Data protection and GDPR

Data protection built into everyday people operations.

Workteam helps organisations handle employee information responsibly with practical controls, contractual safeguards and support for individual rights requests.

Our commitment

Clear safeguards for the data you entrust to Workteam.

We are committed to meeting the data-protection obligations that apply to Workteam as a processor and, where relevant, as a controller.

Appropriate security

Workteam applies technical and organisational measures designed to provide security appropriate to the nature and risk of the processing.

Processing on instructions

Customer employee information is processed on the customer’s documented instructions, except where applicable law requires otherwise.

Governed sub-processors

Sub-processors are subject to due diligence and written data-protection obligations appropriate to the services they provide.

Practical assistance

Workteam supports customers with individual rights requests, relevant security obligations and personal-data breach information in line with the applicable agreement.

Support inside Workteam

Tools that help turn policy into practice.

Manage employee information consistently and make common data-protection workflows easier to carry out.

01

Find and export

Locate relevant employee information and export records to support access requests and, where applicable, portability.

02

Correct records

Keep employee information accurate and update records through controlled administrative workflows.

03

Apply retention rules

Set retention periods for former employees and receive prompts when a configured period has passed.

04

Delete or anonymise

Use deletion and anonymisation tools in line with your instructions, retention needs and legal obligations.

Individual rights

Give people a clear route to their information.

Depending on the circumstances, individuals may have rights to information, access, correction, erasure, restriction, portability and objection.

Customer-led decisions

The organisation acting as controller assesses each request against the applicable requirements, response times and exemptions.

Workteam assistance

Workteam can help customers locate, export, correct, delete or anonymise relevant information in line with their instructions.

Secure handling

Requests should be verified where appropriate and handled through a documented process that protects the individual’s information.

Qualified rights

Individual rights are important but not absolute. The appropriate response depends on the request and applicable law.

International transfers

Protected data can move lawfully across borders.

UK and EU data-protection law permit international transfers when an appropriate legal route and the required level of protection are in place.

Depending on the transfer, safeguards may include adequacy arrangements, the UK International Data Transfer Agreement or UK Addendum, EU Standard Contractual Clauses and an appropriate transfer assessment.

Our Privacy Policy and Data Processing Agreement provide more information about Workteam’s processing, contractual commitments and transfer arrangements.

Shared responsibility

A clear partnership between controller and processor.

Your organisation decides why and how employee information is used. Workteam processes customer data on your behalf and provides controls, contractual commitments and assistance designed to support your obligations.

Customers remain responsible for choosing an appropriate lawful basis, providing privacy information, setting retention periods and configuring Workteam for their intended use. Workteam remains responsible for meeting the legal and contractual obligations that apply to its own processing.

Consent is one possible lawful basis, but it is often unsuitable for routine employment processing because workers may not have a genuinely free choice. The appropriate basis depends on the purpose and applicable law.

Important information

Understand your organisation’s circumstances.

This page provides general product information, not legal advice. Data-protection requirements depend on your organisation, workforce, processing purposes and locations. Seek qualified advice where necessary or consult the Information Commissioner’s Office.

Last updated: 21 July 2026.

Review the detail

See the commitments behind the service.

Read the documents that govern how Workteam handles personal information.