Can an employer keep all my personal data? A colleague recently raised concerns about the personal data that our employer holds about her, but I'm not aware what kind of data that is. What are employers" duties towards their staff when it comes to holding personal data on file and do I need to give express permission for my employer to keep these records? Emma Dickinson, solicitor at Simpson Millar LLP, says: Your colleague is not alone in raising concerns about the use of personal data which is, broadly speaking, information that can be used to identify a specific individual. Importantly, there are strict guidelines in place for what employers can and can't do with such information. This includes making sure that any personal data kept is accurate, up to date, secure, that it is not held for any longer than is necessary, nor is used for anything other than the reason it was provided. Employers most commonly gather, store and sometimes share details of your current salary, address and contact details of family members or next of kin. They may also hold sensitive personal data such as details of a medical condition, information about your trade union membership or information that you might have provided on an equal opportunities monitoring form. Employers do not always have to ask the permission of staff before using their personal data. However, they do have to ask before sharing sensitive personal information, such as medical records, with others. When this is the case, your employer must explicitly seek your permission, making it clear exactly what type of information they wish to use, why and for how long. Although you might need to pay a small fee, you can submit a request to your employer and ask to know what information they hold. If you are unsure about how, when and for what purpose information about you is being gathered, used, stored and shared at work, ask for a copy of the organisation's data protection policy. If you want to know more, you can visit the Information Commissioner's Office website: www.ico.gov.uk. Robert Bond, head of data protection and information security at Speechly Bircham LLP, says: You raise good points in your question - issues surrounding data protection are a very common concern for both employees and employers. In the UK, the use and processing of information about individuals, including employees, is governed by the Data Protection Act 1998. This protects the rights of staff and places obligations on employers. You need to know what your employer is doing with your personal data and therefore you and your colleague have a right to request such information. You also have a right of access to the information that your employer holds on you, including information about grievance and disciplinary issues and information obtained through monitoring in the workplace. On the other hand, your employer does not, in most cases, need consent from you to allow personal data to be processed for employment needs. However, where personal data includes sensitive information, such as health records or diversity information, employers need to put in place stronger security to protect those records - particularly where records are outsourced. The regulator with responsibility for enforcing the law in this area is the Information Commissioner. His office has considerable powers to investigate, audit and fine businesses and employers that fail to comply with the law. For more information on these issues, the commissioner's office provides a useful document, called "Quick Guide to the Employment Practices Code." It is designed to help businesses comply with the Data Protection Act 1998 when recruiting and employing workers and makes it clear that the law applies to businesses that process employment records. While the act does not prevent a business from collecting, maintaining and using those records, it strikes an important balance between the employer's need to keep records and the right of staff to have their private lives respected. Email your career management questions to: recruitment@ft.com