GDPR compliance and data protection at Ciphr

Keep your people data safe and your organisation protected

At Ciphr, data protection sits at the centre of what we do.

We help you manage employee data in line with UK GDPR through secure systems, clear controls, and proven governance. Depending on how you work with us, we act as both a data processor and a data controller, and we take that responsibility seriously.

So you can focus on your people, instead of risk.

Talk to us about compliance at Ciphr

A transparent approach to data protection

We don’t just talk about security. We show you how it works.

Our Trust Centre gives you a clear, detailed view of how we protect your data, including:

Security controls and architecture
Certifications and audit evidence
Data protection policies and processes
AI governance and product safeguards

So you can evaluate risk with confidence, and answer internal stakeholders with ease.

Explore the Ciphr Trust Centre

Built on secure foundations

Your data lives in platforms designed with security at their core. We use:

Multiple layers of encryption
Protective monitoring and auditing
Regular vulnerability assessments and penetration testing

Security testing includes both internal resources and external CREST-accredited partners.

We review and strengthen our approach continuously to stay ahead of new threats.

Access that stays controlled

We make sure the right people — and only the right people — have access to sensitive data.

That includes:

Role-based permissions
Defined access controls and policies
Ongoing governance through an internal security forum

Our security forum, led by our director of information security & IT, regularly reviews controls, policies and procedures to ensure they remain effective.

Talk to us about GDPR compliance at Ciphr

Standards you can trust

We back up our approach with recognised certifications:

ISO 27001 — information security
Cyber Essentials Plus — independently audited protection
ISO 9001 — quality management
ISO 14001 — environmental management

These standards shape how we manage, measure, and improve security across the business.

You can explore these certifications, alongside supporting documentation, in our Trust Centre.

Visit Trust Centre

Clear roles. No grey areas.

We’re transparent about how we handle your data:

As a controller, when we decide how data gets used
As a processor, when we manage data on your behalf

We also have a data protection officer (DPO) who provides oversight and accountability.

Protection across the full lifecycle

From collection to retention, we apply consistent controls across every stage:

Secure data storage
Defined retention policies
Controlled data sharing
Safeguards for international transfers

This supports key GDPR principles like accountability, transparency, and data minimisation.

"Having clear visibility into how suppliers manage data — including AI — is becoming critical for HR and IT teams."

Claire Hawes

Chief people officer and data protection officer, Ciphr

Clear boundaries on how AI is used

Our AI features are designed to support users, not make uncontrolled decisions about people

Data stays protected

We don’t use your employee data to train public AI models, and we apply strict controls to how data is processed within AI-powered features

Transparency and oversight

We document how our AI tools work, so you can understand where automation is applied, and where human review is required

Ongoing risk management

We continuously assess AI risks, update controls, and refine our approach as technology and regulations evolve

How this supports your GDPR compliance

You’re responsible for compliance - but you don’t have to do it alone.

We give you a secure, structured foundation so you can:

Store employee data safely
Reduce risk from manual or disconnected systems
Maintain consistent data protection practices
Show a clear, credible approach to compliance

"Ciphr really is first to market with a lot of its developments; I was a big fan of the GDPR data deletion and monitoring function."

Certitude

Always improving, always protecting

Security doesn’t stand still. Neither do we.

We constantly:

Review and strengthen controls
Test systems and processes
Update policies as risks evolve

So your data stays protected, today and tomorrow.

See how we do it

For a deeper look at our security practices, certifications, and approach to protecting customer data, visit our Trust Centre or talk to us today.

Visit Trust Centre

Talk to us

What role does Ciphr play in GDPR compliance?

How does Ciphr protect customer data?

Does Ciphr hold recognised security certifications?

How does Ciphr manage access to sensitive data?

Who is responsible for data protection at Ciphr?

How does Ciphr keep its security measures up to date?

How does Ciphr govern the use of AI?

What is the GDPR?

The General Data Protection Regulation (GDPR), which came into effect on 25 May 2018, is a set of standards that all organisations in the EU are required to comply with. These regulations govern how personal data is collected, processed, and stored. Any organisation that handles data belonging to a resident of the EU must adhere to the GDPR’s requirements, or face considerable fines.

What does GDPR mean for employers?

HR is the keeper of significant amounts of employee personal data, but the onus for maintaining data in line with the GDPR is typically shared among HR and information security teams, and, of course, the appointed data protection officer (DPO). Employers must put in place policies and procedures to ensure employee (and applicant) data is collected, stored and processed in line with the GDPR’s requirements, and that they respond to subject access requests (SARs) within the required timeframe.

What employee data is covered by the GDPR?

Types of employee data covered by the GDPR can include, for example, job and pay records, addresses, next-of-kin information, details of any medical conditions or disabilities, the results of background checks or right to work checks, and any other personally identifiable information. Because HR, HR managers, and HR practitioners are usually the guardians of an organisation’s employee records, they are responsible (alongside information security teams and the DPO) for compliance with the GDPR in relation to personal, sensitive employee data. HR practitioners and HR managers must ensure they have a lawful basis for collecting and storing data related to employees and job applicants, and that the data is stored only for the required and agreed period (if permissions for data have expired, consent must be captured again, or the data must be deleted or anonymised). They may also have to respond to subject access requests (SARs) from former or existing employees, who, under the GDPR, have a legal right to request a copy of all the personal data that the organisation holds about them.

Disclaimer

We would strongly recommend that you seek your own legal advice if you are unsure about the implications of data protection laws on your business. The information contained on this website is for general guidance purposes only. It should not be taken for, nor is it intended as, legal advice. While we have made every effort to ensure that the information provided on this document is correct and up to date, Ciphr makes no promises as to completeness or accuracy and the information is delivered on an “as is” basis without any warranties, express or implied. Ciphr will not accept any liability for errors or omissions and will not be liable for any damage (including, without limitation, damage for loss of business or loss of profits) arising in contract, tort or otherwise from the use of or reliance on this information, or from any action or decisions taken as a result of using this information.