Data Protection for Construction and Trades

Overview

Construction firms, contractors, and trades may not think of themselves as data-heavy, but they hold a surprising amount of personal data: worker records, subcontractor details, client information, and site footage. This guide explains how to handle it under the Act.

Why this matters

Worker safety records, injury reports, and identity documents are sensitive and valuable. Sites are busy and informal, which is exactly where data gets mishandled. A little structure protects your people and your business.

The data you hold

• Workers: names, TRN, contact and next-of-kin details, pay, certifications.
• Health and safety: injury reports, medical fitness, incident records (often sensitive personal data).
• Subcontractors and agencies: company and individual contact details.
• Clients: contact, site, and project information.

Subcontractors and agencies

When you bring in subcontractors or labour agencies, work out who decides how the data is used. Often both parties have responsibilities. Set the arrangement out in writing so everyone knows their role (see Who is a Data Controller?).

Site CCTV and worker monitoring

Cameras and tracking can be legitimate for safety and security, but they must be fair and transparent:

• use clear signage so workers and visitors know
• limit who can view footage and set a retention period
• avoid covert or excessive monitoring

Common mistakes

• Leaving worker files and safety records unsecured in site offices or vehicles.
• Sharing worker contact lists freely over personal messaging apps.
• Running site cameras with no signage or retention limit.

Best practices

• Keep worker and safety records secure, with limited access.
• Put written terms in place with subcontractors and agencies.
• Give workers a simple privacy notice and dispose of old records securely.