GDPR compliance in construction [Guide for subcontractors]

When it comes to handling personal data, the General Data Protection Regulation (GDPR) isn’t something businesses can afford to take lightly. Construction is no exception.

So far, there has been only one high-profile UK GDPR fine in the construction sector, but it was significant enough to put data protection firmly on the radar. That’s because the case involved a £4.4 million fine against a construction and facilities management company after a cyberattack exposed the personal data of up to 113,000 employees.

While subcontractors aren’t typically at the top of the construction supply chain, they still handle personal data and have a responsibility to protect it, even when working under main contractors or alongside other businesses.

This guide breaks down what subcontractors need to know about GDPR compliance in construction, including their responsibilities and the practical steps they can take to meet them.

Key takeaways

• GDPR applies to construction subcontractors of all sizes
  If you handle personal data, you must protect it, whether you’re a sole trader or a larger business.

• Know your data protection responsibilities
  Understand when you act as a controller or processor, identify a lawful basis for processing data, and be clear with people about how their information is used.

• Protect personal data from collection to deletion
  Keep records secure, limit access, set retention periods, train workers, and have a plan for data breaches and information requests.

• Get data sharing right across the supply chain
  Check contracts and responsibilities with main contractors, especially when handling personal data on their behalf.

• Use Onetrace to manage project information more consistently
  Onetrace’s centralised documents, access controls, custom forms, and traceable job records help subcontractors organise information and support their data protection processes.

What is GDPR?

GDPR is a data protection law introduced by the European Union (EU) in 2018. It sets out how organisations must collect, use, store, and share personal data, with the aim of protecting people’s privacy and giving them greater control over their information. It also gives individuals rights over their personal data and requires organisations to handle it lawfully, fairly, and securely.

Following Brexit, the UK retained GDPR in domestic law, adapting it to create the UK General Data Protection Regulation (UK GDPR). It operates alongside the Data Protection Act 2018, which supplements the framework with additional provisions.

The core principles and responsibilities remain broadly similar to those of the EU GDPR, but the UK framework is overseen by the Information Commissioner’s Office (ICO).

For subcontractors operating solely in the UK, the UK GDPR and the Data Protection Act 2018 are the main laws governing how they handle personal data. Businesses that also operate in the EU, offer services to people there, or monitor their behaviour may need to comply with the EU GDPR as well.

GDPR compliance in construction: Key questions answered

Construction businesses handle a significant amount of personal data throughout a project, including when pricing up a job, onboarding workers, managing site access, and recording health and safety incidents.

Much of this information is gathered as part of routine work, and you might not think of a quote, an induction form, or a site photograph as a data protection concern. However, if it identifies a person, it may contain personal data.

To make this more concrete, the table below highlights the types of personal data construction subcontractors may handle:

Not every subcontractor will handle all these types of information, and some records may contain more sensitive personal data than others.

Health information, for example, receives additional protection under UK GDPR, requiring businesses to provide an additional legal condition to process it, beyond the usual lawful basis.

Does GDPR apply to all subcontracting businesses?

The UK GDPR and Data Protection Act 2018 apply to subcontracting businesses of all sizes—including sole traders—whenever they process personal data within the scope of the legislation. Being a small business doesn’t exempt you from your data protection responsibilities.

Some limited exemptions exist for certain administrative requirements, such as records of processing activities for businesses with fewer than 250 employees. However, these exemptions are narrow and don’t remove most core data protection obligations.

What are a subcontractor’s responsibilities as a data controller or data processor?

A subcontractor’s responsibilities under GDPR depend on the role they play in handling personal data.

A data controller decides why personal data is collected and how it’s used, while a data processor handles personal data on behalf of another organisation and follows its instructions. However, your role can vary depending on the task.

For example, if you collect customer details to prepare quotes, manage your workforce, or pay suppliers, you will generally act as a data controller for those activities because you decide how and why the information is used.

However, if a main contractor asks you to process personal data on its behalf and according to its instructions, you may act as a data processor for that activity.

In some arrangements, a subcontractor and a main contractor may each act as controllers for their own activities. 

Why GDPR compliance matters for subcontractors

GDPR compliance isn’t just another administrative task. It matters for several reasons:

• Avoiding fines and legal trouble: Poor data handling can lead to complaints, regulatory action, and financial penalties. Serious breaches of UK GDPR can result in fines of up to £17.5 million or 4% of annual worldwide turnover, whichever is higher.

• Maintaining customer trust: Protecting customers’ personal information shows that you take their privacy seriously.

• Protecting workers’ privacy: Employment records, health information, and site access details need to be handled carefully and securely.

• Meeting main contractors’ expectations: Proper data protection practices help you meet your responsibilities when sharing information across the supply chain.

• Keeping your business organised: Defined processes for storing, accessing, and deleting personal data help prevent mistakes and keep records under control.

How can construction subcontractors stay GDPR-compliant?

Staying GDPR-compliant in construction can be quite challenging.

That’s because information is collected across multiple sites, shared between subcontractors and main contractors, and stored in everything from paper documents to data protection construction software. Plus, with changing teams and busy project schedules, it can be hard to track what personal data you hold, who can access it, and when it should be deleted.

Here’s a step-by-step guide to staying GDPR-compliant while managing these day-to-day challenges.

1. Audit the personal data your business collects and stores

Start by mapping the following:

• Where personal data comes from

• Why you use it

• Where it’s stored

• Who can access it

• When it should be deleted

Include emails, spreadsheets, paper files, phones, accounting systems, and site apps.

This comprehensive approach gives you an accurate picture of what you hold and where gaps may exist.

2. Identify a lawful basis for using personal data

Every use of personal data needs a lawful basis.

For example, contractual necessity may cover information needed to deliver agreed work, while legal obligation may apply to certain tax records.

Legitimate interests may be appropriate for some security activities, such as site CCTV, if the necessary balancing test supports it.

Note:

Consent isn’t automatically required for routine business processing.

3. Provide clear privacy notices to workers and customers

Explain what personal data you collect, why you need it, how you use it, how long you keep it, and who you may share it with.

Make this information easy to find, such as in onboarding paperwork, customer forms, or your website’s privacy notice.

4. Secure site records, mobile devices, and job management apps

Use strong passwords, multifactor authentication, and access permissions that limit who can view or download records.

Additionally, lock devices when they’re unattended, share files securely, and check where job management apps store data and how they protect it.

Site photos need care, too: Avoid capturing identifiable people or private details unless necessary.

5. Protect health, safety, and site access information

Induction forms, accident reports, and medical information can reveal sensitive details. That’s why you should only collect what’s needed, restrict access to authorised people, and apply the extra legal safeguards required for health data.

6. Keep personal data only for as long as necessary

Set retention periods for worker records, quotes, invoices, site documents, and CCTV footage.

There’s no single timeframe for all personal data. Relevant CIS records generally need to be kept for at least three years after the end of the tax year they relate to, while some health and safety records may need to be retained for up to 40 years.

Check the rules that apply to each record type, then securely delete or anonymise information when you no longer need it.

7. Check contracts and data-sharing arrangements with main contractors and suppliers

Be clear about whether you’re acting as a controller or processor for each activity.

If you process personal data on a main contractor’s behalf, a written data processing agreement may be required.

In addition, you should verify how information should be shared and what security measures each party must follow.

8. Train workers and control who can access personal data

Anyone handling personal data should know how to store it safely, share it appropriately, and spot potential risks.

Cover practical situations like: 

• Sending an email to the wrong person

• Taking site photos

• Losing a work phone

9. Know what to do if personal data is lost or exposed

A stolen phone, misplaced worker file, or email sent to the wrong recipient could be a personal data breach.

That’s why you should have a pre-defined process for reporting and assessing incidents quickly.

You must notify the ICO within 72 hours of becoming aware of a breach if it’s likely to pose a risk to people’s rights and freedoms. If that risk is unlikely, you don’t need to notify the ICO, but you must document the breach and your decision.

If the breach is likely to pose a high risk to affected individuals, you must also inform them without undue delay. The same applies to the relevant controller if you’re a processor.

10. Respond to requests for personal data

Workers and customers may ask to see the information you hold about them or request that it be corrected or deleted.

So, decide in advance who will handle these requests and how you’ll find the relevant records.

Most requests must be answered within one calendar month, although some exceptions and extensions apply. These include:

• Extending the deadline by up to two further months for complex or multiple requests

• Delaying the response period until you receive the information needed to verify someone’s identity

• Pausing the deadline while waiting for clarification if you reasonably need it to respond

• Withholding certain information or refusing requests in limited circumstances, such as when a request is manifestly unfounded or excessive

11. Review your data protection practices as projects change

Starting a new project, bringing on new workers, or adopting a new app can change what personal data you collect and who needs access.

So, you should review your records, permissions, contracts, and retention periods regularly to ensure your practices keep pace with the business.

How Onetrace can help construction subcontractors manage project information

To stay compliant with the GDPR, construction subcontractors need to ensure personal data is handled securely, consistently, and appropriately, both on and off site. Well-built construction management software like Onetrace can make this much easier.

Onetrace supports both sides of GDPR compliance in construction: It provides practical tools to help you manage project information responsibly, and protects the personal data you store in the platform with ISO-27001-certified security.

With Onetrace, you get:

• Centralised project documentation: Keep contracts, RAMS, certificates, and other project files organised in one place.

• Access controls: Manage folder permissions to help ensure sensitive information is only available to the right people.

• Consistent data collection: Create custom forms with mandatory fields to help teams capture accurate, structured project records.

• Traceable evidence of work: Record site photos, complete job sheets, and generate reports to support client handovers and audits.

• Defined data protection commitments: Onetrace’s Data Processing Addendum explains how it handles personal data, including security safeguards, confidentiality, subprocessors, and support with data protection requests.

• Support when things change: The addendum also covers personal data breach notifications and arrangements for data transfers and data deletion when your service ends.

Onetrace was also built specifically for construction subcontractors, with over 1,000 businesses using the platform. This means its tools are designed around the realities of subcontracting, helping you manage project records and compliance-related tasks without adding unnecessary complexity.

Want to see how Onetrace could work for your business?

Book a personalised demo to explore the platform and find out how it could help your team manage project information more effectively.

FAQ

What are the 7 GDPR requirements?

The seven GDPR principles are:

• Lawfulness, fairness, and transparency

• Purpose limitation

• Data minimisation

• Accuracy

• Storage limitation

• Integrity and confidentiality

• Accountability

Who does GDPR not apply to?

GDPR generally doesn’t apply to individuals processing personal data for purely personal or household activities, or to information that isn’t personal data. Certain legal exemptions also apply in specific circumstances.

Is GDPR only for EU citizens?

No. GDPR isn’t limited to EU citizens. It can protect identifiable individuals regardless of citizenship, depending on where and how their personal data is processed.

Who must comply with GDPR requirements?

Any organisation or individual acting as a data controller or processor must comply with GDPR requirements when processing personal data within the law’s scope. This includes sole traders, small subcontractors, and large contractors.

Who manages GDPR compliance?

In the UK, the Information Commissioner’s Office oversees and enforces data protection law. Each organisation is responsible for its own compliance, with a data protection officer required in certain circumstances.

What data is exempt from GDPR?

Data exempt from GDPR includes genuinely anonymised information that can’t identify an individual.