On 28 May 2018 General Data Protection Regulations came in to force.

Companies are required to ensure the privacy of their employees and any personal data which they may process. This may include telephone numbers, e-mail addresses, name and contact details, bank details etc.
Freight Train’s fair processing notice can be viewed here: https://www.freight-train.co.uk/wp-content/uploads/Q-doc-24-privacy-fair-processing-notice-April-2018.pdf

What some companies may not realise is that from the same date any organisation or sole trader who processes personal data must register with the ICO and pay a data protection fee. For further information refer to the ICO website, where there is an online tool: https://ico.org.uk/for-organisations/data-protection-fee/