is the ICO.
- European Union: GDPR Articles 13 and 14 list what the notice must contain, including the legal basis, retention periods, transfers and the right to complain. Name a data protection officer if you must have one, and the regulator for each country.
- United States: California’s privacy law covers employee and applicant data for businesses that meet its thresholds, and requires a notice at collection listing categories, purposes and retention. Most other states exempt employee data, so check where you have people.
- Everywhere: List every country’s regulator and every provider that receives HR data. Keep this notice in line with your actual retention schedule.

## How to adapt it

- List every provider that receives HR data, such as payroll and benefits.
- Give retention periods as real numbers, matching what you actually do.
- Name the regulator people can complain to in each country.

## People want to know how their data is used

- **81%** of Americans say AI monitoring would make staff feel inappropriately watched (Pew, 2023) [pew-ai-workers]
- **67%** of US adults know little or nothing of what companies do with their data (Pew, 2023) [pew-data-privacy]
- **56%** of US adults often click ‘agree’ on privacy policies without reading them (Pew, 2023) [pew-data-privacy]

## What the research says

People feel they don’t know what happens to their data. In 2023, 67% of US adults said they understand little or nothing about what companies do with the data they collect, up from 59%.[pew-data-privacy]

Monitoring is a particular worry at work. 81% of US adults said AI-based monitoring would make workers feel inappropriately watched.[pew-ai-workers] If you monitor devices, access or messages, say so in the notice.

Long notices don’t get read. 56% of US adults said they frequently click ‘agree’ without reading privacy policies.[pew-data-privacy] Short sections, plain words and a clear table of what you keep and why make yours more likely to be read.

## What the law requires

Under UK GDPR, people have the right to be informed. Your privacy information must cover the purposes and lawful basis for processing, retention periods, who receives the data, people’s rights and their right to complain to a supervisory authority.[ico-right-to-be-informed]

You must give it when you collect data from the person, or within a reasonable period and no later than one month when you get it from someone else. It must be concise, transparent, intelligible, easily accessible and in clear and plain language.[ico-right-to-be-informed]

In California, the CCPA’s exemptions for employment-related personal information expired on December 31, 2022. Businesses covered by the law must give a notice at collection, at or before the point of collection, listing the categories of personal information they collect.[ca-oag-ccpa] Other countries and US states have their own rules, so check where your people work.

## Common mistakes

- Reusing the customer privacy policy. Employees need a notice about HR data such as payroll, benefits, absence and performance.
- Leaving out monitoring. If you log device use, building access or messages, say what and why.
- Writing it once and never updating it. Review it whenever you add a new HR or payroll provider or start a new kind of monitoring.
- Burying it in a handbook appendix. Share it with new hires when you first collect their data, and keep it easy to find.

## Common questions

**Is an employee privacy notice a legal requirement?**
In the UK, yes: UK GDPR gives employees the right to be informed about how their personal data is used. In California, businesses covered by the CCPA must give employees and job applicants a notice at collection. Elsewhere it depends on local law, and it is good practice everywhere.

**What should an employee privacy notice include?**
What data you collect, why, your lawful basis, who you share it with, how long you keep it and what rights people have, including how to complain to the regulator. Add any monitoring you do and who to contact with questions.

**Do employees have to sign a privacy notice?**
The law asks you to give people the information, not to get their agreement to it. Many employers still record when each person received it, for example as an onboarding step, so they can show it was shared.

## Sources (read 2026-10-13)

- [pew-data-privacy] Pew Research Center, “How Americans View Data Privacy” (October 18, 2023): https://www.pewresearch.org/internet/2023/10/18/how-americans-view-data-privacy/
- [pew-ai-workers] Pew Research Center, “AI in Hiring and Evaluating Workers: What Americans Think” (April 20, 2023): https://www.pewresearch.org/internet/2023/04/20/ai-in-hiring-and-evaluating-workers-what-americans-think/
- [ico-right-to-be-informed] Information Commissioner’s Office, “Right to be informed” (No date stated; read October 2026): https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/individual-rights/individual-rights/right-to-be-informed/
- [ca-oag-ccpa] State of California Department of Justice, Office of the Attorney General, “California Consumer Privacy Act (CCPA)” (Last updated August 28, 2026): https://oag.ca.gov/privacy/ccpa

## In Shuffl

Use in Shuffl: [Knowledge draft](https://shuffl.ai/app/knowledge?template=employee-privacy). Opens a Knowledge draft with this policy, its checks and what Shuffl already knows, like your HR contact and countries. Draft with Mello can write the rest and show where each value came from. Nothing is published until you choose Publish.

Guide: [Add a policy to Knowledge](https://shuffl.ai/docs/knowledge#add)

## Related terms

- [Human resources information system](https://shuffl.ai/glossary/hris)
- [People operations](https://shuffl.ai/glossary/people-operations)
- [Employee handbook](https://shuffl.ai/glossary/employee-handbook)

All templates: https://shuffl.ai/templates

Agent documentation index: https://shuffl.ai/llms.txt