Most advice on what GDPR compliance is starts with privacy notices, consent wording and cookie banners. That advice is incomplete. In a Microsoft Dynamics 365 environment, the harder questions are operational: who can access an employee record, when an unsuccessful candidate's CV is deleted, how a suspected breach is logged, and whether HR can produce evidence of a decision under pressure.
UK GDPR became a formal legal requirement in the UK on 1 January 2021, when it took effect after Brexit within the Data Protection Act 2018 framework. It requires organisations processing personal data to demonstrate lawful processing, transparency, security, data-subject rights and accountability, not merely publish a policy. The Information Commissioner's Office's activity reinforces that practical emphasis. In 2024/25, it concluded 43 UK GDPR investigation cases, issued 2 UK GDPR penalty notices, and those penalties totalled £3,826,320. The reported ICO enforcement figures show that compliance remains an operational governance issue.
For HR directors and IT leaders, the useful definition is simple: GDPR compliance means building defensible controls around personal data throughout its lifecycle, then proving those controls work. Dynamics 365 and Dataverse can support that model, but only when configuration, ownership and daily processes are designed together.
Why GDPR Compliance Is No Longer About Paperwork
A privacy notice describes intended use. It cannot stop an administrator opening every employee record, prevent a former contractor retaining a downloaded spreadsheet, or identify which candidate files were exposed during a security incident. Consent forms have the same limit. They record one lawful mechanism, while recruitment, payroll, absence management and employment administration often rely on other grounds.
Operational readiness starts with the controls that act on data. In Dynamics 365 and Dataverse, that means permissions, retention, audit history, incident handling and documented ownership working together.
The ICO's current direction reinforces this shift. Security failures, weak breach handling and poor governance reveal weaknesses that policies can conceal. The regulator's UK GDPR security guidance is under review following the Data (Use and Access) Act 2025, which amended, but did not replace, UK GDPR, the Data Protection Act 2018 and PECR. The ICO's explanation of the Data (Use and Access) Act 2025 sets out the practical implication: organisations need to reassess data protection by design and by default across the lifecycle of their systems and services.
Practical rule: If compliance evidence exists only in a policy folder, the control is probably too far removed from the point where risk occurs.
What operational compliance looks like
Inside Dynamics 365, compliance connects business decisions to technical behaviour. A recruitment record needs a defined purpose, limited visibility, an accuracy route and a retention outcome. An employee investigation needs restricted access, a documented processing reason and an audit trail showing who viewed or changed information.
The employer normally makes those decisions. IT configures identity, permissions, monitoring and recovery. HR owns the workflow, while legal or privacy specialists assess lawful bases, rights and risk. Separation without coordination produces familiar failures: HR exports data to email, IT cannot explain the retention setting, and nobody can assemble a reliable incident timeline.
Why Microsoft environments need deliberate design
Microsoft 365 offers powerful collaboration and administration features, but broad capability does not justify broad access. Dynamics 365, Dataverse, Teams, Outlook, SharePoint, Power BI and Power Apps can connect HR data across structured records, documents, messages and reports. Each connection creates another place to configure access, retention and audit coverage.
A workable design asks:
- Access: Which roles can view sickness information, salary details or investigation notes?
- Retention: What happens when recruitment ends or employment terminates?
- Evidence: Can the organisation show the lawful basis, approval, change history and deletion action?
- Response: Can the team identify affected people quickly enough to make an informed breach decision?
The result should be a control set that HR and IT review together, with settings and records that support the decisions made in practice. Paperwork still matters, but it cannot substitute for controls that operate inside the Microsoft environment.
Core Principles and Lawful Bases Under UK GDPR
UK GDPR principles only become useful when they control a real HR data flow. For each process, define the purpose, identify the fields required, select the lawful basis, limit access, decide the retention outcome and record the decision. In Dynamics 365 and Dataverse, those decisions must appear in tables, security roles, workflows and audit records, not only in a policy document.
The seven principles in HR operations
- Lawfulness, fairness and transparency: Tell candidates why you collect a CV, where it will be stored and how it will be used. Do not reuse recruitment information for unrelated profiling.
- Purpose limitation: A time-and-attendance record supports workforce administration. It does not automatically justify unrelated performance judgements. Record any new purpose and assess it before extending the use.
- Data minimisation: Collect the fields the process needs. A hiring manager may require qualifications and experience, but should not receive unrestricted access to salary, sickness or investigation records.
- Accuracy: Give employees and candidates a controlled route to correct contact details, qualifications, bank information and other inaccurate records. Preserve an audit trail where a correction affects a decision.
- Storage limitation: Define the outcome for unsuccessful applications, expired checks and obsolete investigation material. A retention schedule matters only when owners can apply it across Dataverse, SharePoint, mailboxes and exports.
- Integrity and confidentiality: Protect information from unauthorised access, alteration, loss and disclosure through role-based permissions, identity controls, monitoring and secure recovery. These settings are where security-driven enforcement becomes operational.
- Accountability: Retain evidence of decisions, assessments, policies, contracts, access reviews and response actions. The organisation should be able to show who approved a control and whether it operated.
Retention is often the weak point because the same employee record appears in several Microsoft services. A documented data retention policy should describe the required business outcome, ownership and deletion or review action, rather than just naming a platform setting. Organisations assessing governance options can compare business compliance systems before deciding whether one workflow should manage assessments, evidence and remediation.
Choosing a lawful basis
UK GDPR provides several lawful bases. Select the basis for each processing activity, rather than assigning one justification to the whole HR platform.
Contract commonly supports processing required to employ someone, administer agreed employment terms or pay an employee. Legal obligation may apply where the organisation must meet a statutory duty, including maintaining information required for employment compliance. Legitimate interests can support proportionate business activities where the organisation documents its interests, considers the individual's expectations and records the balance against their rights.
Consent requires a genuine choice and a practical method of withdrawal. It can be unsuitable in employment because the power imbalance may make refusal feel ineffective. Vital interests applies only in exceptional situations involving someone's life or serious wellbeing. Public task is relevant where an organisation performs a task in the public interest or under official authority.
Record the basis against the processing activity and its data fields. Recruitment, payroll, benefits administration, time recording and Right to Work checks can have different purposes, access rules, retention outcomes and legal justifications. A lawful-basis register linked to the Dataverse process gives HR, IT and privacy owners evidence they can test during configuration reviews.
Controllers, Processors, and Data Subject Rights Explained
The controller and processor distinction determines who makes decisions and who must follow instructions. In a typical Microsoft environment, the employer is the data controller because it decides why employee and candidate information is collected and how HR processes operate. Dynamics 365 and Dataverse provide the processing platform, while Microsoft may act as an infrastructure processor under the relevant contractual arrangements.
That description doesn't transfer the employer's accountability to Microsoft or to an implementation partner. The employer still decides which fields exist, who receives access, how long records remain available and how a request or incident is handled.
Turning rights into system actions
The eight principal data subject rights require more than an inbox monitored by HR. The right to be informed depends on clear notices. Rectification requires controlled editing and a way to propagate corrections. Erasure requires an assessment of whether deletion applies, followed by action across connected records. Restriction should prevent prohibited processing without destroying information needed for a dispute or legal obligation.
The right of access is particularly demanding in HR because information may exist in structured records, notes, documents, emails and collaboration channels. The ICO requires a response to a subject access request without undue delay and within one month. That period can be extended by up to two further months where the request is complex or the individual has made multiple requests. The ICO's subject access guidance sets out those response expectations.
A workable Dynamics 365 process should capture identity verification, request scope, ownership, searches completed, exemptions considered, approval and secure delivery. Dataverse views can support triage, while audit information helps distinguish the current value from historical changes. Automation should assist the process, not make an unreviewed legal decision.
Governance outside the application
Data portability, objection and rights relating to automated processing need careful assessment because the appropriate response depends on the processing purpose and legal context. AI-assisted CV parsing, scoring or workforce analysis should have clear human oversight and documented safeguards.
The processor arrangement also needs attention. Contracts, subprocessors, security obligations, return or deletion expectations and support for rights requests should align with the actual architecture. For a practical reference point on contractual and privacy matters, review these legal and privacy details. A separate data processing agreements guide can help teams organise the evidence needed when several suppliers interact with the same HR data.
A rights workflow fails when it relies on manual searching across personal mailboxes. It works better when the organisation knows the systems in scope, assigns one accountable owner and records every decision.
The 2025 Legislative Changes and Shifting Enforcement Priorities
The Data (Use and Access) Act 2025 changes the UK compliance environment without replacing the UK GDPR framework. Existing explainers that describe only the pre-Act position can therefore mislead HR and IT leaders, especially where they treat privacy notices as the main deliverable.
The operational question for 2026 is not whether organisations should abandon existing UK GDPR controls. It's which controls need re-checking against updated guidance, revised workflows and the organisation's actual use of technology. The ICO's emphasis on data protection by design and by default means a new HR feature, integration or AI capability should be assessed before deployment, then reviewed as the service changes.
Where enforcement risk is visible
The ICO concluded 43 UK GDPR investigation cases in 2024/25, issued 2 UK GDPR penalty notices, and imposed penalties totalling £3,826,320. Those figures should not be read as permission to reduce investment. A low volume of published penalties can coexist with detailed scrutiny of security, governance and process evidence. The annual report analysis supports a more cautious interpretation.
A separate UK legal summary reports that, in 2025, the ICO issued six monetary penalty notices totalling more than £20 million, with cases linked to cyber-attacks and security failings. The discussion of the ICO's draft complaints guidance and enforcement themes identifies security and integrity as the stronger practical focus than consent wording or cookie banners.
The implication for Dynamics 365 programmes is direct. Funding should cover access governance, secure configuration, logging, retention, recovery and response testing, not just policy refreshes.
Complaints are part of the control environment
The ICO's draft complaints guidance expects organisations to provide a direct way to complain, acknowledge complaints within 30 days, act without undue delay, keep complainants informed and justify how each complaint was handled. HR teams should treat that as a workflow requirement. A case record should capture the complaint, owner, actions, communications, decision and supporting evidence.
Practical GDPR Implementation Inside Dynamics 365 and Dataverse
A compliant HR platform is defined by its data flows and controls, not by the appearance of its screens. Map recruitment, onboarding, employment administration, absence, time and attendance, performance, expenses, Right to Work checks and offboarding. For every flow, record its purpose, personal-data categories, users, connected services, lawful basis, retention outcome and risk controls.
The sequence below gives HR and IT distinct responsibilities while keeping one evidence trail from the original requirement through configuration, review and deletion.
Control the record lifecycle
Configure retention around business events and data categories. Candidate records should move through defined recruitment outcomes. Employee records need an approved lifecycle for leavers. Documents and email attachments require separate treatment because deleting a Dataverse row does not necessarily remove copies held in SharePoint or a mailbox.
Use Dataverse security roles, business units and teams to restrict access to what each role requires. Review privileged roles on a set schedule, remove dormant accounts and separate platform administration from ordinary HR access. Microsoft Entra ID supports role assignment, multifactor authentication and conditional access, but those settings must match the sensitivity of HR data and the way the service is used.
Apply data protection by design during solution design, before user acceptance testing. A field that should not be collected is easier to prevent than to locate and delete across Dataverse, SharePoint, email and connected applications.
Assess high-risk processing before launch
The ICO describes a Data Protection Impact Assessment as a systematic method for identifying and reducing data-protection risks. A DPIA is required where processing is likely to create a high risk to individuals' rights and freedoms. Novel technologies and automated decisions are explicit triggers in ICO guidance, so DPIA screening should cover AI-assisted CV parsing, profiling, and biometric or facial-recognition clocking.
Document:
- Purpose and necessity: State the business need and why each selected data item is required.
- Data categories: Distinguish ordinary personal data, special category data and employment-related information.
- Lawful basis: Record the basis and any separate condition needed for more sensitive information.
- Individual impact: Assess discrimination, incorrect decisions, exposure, loss of control and unexpected reuse.
- Mitigation: Apply minimisation, access restrictions, human review, transparency, testing and deletion.
- Residual risk: If high risk remains after mitigation, consult the ICO before processing starts, in line with the ICO's DPIA guidance.
The approval record should identify the owner, reviewers, open actions and conditions for launch. Store the final DPIA where the delivery and privacy teams can retrieve it during a control review.
Build breach and complaint workflows
A suspected breach needs a timestamped incident record, assigned investigator, affected systems, relevant data categories, potentially affected people and records, containment actions, and a documented notification decision. The ICO says a notifiable breach must be reported without undue delay and, where feasible, within 72 hours of awareness. The ICO's breach guide also requires an explanation if notification is late.
Connect the assessment to Dataverse audit records, Entra ID sign-in information, Microsoft 365 security evidence and backup or recovery activity. Retention discipline reduces the information exposed and makes impact analysis more manageable. The ICO's personal data breach guidance confirms that notification depends on whether the incident is likely to create a risk to individuals' rights and freedoms.
Use a related complaint workflow for employee, candidate and manager concerns. Capture receipt, acknowledgement, ownership, updates, resolution and rationale. A complaint should remain an accountable case record after the email thread closes.
Map obligations to features
| GDPR Obligation | Dynamics 365 / Dataverse Control | Key Configuration |
|---|---|---|
| Purpose limitation | Process-specific tables, forms and views | Define the processing purpose, permitted users and connected processes |
| Data minimisation | Required-field design and restricted columns | Collect only information needed for recruitment, employment or administration |
| Storage limitation | Retention rules and lifecycle status | Set review, archive and deletion actions for candidates, employees and documents |
| Integrity and confidentiality | Dataverse security roles and Entra ID | Apply least privilege, multifactor authentication, conditional access and access reviews |
| Accountability | Audit history, approvals and processing records | Record lawful basis, DPIA outcomes, changes, access decisions and deletion evidence |
| Data subject rights | Request intake and controlled exports | Track identity checks, searches, exemptions, approvals and secure responses |
| Breach response | Incident table and response workflow | Capture awareness time, impact assessment, containment, notification and communications |
| Complaints handling | Case management and reminders | Record acknowledgement, updates, decisions and supporting justification |
Your Mid-Market GDPR Compliance Checklist
A mid-market organisation needs a checklist that produces evidence, not a document that merely confirms intentions. For organisations with 50 to 4,000 employees, the useful test is whether an independent reviewer could follow the path from a processing purpose to the configuration, owner, decision and outcome.
Governance foundations
- Assign ownership: Name the controller-side owner for each HR process and define IT, HR, security and privacy responsibilities.
- Maintain processing records: Describe purposes, data categories, recipients, retention and safeguards for recruitment, payroll, attendance and employee administration.
- Document lawful bases: Link each processing activity to its lawful basis and record the reasoning.
- Control suppliers: Keep processor agreements, subprocessor information, security commitments and deletion expectations aligned with the live architecture.
- Keep policies usable: Make privacy notices, retention rules, rights procedures and complaint routes accessible to the people who operate them.
Data mapping and minimisation
Trace information from candidate application to recruitment decision, then through onboarding and employment. Include exports, email, Teams, SharePoint, Power BI and Power Apps, not just the main Dynamics 365 tables.
Check for blind spots:
- Unsuccessful candidates: Confirm that application records, interview notes and CV attachments have a defined retention outcome.
- Internal investigations: Restrict access to sensitive material and record why each person can view it.
- Right to Work checks: Separate the operational need from unrelated employee information, then control access and retention.
- Reporting copies: Identify dashboards, spreadsheets and downloaded files that bypass the source system's controls.
Technical security and response
Review Entra ID roles, privileged access, multifactor authentication, conditional access, Dataverse security roles, audit settings, backup access and administrator activity. Test whether the organisation can identify who accessed or changed a sensitive record.
Maintain a breach playbook that records awareness time, risk assessment, affected categories, approximate impact, containment and notification reasoning. The ICO's expectation of notification within 72 hours where the breach is notifiable makes timestamps and ownership operational necessities, as set out in its personal data breach reporting guidance.
Rights and ongoing monitoring
Provide one route for access, correction, erasure, restriction, objection and portability requests. Record identity verification, scope, searches, decisions, communications and secure delivery. For subject access requests, test the process against the ICO's one-month response requirement and the permitted extension for complex or multiple requests.
Review access and retention outcomes routinely. A control that was correct at launch can become unsuitable after a new integration, restructuring, acquisition or AI feature. Evidence should show not only that a review was scheduled, but what changed as a result.
Next Steps for Building a Compliant HR Platform
Start with the highest-risk gaps. Check privileged access, retention of candidate and employee data, DPIA coverage for automated or advanced processing, breach timestamps, subject access ownership and complaint handling. Then turn each gap into a named action with an owner, target outcome and evidence requirement.
The right implementation partner should understand both Dataverse architecture and UK employment data realities. Hubdrive's HR Management for Microsoft Dynamics 365 is a hire-to-retire solution built for Microsoft Dynamics 365, with capabilities covering recruitment, onboarding, performance, time and attendance, compliance workflows, retention and UK Right to Work processes. DynamicsHub.co.uk delivers Experience HR transformation built around your business, with UK-based implementation, customisation and ongoing support for Microsoft-centric organisations.
The practical objective isn't to buy another compliance document. It's to configure an HR platform that limits access, applies retention, supports rights requests, records decisions and gives HR and IT evidence when they need it.
DynamicsHub can help you assess your Dynamics 365 and Dataverse HR controls, design a UK GDPR implementation roadmap and configure retention, access, DPIA and response workflows around your organisation. Phone 01522 508096 today, or send us a message through DynamicsHub to discuss your requirements.
