Employee data in the data room: TUPE information and anonymisation

The first question is always which column you are in. Many sellers assume TUPE governs every deal involving staff. It does not: on a share sale the company remains the employer, nothing transfers, and the regulations do not apply. The employees are still the subject of diligence, and the data protection rules still bite, but the specific statutory duties do not.

What is TUPE, in data room terms?

The Transfer of Undertakings (Protection of Employment) Regulations 2006, known as TUPE, protect employees when the business or activity they work in moves to a new employer. Their contracts transfer automatically on existing terms, and dismissals because of the transfer are generally unfair.

For the data room, three provisions matter:

• Employee liability information (ELI). The transferor must give the transferee written information about the transferring employees, at least 28 days before the transfer.
• Information and consultation. Both employers must inform, and where measures are planned consult, appropriate representatives of affected employees long enough before the transfer to allow consultation.
• Liabilities transfer. Most employment liabilities pass to the buyer, which is why the buyer wants to see disputes, claims and pay terms before it commits.

GOV.UK’s guide to business transfers and TUPE and the Acas TUPE guidance set out the employer duties in plain language and are worth sharing with the seller’s HR lead.

What exactly is employee liability information?

ELI is a defined package. It must include, for each assigned employee:

The information must be given at least 28 days before the transfer, or as soon as reasonably practicable if special circumstances prevent that, and updated if anything changes. It can be given in writing or in a form that is readily accessible to the transferee, which a properly permissioned data room folder satisfies, provided you can show when it was made available.

If the transferor fails to provide ELI, the transferee can bring a tribunal claim. Compensation is assessed by the tribunal and, under the regulations, is generally subject to a minimum per employee affected unless the tribunal considers a lower amount just and equitable. Your employment solicitor can confirm how this applies to your deal.

How much employee data should early bidders see?

Very little, and none of it named. At the information memorandum and first-round stage, a bidder needs to understand the cost and shape of the workforce, not the people in it.

A sensible staging in four steps, which the figure above follows for a single employee’s record:

Stage one: aggregates. Total headcount, full-time equivalents, payroll cost, a breakdown by department or site, staff turnover, and the type of pension arrangement. This can go to every bidder who has signed the NDA.

Stage two: a coded staff list. One row per employee with an ID code instead of a name: role or grade, location, start date, contractual hours, salary band or salary, bonus or commission basis, notice period, pension contribution rate and any restrictive covenants. This suits shortlisted bidders in a second round.

Stage three: key people and contracts. The service agreements of directors and senior managers, named, plus the template contracts and policies for everyone else. This usually comes with exclusivity, once there is a single preferred buyer.

Stage four: named individual records and ELI. Named staff lists, disciplinary and grievance records, live claims, and anything involving health or other special category data. On a TUPE transfer this is where the ELI pack sits. Access is limited to named people on the buyer’s legal and HR team.

When does an anonymised staff list stop being anonymous?

When someone can work out who a row refers to. Under UK GDPR, data that can still be linked back to an individual, by you or by anyone reasonably likely to try, remains personal data. Replacing names with ID codes is usually pseudonymisation, not anonymisation, because the seller holds the key.

That has two practical consequences. First, an anonymised staff list is still within UK GDPR, so you still need a lawful basis (commonly legitimate interests, documented in a short assessment) and the room’s access controls still matter. Second, in small teams the list can identify people on its own:

• A business with one finance director, one head of sales and a single HR manager has unique job titles. Their rows are their names.
• A salary noticeably above the band for a role points to one person.
• Long service dates and part-time hours can identify someone the buyer has met at a site visit.

To reduce the risk, use bands rather than exact figures for salary and age, group rare roles into wider categories (“senior management” rather than three separate titles), and hold back the most identifying columns until exclusivity. Our guide to UK GDPR in a data room covers lawful basis and data minimisation in more depth.

Which employee data needs the tightest controls?

Special category data under UK GDPR, and criminal offence data. In an HR context that includes:

• health information: sickness absence reasons, occupational health reports, reasonable adjustments, maternity and disability records;
• trade union membership, which can appear in payroll deductions or collective bargaining records;
• ethnicity, religion or sexual orientation, sometimes held for equality monitoring;
• criminal records checks and any disclosed convictions.

Processing these requires a condition under Article 9 or 10 of UK GDPR and, often, a condition from the Data Protection Act 2018 as well. In most sales, the buyer does not need individual-level special category data to value the business. It needs aggregates (total sickness absence, number of open grievances involving disability) and an assurance that liabilities are disclosed. Give the aggregate, keep the detail out unless the buyer’s solicitor explains why a specific item is needed, and put anything that does go in behind view-only, watermarked access for named individuals.

When should the buyer see employee names?

Later than most buyers ask for them, but early enough to meet the law. A workable rule of thumb:

• Directors and key managers: named once exclusivity starts, because the buyer is often negotiating their future roles and service agreements directly with them.
• The wider workforce on a share sale: often only shortly before exchange, or not at all at individual level, depending on what the buyer’s diligence genuinely requires.
• The wider workforce on a TUPE transfer: no later than the ELI deadline of 28 days before the transfer, and in practice when the information and consultation process starts, since the buyer needs to say whether it plans any measures.

If the buyer is a competitor, consider a clean team: a small group of the buyer’s advisers who see named, commercially sensitive employee data and report only aggregated conclusions back to the buyer’s management. A data room with granular, user-level permissions makes this straightforward to set up. All of the specialist rooms on our UK shortlist support folder-level permissions, watermarking and an audit trail.

How should the employment folder be set up?

A checklist you can work through before the room opens:

• Confirm the deal structure and whether TUPE applies, with your solicitor, before deciding what goes in.
• Prepare an aggregate workforce summary for all NDA signatories.
• Build the pseudonymised staff list, with salary and age in bands where roles are rare, and keep the key mapping IDs to names outside the room.
• Upload template contracts, the staff handbook and key policies in a general employment folder.
• Create a restricted sub-folder for named records, ELI and special category data, with access for named individuals only.
• Turn on view-only and dynamic watermarking for the restricted sub-folder; disable downloads and printing.
• Record the lawful basis and a short legitimate interests assessment for sharing employee data in the deal file.
• Diarise the ELI deadline on a TUPE transfer and plan the upload with at least a week’s margin.
• Agree with the buyer’s solicitors how employee data will be returned or deleted if the deal falls through.

That last point matters more than it seems. The NDA usually covers return or destruction of confidential information, but personal data has its own obligations. When a deal fails, revoke access promptly, keep the audit trail, and ask for written confirmation that downloaded copies have been deleted.

What about collective consultation and the room?

Information and consultation under TUPE happens with employee representatives, not with the buyer, but the data room helps both sides coordinate. The transferor has to tell representatives whether the transferee plans any measures affecting the transferring staff, and the transferee has to give the transferor that information in time. Putting the buyer’s written measures letter into a shared folder, with its date, creates a clear record of when it arrived.

Very small employers have some flexibility: where there are no existing representatives and the business has fewer than ten employees, the employer may be able to inform and consult employees directly. Your solicitor can confirm whether that applies.

On employee data, the best data room is the one that shows less: aggregates for everyone, codes for most, names for a few, and a dated record of each step.