ILO Code of Practice on the Protection of Workers' Personal Data (1997)

International

v1997 (adopted by the Meeting of Experts on Workers' Privacy, Geneva, 1 to 7 October 1996; distribution approved by the Governing Body, 267th Session, November 1996)

9 domains

66 controls

The ILO's guidance on workers' personal data: lawful, job-related processing, notice before monitoring with minimum intrusion, secret monitoring only on reasonable suspicion, continuous monitoring only for safety or property, no polygraphs, limits on sensitive data, security, retention, disclosure, workers' access and correction rights, and consultation of worker representatives before monitoring. Guidance, not law.

Verified

ILO Code of Practice on the Protection of Workers' Personal Data (1997) is a compliance framework from International with 9 domains and 66 controls that map to 1 other frameworks. The largest domains are Section 6: Collection of personal data – ILO Code of Practice on the Protection of Workers' Personal Data (1997) (16 controls), Section 11: Individual rights – ILO Code of Practice on the Protection of Workers' Personal Data (1997) (13 controls), Section 5: General principles – ILO Code of Practice on the Protection of Workers' Personal Data (1997) (13 controls). Every control below carries what it requires and what an assessor expects to see.

Maintained by Gerard Blokdyk

Framework summaries on this platform are AI-assisted interpretations for educational and compliance planning purposes. They do not reproduce or replace the official standards. Refer to the authoritative source for the definitive text. Framework names and trademarks belong to their respective organisations.

Framework Domains (9)

Section 10: Communication of personal data – ILO Code of Practice on the Protection of Workers' Personal Data (1997)

11 controls

Controls in the Section 10: Communication of personal data – ILO Code of Practice on the Protection of Workers' Personal Data (1997) domain of ILO Code of Practice on the Protection of Workers' Personal Data (1997) — 11 controls
Code	Title	Description
ilo-code-of-practice-on-the-protection-of-workers-personal-data-1997::10.1	10.1 No disclosure to third parties without explicit consent, save four cases	Pass data to outsiders only with the worker's express agreement, unless this is needed to avert a grave and immediate da...
ilo-code-of-practice-on-the-protection-of-workers-personal-data-1997::10.10	10.10 Disclosure to worker representatives limited and lawful	Communicate personal data to workers' representatives only in line with national law or a collective agreement and natio...
ilo-code-of-practice-on-the-protection-of-workers-personal-data-1997::10.11	10.11 Monitor internal data flows and compliance	Employers should adopt procedures to track how data move inside the organization and to make sure processing complies wi...
ilo-code-of-practice-on-the-protection-of-workers-personal-data-1997::10.2	10.2 No commercial or marketing disclosure without informed explicit consent	Never hand a worker's data over for selling or advertising unless the worker has agreed expressly, knowing what is invol...
ilo-code-of-practice-on-the-protection-of-workers-personal-data-1997::10.3	10.3 Group companies and government agencies treated as third parties	Treat transfers among companies of one corporate group, and among separate public agencies, as disclosures to outsiders.
ilo-code-of-practice-on-the-protection-of-workers-personal-data-1997::10.4	10.4 Instruct recipients on purpose and seek confirmation	Tell those receiving a worker's data that they may use it only for the purpose for which it was provided and ask them to...
ilo-code-of-practice-on-the-protection-of-workers-personal-data-1997::10.5	10.5 Internal flows limited to those notified	Limit internal communications of personal data to those the worker has been expressly told about.
ilo-code-of-practice-on-the-protection-of-workers-personal-data-1997::10.6	10.6 Need-to-know internal access	Make personal data available internally only to specifically authorized users, each with access limited to what their ta...
ilo-code-of-practice-on-the-protection-of-workers-personal-data-1997::10.7	10.7 No interconnection of files without compliance	Linking files that hold workers' data should be barred unless strict compliance with the internal communication rules is...
ilo-code-of-practice-on-the-protection-of-workers-personal-data-1997::10.8	10.8 Only relevant conclusions of medical examinations to the employer	Following a medical check, the employer should be given only the findings that matter for the job decision in hand.
ilo-code-of-practice-on-the-protection-of-workers-personal-data-1997::10.9	10.9 Conclusions without medical information	Those conclusions should contain no medical information; they may state fitness for the proposed assignment or the kinds...

Section 11: Individual rights – ILO Code of Practice on the Protection of Workers' Personal Data (1997)

13 controls

Controls in the Section 11: Individual rights – ILO Code of Practice on the Protection of Workers' Personal Data (1997) domain of ILO Code of Practice on the Protection of Workers' Personal Data (1997) — 13 controls
Code	Title	Description
ilo-code-of-practice-on-the-protection-of-workers-personal-data-1997::11.1	11.1 Regular notification of data held	Workers should be told regularly what personal data are held about them and how they are processed.
ilo-code-of-practice-on-the-protection-of-workers-personal-data-1997::11.10	11.10 Tell earlier recipients of corrections	After deleting or correcting data, the employer should inform everyone who received the inaccurate or incomplete data, u...
ilo-code-of-practice-on-the-protection-of-workers-personal-data-1997::11.11	11.11 Worker statement where correction is refused	If the employer refuses a correction, the worker may add a statement giving the reasons for disagreeing; later uses of t...
ilo-code-of-practice-on-the-protection-of-workers-personal-data-1997::11.12	11.12 Worker statement on judgemental data	Where judgemental data cannot be deleted or corrected, the worker may add their own view, which should travel with the d...
ilo-code-of-practice-on-the-protection-of-workers-personal-data-1997::11.13	11.13 Avenue of redress and a simple complaints process	Any legislation, agreement, work rule or policy based on the code should give workers a route to contest whether the emp...
ilo-code-of-practice-on-the-protection-of-workers-personal-data-1997::11.2	11.2 Access to all personal data	Workers should be able to see every item of data about them, in computer systems, paper files or any other record.
ilo-code-of-practice-on-the-protection-of-workers-personal-data-1997::11.3	11.3 Examine and copy records	The right to know includes examining and getting a copy of any record containing the worker's personal data.
ilo-code-of-practice-on-the-protection-of-workers-personal-data-1997::11.4	11.4 Access during working hours or by other arrangement	Workers should be able to access their data during normal working hours, or by other arrangements that balance worker an...
ilo-code-of-practice-on-the-protection-of-workers-personal-data-1997::11.5	11.5 Assistance by a representative or co-worker	Workers should be able to name a workers' representative or co-worker to help them exercise their right of access.
ilo-code-of-practice-on-the-protection-of-workers-personal-data-1997::11.6	11.6 Medical data through a chosen professional	Workers should be able to see their health records via a doctor or other health professional they pick.
ilo-code-of-practice-on-the-protection-of-workers-personal-data-1997::11.7	11.7 No charge for access or copies	Employers should not charge workers for access to, or copies of, their own records.
ilo-code-of-practice-on-the-protection-of-workers-personal-data-1997::11.8	11.8 Deferral of access in security investigations only	In a security investigation the employer may deny access to the worker's data until the investigation closes, and only a...
ilo-code-of-practice-on-the-protection-of-workers-personal-data-1997::11.9	11.9 Deletion or rectification of wrong or improper data	Workers should be able to require deletion or correction of data that are incorrect, incomplete or processed in breach o...

Section 12: Collective rights – ILO Code of Practice on the Protection of Workers' Personal Data (1997)

4 controls

Controls in the Section 12: Collective rights – ILO Code of Practice on the Protection of Workers' Personal Data (1997) domain of ILO Code of Practice on the Protection of Workers' Personal Data (1997) — 4 controls
Code	Title	Description
ilo-code-of-practice-on-the-protection-of-workers-personal-data-1997::12.1	12.1 Negotiations bound by the individual's right to know and decide	Any bargaining over the handling of workers' data should respect, as a binding limit, the principles giving each worker...
ilo-code-of-practice-on-the-protection-of-workers-personal-data-1997::12.2(a)	12.2(a) Inform and consult representatives on automated systems	Where workers' representatives exist, and in line with national law and practice, inform and consult them on introducing...
ilo-code-of-practice-on-the-protection-of-workers-personal-data-1997::12.2(b)	12.2(b) Inform and consult representatives before introducing electronic monitoring	Where workers' representatives exist, and in line with national law and practice, inform and consult them before electro...
ilo-code-of-practice-on-the-protection-of-workers-personal-data-1997::12.2(c)	12.2(c) Inform and consult representatives on questionnaires and tests	Where workers' representatives exist, inform and consult them on the purpose, content and administration and interpretat...

Section 13: Employment agencies – ILO Code of Practice on the Protection of Workers' Personal Data (1997)

1 controls

Controls in the Section 13: Employment agencies – ILO Code of Practice on the Protection of Workers' Personal Data (1997) domain of ILO Code of Practice on the Protection of Workers' Personal Data (1997) — 1 controls
Code	Title	Description
ilo-code-of-practice-on-the-protection-of-workers-personal-data-1997::13.1	13.1 Employment agencies required to follow the code	Where employers recruit through employment agencies, they should require the agency to handle personal data in line with...

Section 5: General principles – ILO Code of Practice on the Protection of Workers' Personal Data (1997)

13 controls

Controls in the Section 5: General principles – ILO Code of Practice on the Protection of Workers' Personal Data (1997) domain of ILO Code of Practice on the Protection of Workers' Personal Data (1997) — 13 controls
Code	Title	Description
ilo-code-of-practice-on-the-protection-of-workers-personal-data-1997::5.1	5.1 Lawful, fair and employment-related processing	Handle workers' data lawfully and fairly, and solely for reasons that bear directly on the person's job.
ilo-code-of-practice-on-the-protection-of-workers-personal-data-1997::5.10	5.10 No unlawful discrimination through processing	Processing personal data should not result in unlawful discrimination in employment or occupation.
ilo-code-of-practice-on-the-protection-of-workers-personal-data-1997::5.11	5.11 Cooperate on protection and privacy policy	Employers, workers and their representatives should work together to protect personal data and to develop workers' priva...
ilo-code-of-practice-on-the-protection-of-workers-personal-data-1997::5.12	5.12 Confidentiality for everyone with access	Everyone who can see personal data (the employer, representatives of the workforce, recruitment agencies, fellow staff)...
ilo-code-of-practice-on-the-protection-of-workers-personal-data-1997::5.13	5.13 Privacy rights cannot be waived	Workers cannot give up their privacy rights; a waiver in a contract or form should not be relied on.
ilo-code-of-practice-on-the-protection-of-workers-personal-data-1997::5.2	5.2 Use only for the original purpose	As a rule, confine the use of data to the aims that justified gathering them in the first place.
ilo-code-of-practice-on-the-protection-of-workers-personal-data-1997::5.3	5.3 Compatible further use and avoiding misreading	Where data are to be processed for a new purpose, the employer should make sure the new use is compatible with the origi...
ilo-code-of-practice-on-the-protection-of-workers-personal-data-1997::5.4	5.4 System security data not used to control behaviour	Data collected through technical or organizational measures that keep automated information systems secure and working p...
ilo-code-of-practice-on-the-protection-of-workers-personal-data-1997::5.5	5.5 No decisions solely by automated processing	Decisions about a worker should not rest only on automated processing of that worker's data.
ilo-code-of-practice-on-the-protection-of-workers-personal-data-1997::5.6	5.6 Monitoring data not the sole basis of performance evaluation	Output from electronic surveillance should never be the sole input when a worker's performance is judged.
ilo-code-of-practice-on-the-protection-of-workers-personal-data-1997::5.7	5.7 Regular review to minimize data and improve privacy	Employers should review their data processing regularly to cut the kinds and volume of personal data collected as far as...
ilo-code-of-practice-on-the-protection-of-workers-personal-data-1997::5.8	5.8 Keep workers and representatives informed	Workers and their representatives should be told about every data collection process, the rules governing it and their r...
ilo-code-of-practice-on-the-protection-of-workers-personal-data-1997::5.9	5.9 Train those who process personal data	People who process personal data should receive regular training so they understand the collection process and their par...

Section 6: Collection of personal data – ILO Code of Practice on the Protection of Workers' Personal Data (1997)

16 controls

Controls in the Section 6: Collection of personal data – ILO Code of Practice on the Protection of Workers' Personal Data (1997) domain of ILO Code of Practice on the Protection of Workers' Personal Data (1997) — 16 controls
Code	Title	Description
ilo-code-of-practice-on-the-protection-of-workers-personal-data-1997::6.1	6.1 Collect from the worker	As a rule, obtain all personal data from the worker concerned.
ilo-code-of-practice-on-the-protection-of-workers-personal-data-1997::6.10	6.10 No polygraphs or truth-verification testing	Polygraphs, truth-verification equipment and similar testing procedures should not be used.
ilo-code-of-practice-on-the-protection-of-workers-personal-data-1997::6.11	6.11 Personality tests consistent with the code, with a right to object	Personality tests and similar procedures should conform to the code, and the worker may object to them.
ilo-code-of-practice-on-the-protection-of-workers-personal-data-1997::6.12	6.12 Genetic screening prohibited or strictly limited	Genetic screening should be banned or confined to cases national law expressly authorizes.
ilo-code-of-practice-on-the-protection-of-workers-personal-data-1997::6.13	6.13 Drug testing only in line with law and standards	Testing for drugs should follow national legislation and custom or recognised international norms, such as the ILO code...
ilo-code-of-practice-on-the-protection-of-workers-personal-data-1997::6.14(1)	6.14(1) Tell workers in advance about monitoring and minimize intrusion	Before any monitoring starts, workers should learn why it is done, when it runs, how it works (methods and techniques) a...
ilo-code-of-practice-on-the-protection-of-workers-personal-data-1997::6.14(2)	6.14(2) Secret monitoring only where lawful or on reasonable suspicion	Covert monitoring should be allowed only where national law permits it or where there are reasonable grounds to suspect...
ilo-code-of-practice-on-the-protection-of-workers-personal-data-1997::6.14(3)	6.14(3) Continuous monitoring only for health and safety or protection of property	Monitoring that never stops should be allowed only where it is needed for workplace health and safety or to protect prop...
ilo-code-of-practice-on-the-protection-of-workers-personal-data-1997::6.2	6.2 Third-party collection only with notice and explicit consent	Where data must come from other sources, the worker should first be told and agree expressly, and the employer should st...
ilo-code-of-practice-on-the-protection-of-workers-personal-data-1997::6.3	6.3 Plain, specific authorization statements	Where a worker is asked to sign an authorization for the employer or others to collect or disclose information, it shoul...
ilo-code-of-practice-on-the-protection-of-workers-personal-data-1997::6.4	6.4 Investigators clear on purpose and honest	Where the employer has the worker's consent to collect data, it should make sure anyone it engages to collect data or in...
ilo-code-of-practice-on-the-protection-of-workers-personal-data-1997::6.5	6.5 No data on sex life, beliefs or convictions, save exceptionally	Employers should not collect data on a worker's sex life, political, religious or other beliefs, or criminal convictions...
ilo-code-of-practice-on-the-protection-of-workers-personal-data-1997::6.6	6.6 No data on union membership or activities unless required	Employers should not collect data on a worker's membership of a workers' organization or trade union activities unless t...
ilo-code-of-practice-on-the-protection-of-workers-personal-data-1997::6.7	6.7 Medical data only as needed and lawful	Medical data should be collected only in line with national law, medical confidentiality and occupational health and saf...
ilo-code-of-practice-on-the-protection-of-workers-personal-data-1997::6.8	6.8 No sanction for inaccurate answers to improper questions	Where a worker answers wrongly or only in part a question that the code's principles on relevance, discrimination and se...
ilo-code-of-practice-on-the-protection-of-workers-personal-data-1997::6.9	6.9 Do not process irrelevant data supplied by mistake	Information a worker hands over by misunderstanding what was asked, and which exceeds or misses the point of the request...

Section 7: Security of personal data – ILO Code of Practice on the Protection of Workers' Personal Data (1997)

1 controls

Controls in the Section 7: Security of personal data – ILO Code of Practice on the Protection of Workers' Personal Data (1997) domain of ILO Code of Practice on the Protection of Workers' Personal Data (1997) — 1 controls
Code	Title	Description
ilo-code-of-practice-on-the-protection-of-workers-personal-data-1997::7.1	7.1 Reasonable security safeguards	Employers should protect personal data with security safeguards reasonable in the circumstances against loss and unautho...

Section 8: Storage of personal data – ILO Code of Practice on the Protection of Workers' Personal Data (1997)

6 controls

Controls in the Section 8: Storage of personal data – ILO Code of Practice on the Protection of Workers' Personal Data (1997) domain of ILO Code of Practice on the Protection of Workers' Personal Data (1997) — 6 controls
Code	Title	Description
ilo-code-of-practice-on-the-protection-of-workers-personal-data-1997::8.1	8.1 Store only data collected in line with the code	Only data gathered consistently with the code's collection principles should be stored.
ilo-code-of-practice-on-the-protection-of-workers-personal-data-1997::8.2	8.2 Medical data kept separately by bound staff	Records covered by medical confidentiality belong only with staff who are themselves under medical secrecy rules and kep...
ilo-code-of-practice-on-the-protection-of-workers-personal-data-1997::8.3	8.3 General information on data held and processing	Employers should publish, and review regularly, an overview of the categories of data kept about each worker and what is...
ilo-code-of-practice-on-the-protection-of-workers-personal-data-1997::8.4	8.4 Periodic accuracy checks	Employers should periodically check that stored personal data are accurate, current and complete.
ilo-code-of-practice-on-the-protection-of-workers-personal-data-1997::8.5	8.5 Retain only as long as the purpose justifies	Keep personal data only as long as the specific purposes of collection justify, unless a worker asks to stay on a candid...
ilo-code-of-practice-on-the-protection-of-workers-personal-data-1997::8.6	8.6 Understandable, non-discriminatory coding	Store and code personal data so that the worker can understand them and so that no characteristic is attributed to the w...

Section 9: Use of personal data – ILO Code of Practice on the Protection of Workers' Personal Data (1997)

1 controls

Controls in the Section 9: Use of personal data – ILO Code of Practice on the Protection of Workers' Personal Data (1997) domain of ILO Code of Practice on the Protection of Workers' Personal Data (1997) — 1 controls
Code	Title	Description
ilo-code-of-practice-on-the-protection-of-workers-personal-data-1997::9.1	9.1 Use consistent with collection, communication and storage principles	Use personal data consistently with the code's principles on collection, communication and storage.

Maps to 1 other framework

66 total controls

GDPR

23 source controls mapped|17 target controls covered

35%

Compare ILO Code of Practice on the Protection of Workers' Personal Data (1997) with GDPR

Coverage is not the same as your position

This page shows what ILO Code of Practice on the Protection of Workers' Personal Data (1997) overlaps with in general. Where your organisation actually stands, against the standard you are going for and the certifications you already hold, is a different question. Same graph and the same recorded refutations, scoped to you rather than to a pair.

The Compliance Position Diagnostic, $5,000 fixed, ten business days

What is ILO Code of Practice on the Protection of Workers' Personal Data (1997) and who does it apply to?

ILO Code of Practice on the Protection of Workers' Personal Data (1997) is a compliance framework from International with 9 domains and 66 controls. The ILO's guidance on workers' personal data: lawful, job-related processing, notice before monitoring with minimum intrusion, secret monitoring only on reasonable suspicion, continuous monitoring only for safety or property, no polygraphs, limits on sensitive data, security, retention, disclosure, workers' access and correction rights, and consultation of worker representatives before monitoring. Guidance, not law. It is used by organisations to establish and maintain compliance with industry standards and regulatory requirements.

What does ILO Code of Practice on the Protection of Workers' Personal Data (1997) actually require?

ILO Code of Practice on the Protection of Workers' Personal Data (1997) has 66 controls organised across 9 domains. The largest domains are Section 6: Collection of personal data – ILO Code of Practice on the Protection of Workers' Personal Data (1997) (16 controls), Section 11: Individual rights – ILO Code of Practice on the Protection of Workers' Personal Data (1997) (13 controls), Section 5: General principles – ILO Code of Practice on the Protection of Workers' Personal Data (1997) (13 controls). Each control defines specific requirements that organisations must implement to achieve compliance.

If I already comply with another framework, how much of ILO Code of Practice on the Protection of Workers' Personal Data (1997) do I already cover?

ILO Code of Practice on the Protection of Workers' Personal Data (1997) maps to 1 other compliance frameworks. The top mapping partners are GDPR (35% coverage). Use our comparison tool to explore control-level mappings between frameworks.

How do I implement ILO Code of Practice on the Protection of Workers' Personal Data (1997)?

Start your ILO Code of Practice on the Protection of Workers' Personal Data (1997) compliance journey by running a self-assessment on our platform to identify your current compliance posture. Our AI advisory can answer specific questions about ILO Code of Practice on the Protection of Workers' Personal Data (1997) requirements, and cross-framework mapping helps you leverage existing controls from other frameworks you may already comply with. Create a free account to access all 66 controls and track your progress.

Start Your Compliance Journey

Create a free account to run self-assessments, get AI advisory, and track your compliance progress across 820 frameworks.

Get Started Free →

Free forever — no credit card required