This blog post highlights my article ‘Employer Liability and the Employee Exemption’ published in the PDP Digest 2022 relating to the allocation of data protection liability in the employment context. In that article, I discuss how the Personal Data Protection Act 2012 (‘PDPA’) allocates liability between an employer and an employee, when the employee does something that constitutes a breach of a data protection obligation under the PDPA (for example, where the employee discloses the personal data of an individual without having obtained prior consent from that individual, in breach of the Consent Obligation under section 13 of the PDPA).