Tinsel and Trails: The Data-Protection Sweep UK Offices Should Run Before the Party

Every December, an unremarkable spreadsheet quietly becomes one of the more sensitive documents in a UK business. It carries home addresses for the card round, mobile numbers for the party group chat, dietary notes for the caterer and, in some offices, a column of Secret Santa wishlists. None of it feels like a compliance matter. All of it is personal data.

The risk is not theoretical. A misplaced printout, a shared link left open, a caterer's inbox that never gets cleared — each is a small, ordinary failure that becomes awkward the moment an employee asks what the company holds about them, or a laptop goes missing. The good news is that a modest amount of housekeeping in early December removes most of the exposure.

Why a card list counts as a data file

UK GDPR applies to any information relating to an identified or identifiable living person. A name paired with a home address qualifies. So does a mobile number, a plus-one's name, a note that someone is vegan, or a comment that a guest cannot eat gluten.

That last category deserves particular care. Dietary information can reveal or imply a health condition, which pushes it into the special category data regime under Article 9. The same applies to notes about allergies, pregnancy or religious observance. Special category data needs a stronger lawful basis than ordinary personal data, and it should not be sitting in the same unprotected sheet as the office seating plan.

There is a second, quieter issue: the list is rarely used only for the purpose it was collected for. An address gathered for card delivery gets reused for a survey; a phone number given for the party gets added to a WhatsApp group that outlives the event. Each of those is a new purpose, and each needs a reason.

Step one: write down what the business is actually collecting

Before deleting anything, list it. A single page is enough: what fields are held, where the file lives, who can open it and why it exists. Most SMEs will find three or four seasonal data sets — the card list, the party RSVP tracker, the dietary sheet and the Secret Santa draw.

This does not need to be a formal record of processing activities under Article 30, though if the business is already required to keep one, the seasonal entries should appear in it. The point is simply to make the invisible visible before anyone starts sharing files.

Step two: name the lawful basis, and do not blur it

For a staff Christmas card list, legitimate interests is usually the sensible footing — it is a low-risk, expected part of workplace life, and a short legitimate interests assessment is a reasonable safeguard. For dietary and health-related notes, the business should be relying on explicit consent or, depending on the context, obligations in the field of employment. Ask people directly, explain what the caterer will see, and do not bury the request inside a general party sign-up form.

One distinction is frequently missed: telling clients about a festive drinks reception is service messaging, but adding their addresses to a December newsletter is direct marketing, and PECR applies. Keep the two apart.

Step three: minimise, then separate

Data minimisation is the cheapest control available. Does the card list need a full postal address, or would a first line and postcode do? Does the party tracker need dates of birth for anything other than age verification at a venue with an over-18 policy?

Once the fields are trimmed, separate them. Dietary notes belong in a restricted file shared only with the catering contact, not in the master RSVP sheet circulated to the whole social committee. Access should be by named individual, not by a link that anyone in the company can forward.

Step four: check who else is holding it

The venue, the caterer, the card printer and any e-card platform are likely to be processors. That means a written contract with the required Article 28 terms, a clear instruction on what they may do with the data, and a check on where it is stored. A short email confirming deletion after the event is worth keeping.

Group chats are the other supplier in the room. A WhatsApp group set up to coordinate the party will retain names and numbers on personal devices indefinitely. It is better to use a company channel, or to agree explicitly that the group is deleted in the first week of January.

Step five: set a deletion date now

Retention is where seasonal data most often drifts. The sensible position is that party-related data — RSVPs, dietary notes, guest names, seating plans — is deleted within a short, defined window after the event. Financial records tied to the party, such as invoices and receipts, are kept separately under the normal accounting retention period.

Put the deletion in the calendar on the day the invitations go out, not in the vague hope that someone remembers in the new year. Health-related notes should go first.

Photographs, group chats and the morning after

Cameras are the least considered part of the evening. Staff should know in advance whether photographs will be taken and where they might appear. Publishing identifiable images of colleagues on the company website or social channels generally calls for consent, and a request to remove an image should be honoured without argument. Embarrassing footage from the dance floor is a reputational risk as much as a data one.

If something does go wrong

If a spreadsheet is lost, a phone is stolen or a file is shared too widely, the business needs to assess the likelihood and severity of harm. A lost list of names and dietary notes can meet the threshold for reporting to the ICO within 72 hours. Keep the assessment brief but written.

The pre-party checklist

• List every seasonal data set, its location and who can access it.
• Confirm the lawful basis for ordinary data, and record explicit consent for dietary or health notes.
• Strip unnecessary fields and move sensitive columns into a restricted file.
• Put processor terms in place with the caterer, venue and card supplier.
• Agree a deletion date and diarise it before invitations are sent.
• Brief staff on photography and set expectations for the group chat.
• Keep a one-page note of what to do if data is lost.

None of this takes more than an afternoon. It is also the difference between a party that is remembered for the right reasons and a January spent explaining why the office card list ended up in the wrong inbox.