Who Counts as Your Workforce for Identity Protection?

The instinct to scope an identity protection programme to payroll is understandable, but it is also flawed. In most UK organisations, the population holding corporate credentials extends far beyond the salaried workforce. Contractors, alumni, board members, and shared service accounts all carry credentials and personal data tied to your domain. For any security team evaluating employee data protection, defining the coverage boundary must come first.

This analysis argues that the exposed population is anyone with a corporate credential, mailbox, or profile linked to your organisation, not just those on the payroll. We begin by explaining why payroll is the wrong boundary, then examine what "workforce" means under current UK data protection guidance, noting that the ICO's employment records guidance is under review following the Data (Use and Access) Act. We then map the distinct risks across four categories: contractors and third-party staff, alumni and leavers, board members and non-executives, and shared inboxes and service accounts. Each category shifts both the risk profile and the privacy obligations attached. Finally, we provide a scoping framework to run before you buy anything. The lesson is clear: define the boundary first.

Why Payroll Is the Wrong Boundary for Identity Protection

Payroll answers a narrow question: who was employed on a given date. A credential inventory answers a different one: which mailboxes, SaaS profiles, VPN accounts and domain-bound addresses remain live. The two lists diverge, and the gap is where exposure accumulates.

Scope sets the risk boundary. A payroll-scoped programme leaves contractor logins, alumni mailboxes and shared service accounts outside monitoring, alerting and removal workflows, so the coverage gap is structural. Stale identities do not announce themselves, which is why continuous identity monitoring catches what one-time scans miss.

Scope also sets the privacy boundary. Data protection for employers attaches to personal data in circulation, not to employment status, so a payroll-only map can omit records you are already accountable for.

Teams default to payroll because it is the list that already exists with a defined owner and a regular update cycle. That is convenience, not an adequate definition of the workforce. Current UK guidance shows why the distinction matters.

What Workforce Means in Current UK Data Protection Guidance

The ICO's Employment Practices Code refers throughout to "workers" and "employees," a population that already exceeds a payroll extract. That Code has not been updated since the Data Protection Act 2018 became law and states it does not impose new legal obligations. Treat it as a compliance aid and a set of signposts, not the current statutory position.

The ICO's employment records guidance carries an under-review notice because of the Data (Use and Access) Act; check the live recruitment and selection page for its current status before relying on it. February 2025 commentary reported new guidance on processing employment records, but check the primary ICO source for its present substance rather than citing a summary. The Code's headings remain useful scope anchors: security (2.2), workers' access to their own information (2.8), outsourcing data processing (2.14) and monitoring electronic communications (3.2).

Be explicit about what is settled and what is not. Employees are data subjects with rights under UK GDPR; whether those rights survive termination in the same form is a point to confirm against current ICO guidance rather than assume. What is equally unsettled is whether contractors and alumni fall inside the same obligations. No primary source confirms identical treatment, so verify against current UK GDPR guidance rather than assume.

Contractors and Third-Party Staff: Credentials Without Employment Status

The broader definition of "worker" matters most where contractors hold credentials that behave exactly like employee accounts: a domain mailbox, an SSO profile, code repository access, facilities entry and often customer-facing systems. Their lifecycle follows contract dates and statement-of-work renewals rather than an HR joiner-mover-leaver process, which makes offboarding a recurring failure point when a supplier relationship ends quietly.

Where a supplier processes data on your behalf, the Code's heading on outsourcing data processing (2.14) is the relevant signpost, and the ICO data sharing code addresses sharing arrangements. Read the live text before quoting either in a policy. Under UK GDPR Article 4 and ICO controller/processor guidance, confirm the classification against those sources, a contractor processing personal data on your instructions may be a processor, which changes contract terms, security expectations and audit rights compared with an employee.

In practice, third-party staff from a managed service provider may share a single corporate identity, meaning your inventory shows one account standing in for several rotating individuals, a gap worth investigating during the scoping exercise.

Alumni and Leavers: Accounts That Outlive the Employment Relationship

Access rarely ends in one action: a mailbox may become a shared inbox, forwarding rules can persist for years, and cloud files may stay tied to a personal recovery address. Retention is the governing principle. Employee records, mailbox content and identity profiles should not be kept indefinitely, and the ICO's Employment Practices Code is the right starting signpost for setting and defending a deletion point. Alumni mailboxes also hold personal data about other people, so subject access and erasure requests from former staff, or from third parties named in old correspondence, become mixed-content problems. Whether UK GDPR access rights survive employment is a point to confirm against current ICO guidance; treat former staff as data subjects until that question is resolved. Identity monitoring that stops on the last working day creates a blind spot precisely when stale accounts are most likely to sit unread and unmanaged. Treat leaver identities as live data subjects and live risk, not archive. For the deletion mechanics behind that retention point, see our guide to deleting personal data from the internet.

Board Members and Non-Executives: Small Numbers, High Privilege

Non-executive directors often work from personal devices and personal email addresses that fall outside your domain controls entirely, so conventional device management never sees them. Board papers compound the problem. They routinely mix personal data about executives, employees and third parties in personal cloud drives and messaging apps, where no corporate retention rule reaches.

Where monitoring extends to accounts used for both company and personal business, the ICO Employment Practices Code heading on monitoring electronic communications (3.2) is the relevant signpost, though proportionality questions intensify sharply in that setting and the Code predates UK GDPR. Low headcount does not mean low impact. Depending on access provisioned, a compromised board credential could reach sensitive financial, legal or strategic materials, making these identities high-value targets regardless of headcount. As analysis of what breach numbers actually mean in 2026 suggests, scale is a poor proxy for severity.

Mapping these identities means recording who holds them, which devices and mailboxes reach them, and how access terminates when an appointment or term concludes. That record belongs in the credential inventory, not the board pack.

Shared Inboxes and Service Accounts: Identity Without a Person

Shared inboxes and service accounts invert the accountability model the identity perimeter assumes. Where a board member at least carries a name, these identities represent a function: there may be no data subject to notify, no individual to train, and no obvious owner to revoke access from when something goes wrong.

That has a forensic consequence. Without attribution controls, incident investigation is limited to identifying who held the password, a forensic constraint worth stating explicitly in your risk documentation. Access becomes approximate rather than evidential.

The irony is what these identities hold. Shared inboxes frequently carry the most sensitive correspondence an organisation keeps: HR casework, payroll queries, legal and regulatory mail, and whistleblowing channels. Poorly governed access here is not a minor hygiene issue.

Accountability still sits somewhere. Assign a named human owner for every shared identity and document who can reach it, even where the mailbox is treated as team property. Folding service accounts and shared mailboxes into joiner-mover-leaver processes and continuous identity monitoring prevents them becoming the accounts nobody owns and nobody removes.

How Privacy Obligations Shift With Each Worker Category

Once shared identities are folded into scope, the obligations do not stay neatly aligned with payroll either. Security of processing obligations under UK GDPR follow the data rather than the contract type, the Code's security heading (2.2) is a starting signpost, but verify the operative principle against the current ICO security guidance: a contractor mailbox holding employee sickness records needs the same safeguards as an internal one.

Transparency is where categories diverge most sharply. Employees receive a workplace privacy notice; whether alumni and non-executives are covered by your current privacy notices is worth verifying, standard templates often address only employees, workers and contractors.

Records of processing and lawful basis must also cover non-employee populations. Many organisations document employee processing carefully and leave everyone else implicit, which becomes awkward at audit or on complaint.

Contracts must match reality. Processor terms, controller-to-controller arrangements and data sharing terms need to reflect what each third-party population does with your data, including onward transfers. Employee identity exposure is now a UK compliance obligation, so document decisions rather than assumptions.

A Scoping Framework to Run Before You Buy Anything

Obligations differ by category; the method for pinning them down does not. Run five steps before procurement begins.

1. Define the boundary in writing. Every credential, mailbox, profile or domain-linked identity counts, whatever the employment status or contract type. Word it to survive turnover in the team that drafted it.

2. Build a credential inventory from your identity provider, email tenant and SaaS estate, then reconcile it against the HR or payroll list. Investigate every difference rather than tidying it away.

3. Classify each population (employee, contractor, third-party staff, alumnus, board member, shared or service account) and attach the retention rule, lawful basis and access rights that apply. Our guide to building an employee identity protection programme shows how those categories become programme scope.

4. Assign a named owner for every non-employee identity, shared mailboxes included, and set a review cadence that follows contract, appointment and alumni timelines rather than the payroll cycle.

5. Check the live ICO position on employment records, recruitment and the status of the Employment Practices Code before formalising scope in policy. Guidance is under review following the Data (Use and Access) Act.

If a platform is part of the plan, note that Ghost describes its own offering as continuous identity monitoring with automated removals for individuals and businesses. That is a vendor claim, and it belongs beside your scope definition, not inside your evidence.

Conclusion: Define the Boundary First

You now have a five-step framework for defining that boundary, so the final task is to commit it to paper before you commit budget. Write the scope definition first, because it determines both what a tool can cover and which privacy duties you accept once it is running in production.

Extend identity protection to anyone holding a domain credential, all the categories this piece has mapped belong inside the line you draw.

Keep the definition alive. Reconcile your identity inventory against payroll regularly, and treat every difference as a decision to record rather than an anomaly to clear. A gap you have documented and accepted is governance; a gap you have tidied away is exposure.

One final discipline: this research base contained no exposure or breach statistics, and you should not repeat figures you cannot source. A scoping argument is stronger without borrowed numbers.