Before an employer can process personal data under the Data Protection Act 1998, are there any specific conditions that must be met?

The Data Protection Act 1998 requires that one of a number of conditions must be satisfied in order to ensure that an employer is processing personal data "fairly and lawfully". One of these conditions is that the individual to whom the data relates must have given his or her free consent to its processing. If such consent has not been obtained, for processing to be lawful, it must be necessary for one of the following purposes:

  • for the performance of a contract, for example the processing of employees' wages;
  • in order to ensure compliance with a legal obligation, for example information about an employee's absences may be necessary in order to comply with the duty to pay statutory sick pay;
  • to protect the vital interests of the employee, for example if disclosure of an employee's medical record was requested by a hospital in the event of the employee suffering an accident;
  • for the administration of justice or for public functions; or
  • for the purposes of legitimate interests pursued by the employer, for example if the business is about to be transferred.