GDPR Compliance: Implications of working from home for employers

Friday 20 March 2020

Following the Prime Minister’s announcement this week, many employers have followed government advice to allow employees to work from home to reduce the spread of Covid-19. However, employers should be aware that despite this advice, they still have a responsibility to comply with General Data Protection Regulation (GDPR).

We have listed below some points for employers to consider.

A policy for working from home

Employers should consider implementing a ‘working from home’ policy to ensure that when employees work from home they can still maintain continued compliance with GDPR.

Employers should check whether their employees’ contracts of employment or handbooks contain provisions relating to working from home.

An appropriate policy could include:

• steps to restrict access to designated company equipment;
• discouraging employees from taking confidential information out of the office, save where absolutely necessary, combined with an obligation to notify a manager if confidential information is to be taken home;
• taking steps to maintain client confidentiality and the security of documents and information;
• instructions regarding the storage and disposal of confidential information; and
• restrictions on the use of personal email addresses.

Security

With the continued threat of cybercrime, employers should ensure that home working prompted by Covid-19 does not jeopardise the security of data.

To minimise the threat of a data breach and comply with GDPR, employers should ensure that:

• equipment is protected by up-to-date cyber-security software and that the employees are working through a secure link;
• home-based devices are protected through encryption and strong passwords;
• company equipment/information is not left where it could easily be seen by a family member or a guest to their home; and
• computer equipment and confidential documents are kept in a secure location when not in use.

Breaches

Employers should be made aware by their employees if any data breaches take place. Failing to report a data protection breach could lead to serious repercussions for the employer.

If you have any questions regarding GDPR compliance while working from home, please contact a member of our Employment Law team.