On the sixth day of Christmas, HR was asked “What's Sarah’s home address? I want to send her a Christmas present, and I don't want to guess!”

And HR replied…. personal data is not for sharing!

Employers need to comply with their GDPR obligations even when it comes to Christmas! This includes having a lawful basis for processing the personal data, only using it for that purpose and being transparent with employees about how their data will be used before any processing takes place.

Before sharing any personal data with line managers or other employees, employers should check their employee privacy notice to see whether it provides for the employer to use and share the employee’s home address in this way. If it does not, then the best approach would be to ask the employee whether they are willing to share their home address explaining why it is needed and reassuring them that it will only be used for this purpose.

If the employer uses a third party to send out Christmas cards or presents to employees, again it is important to check that the data sharing section of the employee privacy notice covers this. If not, then again employees will need to be informed in advance what information needs to be shared and why, with whom it is being shared and what lawful basis the employer is relying on to allow for the sharing.

If the employee privacy notice is silent on this issue and it is likely to come up every year, consider amending the employee privacy notice to include the sharing of home addresses for these legitimate reasons and re-issuing it to employees, being sure to do this well in advance of any information being shared.

If it is usual for employees to receive gifts from suppliers and customers, it is also worth a gentle reminder to employees about the organisation’s policy on receiving gifts and its bribery policy.