my partner has asked if she can see the holiday rota and was told she couldn't because of GDPR. Is that correct? I know anything that identifies you needs to be secure but the rota of when people are working is clearly visible on their noticeboard so doesn't the same apply to that?


  • Perhaps the rota contains more details, like training days, reasons for being away other than vacation (e.g. maternity leave), sick days. – Stefano Palazzo Apr 5 at 9:38
  • For those of us who don't know what a rota is, it is apparently a kind of schedule. – phoog Apr 5 at 15:27

There is no clear answer to this question.

  • The GDPR doesn't not apply, but it delegates rules for processing in the context of employment to member states. That means, the laws in your country might override the GDPR here.
  • As the data controller in this situation, the company must protect the personal data it processes, including the personal data of employees. Protection doesn't have to be absolute, just proportional to the risks. It may be fine to treat data in one context more carefully than another. This is always a judgement call of the data controller.

There is nothing about holiday rotas where the GDPR would require them to be kept under lock. The company could very well decide that this data isn't very sensitive and that everyone can look at it themselves. For example, the company might argue they have a legitimate interest for this so that employees can see whether their colleagues are unavailable.

But until the controller makes such a decision, the rota contains other person's personal data and cannot be disclosed without a legal basis.

Here, I see three reasons why the company might be acting that way:

  • They are overly careful with GDPR compliance and are cargo-culting restrictions that are not actually necessary.
  • They have made a conscious decision to restrict access to this data to protect the private life of employees.
  • They want to make it more difficult for employees to take time off.

Your Answer

