Free template

The staff data protection pack, including the privacy notice you probably do not have

Most practices have a client privacy notice on the website and nothing at all for staff. The staff one is the document you are most likely to be asked for, usually by somebody who has just resigned or raised a grievance, and it is the easier of the two to write.

Editable Word document, free, emailed to you. This covers staff data. Your client and patient obligations are a separate matter.

What is in it

• Staff privacy notice, with a lawful basis table you can actually defend rather than a blanket claim of consent.
• Personnel file index, including a list of what should never be in the file.
• Retention schedule, with the statutory periods marked separately from the ones that are your decision.
• Subject access request procedure and a response log.

Consent is usually the wrong basis

In an employment relationship consent is rarely freely given, because of the imbalance of power, and it can be withdrawn at any time. A privacy notice that relies on consent for payroll is a privacy notice that collapses the moment somebody withdraws it.

The notice in this pack uses contract, legal obligation and legitimate interests, each mapped to a purpose. Consent is reserved for the genuinely optional, such as a photograph on your website, where refusal must carry no consequence.

The WhatsApp problem

Almost every practice coordinates cover through a group chat, and those messages are personal data the practice holds. They are disclosable in a subject access request and discoverable in a tribunal claim.

Nobody needs to stop using it. Everybody needs to write in it as though it will one day be read out, because a subject access request very often arrives the week after a grievance and the rota chat is exactly where people say the unguarded thing.

The retention schedule ties to a duty that is already live

One line on the schedule is not a practice decision. Since 6 April 2026 employers must keep annual leave records for six years, including how holiday pay was calculated and any payment in lieu on termination, and failing to keep them is a criminal offence.

The schedule sets that out alongside the periods that are genuinely yours to choose, so you can tell the difference. Read it with our guide to the annual leave records duty and to GDPR and staff records.