Applicant Privacy Notice Template for England and Wales

An Applicant Privacy Notice is a legally required document that informs job candidates about how their personal data will be collected, used, and protected during the recruitment process. Under UK GDPR and the Data Protection Act 2018, you must provide this notice to all job applicants before or at the time you collect their personal information, ensuring transparency and compliance with England and Wales data protection laws.

When do you need this document?

You need an Applicant Privacy Notice whenever you collect personal data from job candidates, whether through online application forms, CV submissions, interview processes, or background checks. This includes recruitment for permanent positions, temporary roles, internships, and volunteer positions. The notice is required regardless of your organization's size, from small businesses to large corporations. You must also update and re-issue the notice if your data processing activities change significantly during the recruitment process. Digital recruitment platforms, recruitment agencies, and in-house HR teams all require compliant privacy notices to meet their legal obligations.

Key legal considerations

Your privacy notice must clearly identify you as the data controller and provide contact details, including Data Protection Officer information if applicable. You must specify the types of personal data collected, from basic contact information to sensitive data like criminal records or health information for specific roles. The notice should detail all purposes for processing data, including assessment, background checks, and record-keeping. You must identify the legal basis for each processing activity under UK GDPR, whether legitimate interests, contract performance, or legal obligations. Data retention periods must be clearly stated, explaining how long you'll keep successful and unsuccessful applicant data. The notice should outline applicant rights, including access, rectification, erasure, and portability, along with complaint procedures to the ICO.

Legal requirements in England and Wales

Under UK GDPR and Data Protection Act 2018, your privacy notice must be provided in clear, plain language that candidates can easily understand. The information must be provided at the first point of data collection, typically when candidates submit applications or register interest. You must implement appropriate technical and organizational measures to protect applicant data from unauthorized access or breaches. Special category data, such as diversity monitoring information or health data for occupational health assessments, requires explicit consent or other specific legal grounds. The ICO Employment Practices Code provides detailed guidance on proportionate data collection and processing in recruitment contexts. You must maintain records of processing activities and be prepared to demonstrate compliance with data protection principles. Cross-border data transfers, including to group companies or third-party processors outside the UK, require additional safeguards and disclosure in your privacy notice.