A matter of records - To provide an up-to-date snapshot of employers' current policies and procedures on the use of personal data in employer-employee relationships, IRS and the leading employment law firm DLA jointly surveyed a panel of employers on the eve of the first anniversary of the Data Protection Act 1998 (DPA) coming into force. We questioned them about the extent to which practice in their organisations complies with the DPA in several key areas, and about how far they make use of some of the "good-practice" procedures set out by the Data Protection Commissioner in the draft Code of Practice on the use of personal data in employer-employee relationships. The research reveals a considerable gap between the commissioner's view of the requirements of the law and the practice of employers. For example, the code says that, to comply with the DPA, employers should hold employee sickness absence records only if they have the "explicit consent of each employee or if one of the other conditions for processing sensitive data is satisfied". But less than onethird of our employers' panel have made any attempt to gain such consent. We conclude that there is a long way to go before all employers are meeting the standards that the commissioner believes are required both to comply with the law and to implement "good practice".