Attendance Records as Personal Data

General orientation, not legal advice; requirements differ by jurisdiction.

Attendance records describe named people's days, and sickness records touch health. Both carry obligations, and for a small business they are manageable.

What you are holding

Presence and absence by day, which over a year describes someone's life in some detail: caring patterns, health episodes, religious observance inferred from leave dates.

Sickness dates, which are ordinary personal data.

Medical evidence and any diagnosis, which is health data and a special category with a higher bar.

The distinction matters and it is why the note on what to record argues for keeping the diagnosis out.

The four things to do

Say what you hold and why. A paragraph in the handbook: we record attendance and absence to manage cover, calculate leave and pay, and meet our legal obligations.

Keep it to what you need. Dates and a broad reason, not detail.

Limit who sees it. Managers see their team; medical evidence goes to one named person.

Delete on a schedule. A retention period per record type, applied.

That is the whole compliance burden for an ordinary small employer holding ordinary attendance records.

Access requests

People can ask for a copy of what you hold about them.

Which means records need to be findable per person, and free of anything you would not want them to read. A note saying "off again, suspicious" is discoverable, and it reads badly.

Write records as though the person will see them, because eventually one will.

Know the response period for your jurisdiction, and test once that you could meet it.

Medical evidence specifically

Stored separately from the attendance record, with access limited to whoever handles HR.

Its own retention period, usually shorter than the attendance record.

Not shared with colleagues, including the ones covering the shift who will ask. "They're off sick" is the complete answer.

Not used for anything other than the purpose it was obtained for.

Retention

Attendance and leave records: driven by employment and payroll obligations, commonly a few years.

Sickness absence dates: tied to statutory sick pay rules, which set their own period.

Medical evidence: shortest, and delete it when the reason for holding it has passed.

Write the periods down and apply them. Holding twelve years of sickness records is not caution; it is an unnecessary liability with no operational use.

The test worth applying

Could you show a person everything you hold about them, today, and would you be comfortable doing so?

If no to the first, the records are disorganised. If no to the second, something is in there that should not be.

Write records as if they will be read

Because eventually one will be.

People can request everything you hold about them.

A note saying "off again, suspicious" is discoverable and reads exactly as badly as it sounds.

Record facts and agreements, not impressions.

Where a concern exists, it belongs in a conversation and, if it goes further, in a proper process — not as an aside in an attendance sheet.

Connect policy to configuration

The practical choices behind this note can be compared with employee PC activity tracking. Keep the written purpose in control of the setup, enable only data needed for that purpose and review the result with affected employees.

Independent reference

For an external point of reference, see the Information Commissioner's Office. Its guidance is a useful external reference when defining lawful purpose, access, retention and rights around employee records.