PanicStation.org
UK USA
uk Work & employment crises

What to do if…
your personal information is being shared at work without your consent

Produced and maintained by PanicStation.org Published: Last reviewed: Editorial policy UK guide

Short answer

Record what appears to have been shared and ask your employer in writing to stop any unnecessary further sharing. Ask for the matter to be handled as a data protection complaint and for a clear explanation of what happened.

Do not do these things

  • Do not resign, threaten anyone or send an all-staff message while you are distressed.
  • Do not delete relevant emails, messages, screenshots or notes.
  • Do not repeat the information widely to prove that it has been shared.
  • Do not publicly confront the person you suspect shared it.
  • Do not copy restricted workplace files to a personal device or account.
  • Do not access records or messages that you are not authorised to view.
  • Do not assume that sharing without consent is automatically unlawful, because an employer may rely on another lawful basis in some circumstances.

What to do now

  1. Address any immediate risk. Change exposed passwords or access codes and contact workplace IT or security if account details were shared. Contact your bank or card provider if financial details may be at risk. If the disclosure creates an immediate threat to your physical safety, move to a safer place and call 999.

  2. Make a factual record. Note what personal information was shared, when and where it appeared, how you found out, who may have sent or received it, and any effect it is having. Keep copies of material you already have lawful access to.

  3. Check your employer’s privacy notice, data protection policy and complaints procedure. Look for a data protection officer, privacy team, HR contact or appropriate manager.

  4. Contact that person or team in writing. State clearly that you are making a data protection complaint and describe the information, the apparent sharing and any urgent risk.

  5. Ask the employer to:

    • stop any unnecessary further sharing
    • contain the disclosure where possible
    • preserve relevant emails, messages, access records and audit logs
    • confirm what information was affected
    • explain how and why it was shared
    • identify the purpose and lawful basis relied on
    • explain what protective or corrective steps are being taken

  6. If the information is inaccurate or incomplete, identify the error, explain what the correct information is and provide supporting material where available. Ask the employer to correct its records and address inaccurate copies already disclosed.

  7. If the sharing is also causing bullying, discrimination or another workplace problem, raise that issue with a manager, HR or your trade union representative. Use another appropriate contact if the person normally responsible is involved.

  8. Keep your complaint, evidence and every response together. If the employer does not resolve the concern or you remain dissatisfied after giving it an opportunity to respond, you can consider making a complaint to the Information Commissioner’s Office.

What can wait

You do not need to decide today whether to resign, claim compensation or take legal action. A detailed subject access request, formal grievance or consultation with a specialist can usually wait until you have requested immediate containment and an explanation.

Important reassurance

Finding out that personal information has circulated at work can feel exposing and destabilising. You can take this one step at a time: limit further harm, create a clear record and ask the employer to deal with the concern through its data protection process.

Scope note

This guide covers immediate first steps only. Later decisions may require support from a trade union, Acas in England, Scotland and Wales, the Labour Relations Agency in Northern Ireland, the Information Commissioner’s Office, or an employment or data protection specialist.

Important note

This is general information, not legal or professional advice. Whether the sharing complied with data protection law depends on the information involved, the purpose, the lawful basis, the recipients and the surrounding circumstances.

Additional Resources

Closely connected guides that may be useful during the same situation or its immediate aftermath.

About this guide

This guide was produced and is maintained by PanicStation.org using its published editorial process. Official and specialist sources are checked where relevant, and AI-assisted tools may be used for drafting, organisation, and consistency checks. The site operator remains responsible for publication, revision, and removal decisions.

Support us