Job applicant privacy notice

An applicant gives an employer a CV, a form, references, right to work documents and sometimes a video interview or a psychometric test, and the employer obtains more from referees, agencies, professional networks and checking services; the applicant is entitled to a notice before any of it, which the employee privacy notice does not provide because the applicant is not yet an employee. The applicant notice has to describe the process, the sources, the checks, any automated screening, the equality monitoring and the adjustments, and what happens to the data of the people who do not get the job. Drafting for the business, I deliver the privacy notice, the cookie notice and guidance on consent in five working days for a fixed £595.

Who this is for

Employers in England and Wales that recruit, whether through their own careers page, agencies, job boards or applicant tracking systems, and employers whose applicants currently see no notice at all.

What matters in a job applicant privacy notice

Why applicants need a notice before they apply

Article 13 of the UK GDPR obliges the business as controller to tell applicants at the point of collection what it will do with their data, which means a notice linked from the job advertisement, the application form and the careers page and given to applicants who apply by email or through an agency, rather than one issued on appointment; Article 14 requires the employer to tell applicants whose data it obtained from elsewhere (an agency, a job board, a professional network, a referee) within a month or at first contact where it came from, and the notice should cover both routes.

The data a recruitment process collects and from where

The notice should list the data (contact details, the CV and application, qualifications, employment history, interview notes and assessments, right to work evidence, references, test results, video interview recordings, correspondence) and the sources (the applicant, agencies, job boards, professional networks, referees, checking services, public sources), and the lawful basis for each: the steps at the applicant's request before a contract under Article 6(1)(b), legitimate interests under Article 6(1)(f) for assessing suitability and keeping records of the decision, and legal obligation under Article 6(1)(c) for right to work checks under the Immigration, Asylum and Nationality Act 2006; consent is reserved for the optional (the talent pool, equality monitoring).

References, checks and the data obtained from others

The notice should explain when references are taken (after a conditional offer, with the applicant's agreement), what referees are asked, the checks the employer carries out for the role (identity, qualifications, right to work, credit checks where the role justifies them, disclosure and barring checks under the Safeguarding Vulnerable Groups Act 2006 regime where the role is eligible, professional registration, social media checks where the employer does them, which the Information Commissioner expects to be proportionate and disclosed), the checking services used as processors or controllers, and the applicant's right to see what the employer holds under Article 15 (with confidential references subject to the exemption in the Data Protection Act 2018).

Automated screening, assessments and the tools recruiters use

Where the employer or its applicant tracking system screens applications automatically (keyword matching, scoring, ranking, video interview analysis, psychometric tests scored by software), the notice must under Article 13(2)(f) of the UK GDPR give meaningful information about the logic and its consequences, and where a rejection is decided solely by automated means Article 22 as amended by the Data (Use and Access) Act 2025 requires the safeguards (information, representations, human intervention, the right to contest); the notice should say which tools the employer uses, whether they decide or recommend, and how an applicant asks for a human review, and the employer should know what its applicant tracking system does, because most employers do not.

Equality monitoring, adjustments and the data that is special category

Equality monitoring data (ethnicity, disability, sexual orientation, religion, gender) is special category data under Article 9 of the UK GDPR collected under the equality of opportunity condition in Schedule 1 to the Data Protection Act 2018, voluntarily, separated from the application and never seen by those making the decision, and the notice should say so; adjustments an applicant requests for the process (health or disability data) are processed under the employment law condition with the appropriate policy document, with the employer's questions before offer limited as section 60 of the Equality Act 2010 permits; criminal records information is processed under Article 10 and the conditions the Act sets, only where the role justifies it and at the stage the Rehabilitation of Offenders Act 1974 and the Disclosure and Barring Service's rules allow.

Retention for unsuccessful applicants and the talent pool

The notice should state that unsuccessful applicants' data is kept for a stated period after the decision (long enough to respond to a challenge within the discrimination claim window and to show the reasons for the decision, which the employer's legitimate interest justifies) and then deleted, that the successful applicant's data moves to the personnel file under the employee privacy notice, that applicants may be asked to join a talent pool for future roles on consent they can withdraw, that the applicant tracking system is a processor (with international transfers under Article 46 where it is hosted abroad), and the individual's rights over their data (access, rectification, erasure, restriction, portability, objection), the process and the one-month limit, and the complaint to the Information Commissioner's Office; the notice should give the registration number the business holds with the Information Commissioner's Office under the Data Protection (Charges and Information) Regulations 2018.

What it costs

Website privacy and cookies pack, £595. Privacy notice, cookie notice and consent guidance. Five working days.

DPA and privacy terms, £795. Data processing agreement plus privacy notice. Five working days.

Buying online forms the engagement on payment. The scope is what the data protection agreements and privacy terms page describes, you accept the Terms of Service at checkout, and I email you within four working hours to get started. If you would rather ask something first, email me.

What you get

• A data processing agreement that meets the statutory requirements and can be used as a schedule to your main contract
• A privacy notice written for people to read rather than to be scrolled past
• Clear allocation of controller and processor roles, which is where most confusion starts
• International transfer provisions where you use overseas suppliers
• Sub-processor and security provisions proportionate to what you do
• A note on the operational steps the documents assume you are taking

What is not included

• Full compliance audits and data mapping exercises
• ICO registration, which you do yourself
• Breach response and regulatory correspondence
• Cyber security certification such as Cyber Essentials
• Advice on data protection law outside the UK and EU

Questions I am often asked

Our employee privacy notice covers applicants. Does it?

Not usually, because applicants are not employees and the data and purposes differ. The applicant notice is linked from the advertisement and the form, before the applicant gives anything.

Can we check applicants' social media?

Proportionately, for roles where it is relevant, and disclosed in the notice, as the regulator expects. A check the applicant was not told about is a breach.

How long can we keep unsuccessful applicants' data?

For a stated period after the decision, long enough to respond to a challenge in the discrimination claim window and to show the reasons, then deleted. The notice states the period; the talent pool is on consent the applicant can withdraw.

Related guidance and services

• Data protection agreements and privacy terms, £595, the service this page describes
• Terms and conditions drafting, £995
• SaaS and technology contracts, £995
• Employee privacy notice
• Privacy notice for a recruitment agency

This page is general guidance for businesses in England and Wales, not advice on your own circumstances. Last reviewed: October 2026. Email geoffrey@caesar.co.uk.