Can an employer share HR-related data with an external supplier of HR services without the consent of the employees?

Yes, provided that the employer informs the employees that their personal data is being processed by a third party on the employer's behalf, and that processing is done in line with the requirements of the UK General Data Protection Regulation (retained from EU Regulation 2016/679 EU) (UK GDPR), the employer does not need the consent of the employees to share their data with the third party.

Employers can allow a third party (for example a benefits supplier or an external HR consultant) to process data on their behalf only where the third party implements sufficient technical and organisational measures to comply with the UK GDPR and protect the rights of the employees. There must be a contract between the employer and the third party setting out specific details relating to the processing and the security measures in place.