HR teams and training coordinators handle passport scans, bank details, salaries, sick notes and test results. If someone steals or leaks that data, the people in it can face fraud or embarrassment, and the company can face fines.
To cover the main risks, collect less, limit who sees what, use strong logins and plan what to do after a leak.
The ICO treats health, ethnicity, religion, trade union membership, and genetic and biometric data as special category data. Organisations need a specific legal condition to use it. HR teams collect this data through sick notes, disability adjustments, union fee deductions and fingerprint clock-in systems.
The ICO does not list bank details, tax numbers, passport scans or salaries as special category data. Criminals can still use any of them for fraud or identity theft.
Training teams collect names, contact details, attendance and test results. Managers may use a failed compliance test or a missed safety course in decisions about someone’s job.
Keep each record for its legal minimum period, or for as long as you have a clear business reason, then delete it.
In the UK, employers must keep PAYE payroll records for 3 years from the end of the tax year they relate to, according to GOV.UK. HMRC can charge a penalty of up to £3,000 if you do not keep full records. In Germany, businesses must keep tax-relevant records for 6 or 10 years, depending on the document type, under section 147 of the German Fiscal Code.
Some companies hire abroad through an employer of record (EOR), a company that legally employs workers on their behalf. Those companies can leave local payroll and tax records to the EOR, which keeps them under each country’s rules. You can check how the arrangement works to see which records you still need to keep.
For training records, decide a period for each record type and write it down. A training company might keep invoices for the tax period and delete marketing contact details two years after a participant’s last course. Sort your files by record type and year to find expired records by date.
Give each person access only to the records they need for their job. A payroll officer needs bank details and salaries. A line manager needs holiday and performance records for their own team.
In a training company, a course coordinator needs bookings and attendance, while finance staff need invoices. If you run courses through training management software, check which user roles you can set up and assign each person’s role before they start.
Remove access on the day someone leaves or changes role. Former employees with working logins can still open records, and so can anyone who steals those logins.
Turn on activity logs in your HR, payroll and training systems, and review the logs once a month.
Before you start, check what each provider records. Some providers log each time someone views a file. Others log only edits, downloads and exports.
When you review the logs, look for:
Ask the person about any entry you cannot explain. Say a payroll officer exported the full staff list at 23:00 on a Saturday. They may have been preparing a year-end report. If they did not make the export, treat it as a possible leak.
Use long, unique passwords and turn on multi-factor authentication (MFA), a second login step such as a code from an authenticator app.
In its 2025 Data Breach Investigations Report, Verizon found that attackers got in with stolen or abused login details in 22% of breaches. Verizon ranked this route first among the ways attackers got in. NIST, the US standards body, sets a minimum of 15 characters for passwords used as the only login step in its digital identity guidelines. NIST also tells organisations to drop rules about mixing symbols and numbers, and to force a password change only when there is evidence of compromise.
You can create a long random password with the free password generator and store it in a password manager. For a password you need to type from memory, use four or five random words, such as “lamp orbit cedar flannel” (24 characters).
Share only the data people need for the task, and use a secure channel. When you do not need to know who each person is, replace names with random codes.
Say your finance team wants to see which departments completed compliance training. They do not need names. You can replace each name with a UUID, a long random code such as 7c9e6679-7425-40de-944b-e07fc1f90ae7, using the free UUID generator. Keep the code-to-name list in a separate, locked file.
The ICO still treats data with names swapped for codes, called pseudonymised data, as personal data, according to the Society for Computers and Law. Protect the coded file.
Send files through a shared drive with access controls or an encrypted link, and set the link to expire. Avoid email attachments for payroll files, because you cannot pull back an email sent to the wrong person.
Stop the leak first, then work out who is affected, how serious it is and whether you must report it.
Collect only what you need, keep it for a set period, limit who sees it and protect logins with long passwords and MFA. Write down your data leak plan.