Staff and Workforce Privacy Notice
Version 5 | August 2026
Review date: August 2027
About this notice
This privacy notice explains how The Hayling College collects, uses, stores and shares personal information about current and former employees, workers and relevant contractors.
It reflects the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 as amended, including the Data (Use and Access) Act 2025, and relevant law.
The Hayling College is the data controller. This means that we decide why and how personal information is used and are responsible for ensuring that it is used lawfully, fairly, transparently and securely.
Data protection principles
We process personal information in accordance with the following principles:
- lawfulness, fairness and transparency;
- purpose limitation;
- data minimisation;
- accuracy;
- storage limitation;
- integrity and confidentiality; and
- accountability.
Information we may collect
We may collect and process:
- identity, address and contact details;
- emergency contacts;
- recruitment records, references, CV/application, qualifications and right-to-work evidence;
- contract, role, hours, start/end dates and employment history;
- salary, payroll, tax, National Insurance, pension and benefits information;
- absence, leave, attendance and working-time information;
- health, disability and occupational-health information;
- appraisal, performance, capability, grievance and disciplinary information;
- training and professional-development records;
- DBS, safeguarding and criminal-record information where lawful;
- equality-monitoring information where appropriate;
- trade-union information where relevant;
- IT, email, internet, device, access-control and information-security records;
- CCTV, photographs and video-conferencing recordings where appropriate; and
- other information required to manage the employment relationship and meet legal duties.
Why we use workforce information
We use workforce information to:
- recruit and appoint staff and verify suitability and right to work;
- manage contracts, deployment, payroll, pensions and benefits;
- manage attendance, leave, wellbeing, occupational health and reasonable adjustments;
- support appraisal, professional development and workforce planning;
- meet safeguarding, safer-recruitment and DBS duties;
- manage performance, capability, conduct, grievance and employment processes;
- meet health and safety, equality, tax, pension and employment-law duties;
- protect College premises, systems and information;
- complete statutory workforce returns and support workforce planning;
- manage insurance, legal claims, audits and regulatory requirements; and
- provide references and manage post-employment obligations.
Lawful bases
Our main Article 6 lawful bases are contract, legal obligation and public task.
We may also use legitimate interests, vital interests or consent where appropriate.
Special category and criminal offence information is processed only where an additional Article 9/Data Protection Act 2018 condition or criminal-offence condition applies.
How we collect information
We collect information directly from you and, where lawful, from other sources including referees, previous employers, recruitment agencies, the Disclosure and Barring Service, the Home Office, Hampshire County Council, pension and payroll providers, occupational-health professionals, training providers, professional bodies and College systems.
Who we share information with
Where appropriate and lawful, information may be shared with:
- Hampshire County Council;
- the Department for Education through the statutory school workforce census and other lawful collections;
- HMRC, pension providers and payroll services;
- the Disclosure and Barring Service, Home Office and safeguarding authorities;
- occupational health and healthcare professionals;
- training, recruitment and supply agencies;
- Ofsted and other regulators or public authorities where required;
- prospective employers where a lawful reference is provided;
- insurers, auditors and legal/professional advisers; and
- approved HR, payroll, IT, communications, security and other service providers.
School workforce census
As a maintained school, we are required to share specified workforce information with the Department for Education under the Education (Supply of Information about the School Workforce) (England) Regulations 2007 and amendments.
The Department for Education uses workforce data for purposes including policy, pay, diversity, funding and expenditure analysis, and research.
Monitoring of College systems
For safeguarding, security, acceptable-use and operational purposes, the College may monitor the use of College IT, email, internet, networks, devices, access systems and business-related communications in accordance with College policies.
Monitoring is proportionate, access is restricted and staff are informed of relevant expectations.
Automated decision-making
The College does not routinely make employment decisions that have legal or similarly significant effects solely by automated means.
If significant automated decision-making is introduced, we will provide additional information and appropriate safeguards.
International transfers
Some approved providers may process information outside the UK. Where this happens, an appropriate UK data-transfer mechanism or other lawful safeguard will be used.
Retention and security
We retain workforce information in accordance with the College's Data Retention Policy and retention schedule, taking account of legal, payroll, pension, safeguarding and employment requirements.
We use appropriate security measures and role-based access controls to protect personal information.
Your information rights
The rights that apply will depend on the lawful basis and circumstances of the processing. These may include:
- the right to be informed;
- the right of access;
- the right to rectification;
- the right to erasure in certain circumstances;
- the right to restrict processing in certain circumstances;
- the right to object in certain circumstances;
- the right to data portability where applicable;
- rights relating to automated decision-making and profiling;
- the right to withdraw consent where consent is relied upon; and
- the right to complain about the use of your personal information.
Questions, concerns and data protection complaints
If you have a question or concern about how the College uses your personal information, please contact:
The Hayling College
Email: admin@hayling.hants.sch.uk
Telephone: 023 9246 6241
For a formal complaint, please use the subject line “Data Protection Complaint”.
Under the Data (Use and Access) Act 2025, we will acknowledge a data protection complaint within 30 days, investigate it appropriately and respond without undue delay.
Data Protection Officer
The Hayling College's Data Protection Officer is Helen Cox.
She can be contacted through the College at admin@hayling.hants.sch.uk or on 023 9246 6241.
The College also receives specialist data protection support from Judicium Consulting Limited:
Email: dataservices@judicium.com
Telephone: 0345 548 7000 (option 1)
Website: www.judiciumeducation.co.uk
You also have the right to complain to the Information Commissioner's Office (ICO).
Keeping your information accurate
Please tell the College promptly if your contact details, bank details, emergency-contact information, right-to-work information or other relevant personal information changes.
Keeping this notice current
We review this privacy notice at least annually and sooner where there is a significant change to how personal information is processed.
Staff will be informed of significant changes.
Version 5 – August 2026
Next review: August 2027