Creating your candidate privacy notice

What is a privacy notice?

If you collect applications online, you need a privacy notice for job applicants. Whether you're launching a new applicant tracking system (ATS), refreshing your careers site or reviewing your recruitment process, it's an essential piece of the puzzle, and it's simpler than it sounds.

A privacy notice is a plain-English statement that tells candidates what personal information you collect, why you collect it, who you share it with and how long you keep it. Data protection laws, such as UK GDPR and the Data Protection Act 2018 in the UK, require you to give people this information at the point you collect their data.

Most careers sites ask candidates to read and accept the privacy notice when they register or apply, and make it available in the site footer so it can be found at any time.

Because your organisation decides what candidate data is collected and how it's used, you are the "data controller". That means the privacy notice needs to come from you, and it's your responsibility to make sure your recruitment process, and the way you use any recruitment technology, complies with the laws that apply to you and your candidates.

What your privacy notice should cover

Every organisation's notice will be different, but a good candidate privacy notice usually explains:

• Who you are: your organisation's name and contact details, plus your Data Protection Officer if you have one.
• What data you collect: for example, contact details, employment history, qualifications, referee details, equality and diversity information and, where relevant, details needed for criminal record checks.
• Why you collect it: to manage applications, assess suitability, carry out pre-employment checks and monitor equal opportunities.
• Your lawful basis: the legal reason you rely on to process the data, such as consent, taking steps towards a contract or legitimate interests.
• Who you share it with: for example, third parties that carry out reference, qualification or background checks, or skills assessments. Your ATS provider should also be named as the company that hosts your careers site and candidate data.
• Where it's stored: where your candidate data is held. Ask your ATS provider if you're not sure, and check whether storing data outside a candidate's own country counts as an international transfer under their local laws.
• How long you keep it: your retention periods for unsuccessful and successful candidates.
• Candidates' rights: including the right to access, correct or delete their data, and to complain to the relevant data protection regulator (in the UK, the Information Commissioner's Office).

If your organisation already has a privacy notice for job applicants, check it reflects the systems you use today. Your data protection lead or legal team should always sign off the final version.

Recruiting in more than one country? Check the local rules

If you plan to recruit outside the UK, your privacy notice and recruitment process need to work for every country you recruit in, not just the UK. Employment and data protection laws vary widely, and something that's standard practice in one country may not be allowed in another. For example:

• Equal opportunities questions: some countries restrict or prohibit asking candidates about characteristics such as ethnicity, religion, sexual orientation or disability, even for monitoring purposes.
• Data processing rules: the lawful basis you can rely on, the information you must give candidates, and how long you can keep their data may all differ.
• International transfers: some countries have rules about personal data being stored or processed outside their borders.
• Background and criminal record checks: what you can check, and when in the process, varies from country to country.
• Language: you may need to provide your privacy notice and application process in the local language.

A good ATS will let you tailor application forms, questions and processes for different locations, but technology alone can't make you compliant. It's your organisation's responsibility to consider the impact on candidates in each country you recruit in, and to make sure your recruitment process, the questions you ask and your use of any system comply with all applicable laws. We strongly recommend taking local legal advice before you start recruiting in a new country.

Adding your privacy notice to your careers site

Most applicant tracking systems give you two ways to display your privacy notice:

1. A link to your own website. If your privacy notice is already published online, your careers site can link straight to it. Any updates you make on your website then apply automatically.
2. The wording itself. If you'd prefer the notice to sit on your careers site, the full text can be added there instead.

Whichever option you choose, check how it looks on a test site before it goes live. Make sure candidates can find it easily, that it opens correctly, and that they're asked to accept it at the right point in the application process.

If you're choosing a new ATS, ask how privacy notices are added and updated. You'll want a straightforward process for making changes whenever your notice is reviewed.

Starting from scratch

If you don't have a privacy notice yet, you don't need to start with a blank page. Many ATS providers can share template wording, and the ICO publishes guidance on what to include.

A common approach to retention, for example, is to securely destroy unsuccessful candidates' data 12 months after the decision on their application. This gives candidates time to challenge a recruitment decision if they need to. For successful candidates, information needed for employment is kept throughout their employment, while other supporting documents are destroyed after a set period once they've started.

Treat any template as a guide rather than a finished notice. Templates are often written with one country in mind, so they'll need adapting if you recruit elsewhere. Tailor the wording to your organisation, your checks and your retention policy, and have it reviewed by your data protection lead before it goes live.

Keeping your promises: what to look for in your ATS

Your privacy notice makes promises to candidates about how their data is handled. Your applicant tracking system should make those promises easy to keep. Whether you already have an ATS or you're comparing options, look for:

• Self-service control for candidates. Candidates should be able to log in to review and update their details, or delete their account.
• Automated data retention. The system should remove data automatically in line with your retention periods, and ideally email inactive candidates beforehand so they can choose to keep their account.
• Flexible retention rules. Some organisations need different rules for different types of application or location.
• Anonymised archiving. When data is removed, anonymising it rather than deleting everything lets you keep reporting on your recruitment history without holding personal data.
• Configurable application forms. The ability to tailor questions by role or location, so you only ask what's lawful and necessary.
• Clear data storage. A provider that can tell you exactly where your candidate data is held.

Whatever system you use, make sure the retention settings match what your privacy notice says.

Your privacy notice checklist

• Check whether your organisation already has a privacy notice for job applicants
• Update it (or create one) to reflect the systems and third parties you use
• List every country you plan to recruit in and check the local employment and data protection laws for each
• Review your application forms and equal opportunities questions to make sure they're lawful in every location
• Confirm where your candidate data is stored
• Check your retention periods match your ATS settings
• Get sign-off from your data protection lead or legal adviser
• Add the notice to your careers site and test it before going live
• Set a date to review it, at least once a year

Further reading

The Information Commissioner's Office (ICO) website has detailed guidance on privacy notices and on your obligations as an employer when handling candidate data. If you recruit outside the UK, check the guidance from the data protection regulator in each country.

This article is general guidance and isn't legal advice. Your organisation is responsible for making sure your recruitment process, privacy notice and use of any recruitment technology comply with all laws that apply in every country you recruit in. Please speak to your data protection lead or legal adviser about your obligations.