Every business running a staff roster is handling personal data — names, contact numbers, sometimes bank details and leave/medical records. The Personal Data Protection Act 2010 sets real obligations around how that information is collected, used, and kept.
Employee data is still covered
PDPA applies to personal data processed in the course of commercial transactions, and staff data — used to run payroll, scheduling, and HR administration — generally falls within scope. It's not just customer data that businesses need to think about.
The core principles that matter for a small business
- Notice: staff should be told what data is collected and why (a simple written notice at onboarding is generally enough)
- Purpose limitation: data collected for payroll/scheduling shouldn't be repurposed for unrelated uses without consent
- Retention: don't keep former staff's personal data indefinitely once there's no legitimate business reason to
- Security: reasonable steps to prevent unauthorised access — a shared spreadsheet with everyone's bank details open to the whole team chat is a real risk, not a technicality
Sensitive personal data needs extra care
Medical certificates, health information tied to sick or hospitalisation leave, and similar records are treated as sensitive personal data with a higher bar for handling than routine contact details — worth keeping in a more restricted location than the general staff roster.
Why this matters more once you're using digital tools
Moving staff data from paper into spreadsheets, WhatsApp groups, or scheduling software doesn't remove the obligation — if anything, it makes clear data-handling practices more important, since digital records are easier to accidentally over-share (forwarding a spreadsheet that includes everyone's bank details when only shift times needed to be shared, for example).
The practical takeaway
Check who currently has access to sensitive staff information like bank details or medical certificates, confirm it's genuinely limited to people who need it for a real business reason, and don't keep former employees' personal data around indefinitely once there's no reason to.