GDPR for Utility Contractors
Utility contractors handle a lot of personal data — certifications, training records, right-to-work, addresses, payment details. This guide covers the GDPR essentials for onboarding and managing utility workforces.
Lawful basis
Most workforce data is processed under contract or legitimate interest. Marketing communications need explicit consent. Keep a Record of Processing Activities (ROPA) and review it annually.
Data minimisation
Only collect data you actually need. Right-to-work, certifications and payment details — yes. Date of birth or marital status — usually not.
Retention
Worker records typically need to be kept 6 years after last engagement for tax and compliance purposes. Delete sooner if there's no legal basis to keep them.