Should we buy off-the-shelf HR software or build bespoke?
It depends on how closely a ready-made product fits your processes, budget and risks. Either way, the employer remains the controller of employee data, so the ICO expects data protection by design and by default, suitable security, clear retention rules and, where a supplier processes data for you, a written contract and evidence that its processing will meet UK GDPR requirements.
Start with your needs
Map the HR processes you need to support, the data each one uses and the systems it must connect to, such as payroll. Off-the-shelf products may suit common processes; bespoke builds may suit unusual workflows or integrations, but need ongoing ownership and maintenance.
GOV.UK's Service Manual, written for public services, offers principles that also apply here: make choices that let you change your mind later, minimise total cost of ownership including the risk of being locked into long contracts, keep full control of any data you store, and test assumptions with prototypes early.
Data protection by design
The ICO says employers must build data protection into systems from the design stage and throughout their lifecycle, and limit the personal information used to what is necessary for each purpose. When choosing products, it suggests asking whether the provider offers ways to support data protection by design, follows industry standards, or belongs to an approved certification scheme or code of conduct.
If a supplier processes employee data on your behalf, you must use only processors that can show their processing will meet UK GDPR requirements, and have a written contract with them. A data protection impact assessment is needed where processing is likely to be high risk.
Records, retention and security
- Access controls, so only authorised people can view, change or delete records and managers see only what they need
- Extra protection for health, disability and other special category information
- Retention schedules by record type, with prompts to review or delete data that is no longer needed
- Backup and recovery, and central storage so records stay available when staff leave
- The ability to find and export an individual's data quickly to answer subject access requests
Sources
- Data protection by design and by default · ICO
- Collecting and keeping employment records · ICO
- Choosing technology: an introduction · GOV.UK
- Subject access request Q and As for employers · ICO
General information for employers in Great Britain, not legal advice. Check the official sources for your situation.
What employers can do
- List your processes, data, integrations and must-have features before speaking to suppliers
- Compare total cost of ownership over several years, including exit and data migration
- Complete a DPIA and confirm controller and processor roles in a written contract
- Test access controls, audit trails, retention settings and data export in a trial or prototype
- Confirm you can extract all your data in a usable format if you change supplier
Related answers
- How should employers handle an employee subject access request? Employers should recognise the request, which can be made verbally or in writing, confirm the person's identity if needed, make a reasonable and proportionate search and respond without undue delay and within one month. Complex requests can be extended by up to two months. A fee usually cannot be charged, and information about other people may need redacting.
- Can employers monitor their staff? Yes, but the ICO says monitoring must be lawful, fair and transparent under data protection law. Employers need a clear purpose, a lawful basis, the least intrusive method that achieves it, and must tell workers about it. A data protection impact assessment is required for high-risk monitoring, and covert monitoring is justified only in exceptional circumstances.
- What should employers consider when using AI in recruitment? Employers remain responsible under data protection and equality law when they use AI to source, screen or score candidates. The ICO expects a data protection impact assessment, a lawful basis, clear contracts with the provider, checks for bias, transparency with candidates and minimal data collection. Employers should also plan reasonable adjustments for disabled applicants.