Employee data is some of the most sensitive personal data a business handles. Names, addresses, salaries, National Insurance numbers, bank details, health information for sick pay, family circumstances for parental leave — all of it flows through the payroll and HR process. When that process runs through an employer of record, the question of who is legally responsible for that data under UK GDPR is not as straightforward as most EOR contracts make it appear.
This guide explains the data protection framework that applies to EOR arrangements, the practical implications, and what you should check before signing.
Recommended Employer of Record
The UK GDPR framework
The UK GDPR — retained post-Brexit from the EU GDPR — governs the processing of personal data in the UK. The Information Commissioner’s Office (ICO) enforces it. Two roles matter here:
Controller: The controller decides why data is collected and what it’s used for. Controllers have primary compliance obligations — lawful basis for processing, responding to data subject rights, breach reporting, record-keeping, and data minimisation.
Processor: The processor handles data on the controller’s behalf, acting on the controller’s instructions. Processors have narrower obligations but must only process data as instructed and must implement appropriate security measures.
Where two or more parties jointly determine the purposes and means of processing, they are joint controllers — each carrying compliance obligations, though the allocation of those obligations can be agreed between them.
Who is the controller in an EOR arrangement?
This is where most EOR contracts are insufficiently clear — and where the gap between contract language and legal reality tends to show up.
In a typical EOR arrangement, both you and the EOR process the employee’s personal data. The EOR needs it to run payroll, issue contracts, and meet HMRC obligations. You need it to manage the employment relationship. Both parties are, to some degree, determining the purposes for which the data is processed.
That suggests that in many EOR arrangements, both the client and the EOR are controllers — or joint controllers — rather than the EOR being simply a processor acting on your instructions.
Most EOR providers structure their contracts to position themselves as data processors. This is often an oversimplification. If the EOR is making independent decisions about what data it collects (to meet its own regulatory obligations), how it stores it, and how it responds to data subject rights requests from employees, it’s acting as a controller for those purposes — not just as a processor.
This isn’t just a technical distinction. If the EOR suffers a data breach and you’re a joint controller, you may have your own breach reporting obligations to the ICO — even if you weren’t directly responsible. If the EOR mishandles an employee’s data subject access request, you may have exposure if you’re considered a joint controller in respect of that data. The contract positioning doesn’t resolve the underlying legal reality.
What a data processing agreement should cover
Under UK GDPR, whenever a controller engages a processor, a data processing agreement (DPA) must be in place. It needs to specify:
- The subject matter and duration of processing
- The nature and purpose of processing
- The type of personal data and categories of data subjects
- The obligations and rights of the controller
- That the processor only processes data on documented instructions
- That the processor won’t engage sub-processors without controller approval
- The security measures the processor will implement
- How data will be returned or deleted at the end of the arrangement
Most reputable EOR providers have a standard DPA alongside their commercial agreement. Read it before signing. Specifically:
Sub-processor chains. EOR providers typically use sub-processors — payroll software, pension providers, right-to-work check services, cloud storage. The DPA should list these, or at minimum require you to be notified when new ones are added. Each sub-processor in the chain processes your employees’ data. If any are outside the UK or EEA, there may be transfer mechanism requirements.
Breach notification timelines. Under UK GDPR, controllers must notify the ICO of a reportable breach within 72 hours. The DPA should require the EOR to notify you without undue delay of any breach affecting your employees’ data — giving you enough time to meet your own reporting obligations. “Without undue delay” should be no more than 24–48 hours in practice.
Data deletion on termination. When the EOR relationship ends, what happens to your employees’ personal data? The DPA should require the EOR to delete or return data at your request, confirming it won’t retain data beyond its own legal obligations. Payroll records must be kept for three years; tax records may need to be kept longer.
International transfers. If your EOR is based outside the UK, or uses sub-processors in countries outside the UK and EEA, personal data may be transferred internationally. UK GDPR requires an appropriate transfer mechanism — typically Standard Contractual Clauses or reliance on an adequacy decision. The DPA should address how international transfers are handled.
Employee rights in an EOR context
Employees have GDPR rights: subject access requests (SARs), the right to rectification, the right to erasure in certain circumstances, and the right to object to processing.
When an employee exercises these rights, who do they exercise them against? In practice, employees contact both the EOR and the client business. If you’re a joint controller, you may have obligations to respond to SARs directly — not just forward them to the EOR.
The DPA should address how SARs and other rights requests are handled. Typically, the EOR holds the bulk of the employment data and should handle the response — but you need to know your own obligations if a request comes to you directly, and you need to be confident the EOR has a competent process for responding.
Health data: the higher-risk category
Sick pay, occupational health referrals, disability adjustments, and parental leave all involve processing health data or data about family circumstances — both “special category” data under UK GDPR, subject to stricter rules.
The lawful basis for processing health data in an employment context is typically Article 9(2)(b) — processing necessary for obligations in the field of employment law. But the basis must be documented, and the data must be handled with appropriate security.
In an EOR arrangement, health data flows through the EOR’s payroll system for SSP calculations and sick pay reporting. Check that the DPA addresses how health data is secured, retained, and accessed — and that the EOR’s systems meet an appropriate security standard for special category data.
What to do before you sign
Ask for the DPA before signing the commercial agreement. Read it before signing, not after.
Check whether the EOR positions itself as controller, processor, or joint controller for different categories of processing — and whether that accurately reflects the actual arrangement.
Identify international data transfers: does the EOR use sub-processors outside the UK and EEA? If so, what transfer mechanisms are in place?
Confirm the breach notification process: how quickly will you be told about a breach affecting your employees’ data?
Confirm data deletion terms: what happens to employee data when the contract ends?
None of this is unusual due diligence. It’s the same work you’d do for any supplier processing personal data on your behalf. The difference with an EOR is that the data is especially sensitive — employees’ financial and personal details — and the processing is high-volume and ongoing. Getting the data governance right at the start is considerably easier than trying to fix it after a breach or a SAR you weren’t prepared to handle.
Read our introductory guide to EOR services and, if you’ve worked through this and decided an EOR is the right route, our shortlist of the ten best EORs for UK businesses covers popular providers in more detail.
