Under the UK GDPR and the Data Protection Act 2018, any information that can identify an individual is personal data. Time and attendance records fall into two distinct categories, and the distinction matters significantly for your compliance obligations.
