GDPR applies to any organisation processing personal data of EU and UK residents, regardless of sector. Oil and Gas organisations face a specific configuration of obligations shaped by the personal data they collect, the regulatory environment they operate in, and the systems they use to do it.
This page covers the GDPR obligations specific to Oil and Gas, the lawful bases that apply, and the implementation approach that survives supervisory authority scrutiny.
Regulatory context
Supervisory authority: National supervisory authorities, multiple jurisdictions
Key personal data categories: offshore workforce records including H&S and medical data, contractor data, geospatial data linked to personnel, environmental records
Special category data present: Yes — requires Article 9 lawful basis in addition to Article 6
Primary lawful bases: Legal Obligation (H&S, regulatory reporting), Contract (employment, contractor agreements), Legitimate Interests (security)
Medical examinations required for offshore fitness-to-work certification produce health data — special category under Article 9. The lawful basis is typically Article 9(2)(b) (employment law obligations) combined with the specific national health and safety legislation mandating the examination. The examining physician is a separate controller; their records are subject to professional confidentiality in addition to GDPR.
The hard part
Offshore operations involve workers from multiple nationalities working in multiple jurisdictions simultaneously. Determining which national data protection law governs each employee's records — and maintaining compliance with all applicable laws at once — is structurally complex and cannot be resolved by a single GDPR policy.
This is the implementation decision that most Oil and Gas GDPR programmes get wrong. It is also the issue most likely to appear in a supervisory authority audit or a data subject complaint.
Required controls
- Multi-jurisdiction employment data map with applicable law per location
- HSE data classified as special category with legal obligation basis documented
- Cross-border transfer mechanisms for non-EU workforce data
- Article 28 agreements with contractors and service companies processing personal data
- DSAR workflow spanning HR, HSE, procurement, and payroll systems
GDPR gap assessment framework for Oil and Gas
A gap assessment for a Oil and Gas organisation covers five areas:
1. Data inventory and ROPA
Map every system that holds personal data specific to Oil and Gas operations: offshore workforce records including H&S and medical data, contractor data, geospatial data linked to personnel, environmental records. Document the purpose, lawful basis, retention period, and third-party recipients for each. The ROPA must be current — a snapshot taken at implementation and not updated is not compliant.
2. Lawful basis audit
For each processing activity, confirm the lawful basis is documented and appropriate. Oil and Gas organisations frequently find that processing that was assumed to be covered by legitimate interests has not had a Legitimate Interests Assessment completed. Where special category data is present, Article 9 requires a separate documented basis.
3. Consent management
Where consent is the lawful basis, verify that consent records meet GDPR Article 7 requirements: freely given, specific, informed, unambiguous, and withdrawable. Legacy consent from before the current privacy notice version should be assessed for adequacy.
4. DSAR readiness
Test the DSAR workflow with a synthetic request. The test should cover: intake, identity verification, data discovery across all systems identified in the data inventory, response assembly, and delivery within the 30-day deadline. Most Oil and Gas DSAR gaps are discovered at the data discovery stage — systems that hold personal data but are not connected to the DSAR workflow.
5. Breach preparedness
Verify the incident log, the severity classification matrix, and the 72-hour notification workflow. The Oil and Gas-specific question is: which data categories, if breached, trigger notification to individuals (not just to the supervisory authority)? Notification to individuals is required where the breach is likely to result in high risk to their rights and freedoms.
Implementation priority order
For Oil and Gas organisations starting a GDPR programme:
- Data inventory — identify all systems holding personal data before configuring any controls
- Lawful basis documentation — stop processing for which there is no documented basis
- DSAR workflow — rights requests can arrive at any time; the workflow must be operational before launch
- Consent remediation — address legacy consent before running any marketing to the affected population
- ROPA — live, connected to source systems, reviewed quarterly
- Breach procedure — tested annually; DPO and legal team both trained on the 72-hour obligation