HR and Employment Law FAQs May 2026

1. Should we update our GDPR documentation to take account of changes introduced by the Employment Rights Act 2025 and/or other new legislation?

Yes, when handling personal data of staff and job applicants, employers are obliged to ensure compliance with the UK General Data Protection Regulation (UK GDPR) and demonstrate that they are complying with its principles. In practice, this requires employers to have specific data protection documents in place, and to keep these up to date. There have been some recent legislative changes which mean that now is a good time to review your documentation.

The following changes contained in the Employment Rights Act 2025 may impact the data retention periods in your data protection documentation:

• A new obligation to maintain records relating to statutory holiday for six years took effect in April 2026.
• An increase in time limits for bringing employment tribunal claims from three to six months is expected to take effect (no earlier than October 2026). You should also bear in mind that time limits for Acas early conciliation have increased from six to twelve weeks.

In addition, the Data Use and Access Act 2025 (DUAA) is now in force. This introduces changes to the UK GDPR, which you should consider reflecting in your UK GDPR documentation, including the following:

• The codification into statute of provisions in the ICO guidance which enable an employer to limit searches to reasonable and proportionate efforts when dealing with subject access requests.
• A new statutory right for individuals to raise complaints directly with their employer if the individual believes that their employer has breached their data protection rights. The employer must respond within 30 days.
• The addition of a new lawful basis for processing personal data known as “recognised legitimate interests”, which allows employers in limited situations (such as crime prevention, safeguarding or responding to emergencies) to process personal data without carrying out a full legitimate interests balancing test.

For more details about the DUAA, see the ICO summary document.

Keep in mind that the type of personal data that you process about your staff and how you handle it is likely to evolve over time, so your documentation should reflect the personal data you hold and what you do with it in practice. Be aware too that if it is some time since you reviewed your UK GDPR documentation, you could also have missed other relevant changes to ICO guidance, which could impact your UK GDPR compliance.

We therefore recommend that you review and, where necessary, update your UK GDPR documentation regularly to ensure ongoing compliance. For example, you should review your employee/job applicant privacy notices, data protection policy, record of processing and appropriate policy document to reflect the legislative changes described above, including reviewing retention periods of HR personal data. We also recommend that you review internal processes and guides which set out how long you retain HR personal data, how data protection breaches should be handled and the process for dealing with individual rights requests (such as subject access requests).

Make UK can provide an updated pack of essential template GDPR documents (see here).

If you are a Make UK subscriber, you can also access information about HR data protection matters in the HR and Legal Resources section of our website.

If you are not a Make UK subscriber, you can contact us for further support on this topic or to access our resources. Please click here for information on how we can help your business.

2. What is happening with ethnicity and disability pay gap reporting?

Following its consultation on mandatory ethnicity and disability pay gap reporting last year, the Government has published the response which confirms its intention to introduce mandatory ethnicity and disability pay gap reporting for large employers (i.e. those with 250 or more employees). 

The proposed legal framework broadly mirrors the current gender pay gap reporting regime.  Employers will need to publish the same six pay gap measures which are currently used for gender pay gap reporting, and the same snapshot dates used for data collecting and reporting will apply. Employers will be required to upload their ethnicity and disability pay gap data to an online reporting service and will be subject to the same enforcement mechanisms as with gender pay gap reporting. (For further information on the gender pay gap reporting framework, see our webpage Gender pay reporting.)

(Note that, as with gender pay gap reporting, employers with fewer than 250 employees will not be required to report on their ethnicity and disability pay gaps, but they will be encouraged to do so voluntarily.)

For ethnicity pay gap reporting, employers will need to collect ethnicity data using the ethnicity classifications set out in the Government Statistical Service’s (GSS) harmonised ethnicity standard. Ethnicity pay gaps should be reported with the minimum of a binary comparison between White (including White Other) and all other ethnic groups combined. However, if numbers within a group reach a minimum threshold (likely to be 10 employees, although still under consideration), employers must also report comparisons between the five broad ethnic groups identified in Government guidance to employers reporting ethnicity pay gaps voluntarily (i.e. White, Asian or Asian British, Black/Black British/Caribbean or African, Mixed or multiple ethnic groups, and Other ethnic groups).

For disability pay gap reporting, employers will need to compare disabled and non-disabled employees using the definition of disability set out in the Equality Act 2010. As with ethnicity reporting, the threshold for reporting on disability pay gaps is likely to be at least 10 employees in each group being reported on.

As well as reporting on the pay gaps, employers will need to provide details of the overall composition of their workforce by ethnicity and disability (referred to as ‘workforce reporting’), and the proportion of employees who choose not to disclose their ethnicity and/or disability status (‘declaration rates’).

Notably, employers will also be required to publish action plans setting out the steps they are taking to tackle any ethnicity and/or disability pay gaps they have identified. This will expand on, and align with, the requirement for employers to produce action plans covering steps to reduce the gender pay gap and support employees going through the menopause. (For further information on equality action plans, see our ⁣Action on Equality: Spotlight)

The Government has indicated that these changes will come into force via a new Equality (Race and Disability) Bill, a draft of which may be published in 2026. (We also expect such draft Bill to include various measures aimed at making it easier for disabled people and ethnic minorities to bring equal pay claims.) 

Although it is likely to be some time before these new measures come into force, employers should start taking preparatory steps now to minimise the potential risks that could arise from these changes.  In particular, now is a good time to review your HR and payroll systems to ensure they can collect the necessary ethnicity, disability and pay-related data. You should also review your information storage policies to ensure they comply with the GDPR requirements for special category personal data. You may need to encourage members of your workforce to voluntarily disclose the data you require for these purposes, which will require you to consider carefully how best to prepare relevant internal communications. The Government has indicated that regulations will set out the detailed ethnicity and disability reporting requirements and that guidance and practical tools will be developed to support employers with the new reporting requirements.

If you are a Make UK subscriber, you can speak to your regular adviser for guidance on pay related matters. Our HR consultancy team also has a wealth of experience to help you with preparing for these new reporting requirements.

If you are not a Make UK subscriber, you can contact us for further support. Please click here for information on how we can help your business.