Job applicant privacy notice

This notice explains how Online NHS Trust uses personal information when you apply for a role, take part in recruitment or join a recruitment talent pool. It also explains your rights and how to contact us.

Policy details

Version number: 1
Issue date: 23 September 2026
Approved by: Data Protection Officer
Document Owner: Data Protection Officer and Workforce lead
Next Review: 22 September 2027

1. Who we are

Online NHS Trust is the controller for the personal information it decides to use for its recruitment and selection activities.

Our contact address is Online NHS Trust, Wellington House, 133–155 Waterloo Road, London SE1 8UG.

You can contact our Data Protection Officer at onlinetrust.dataprotection@nhs.net.

Where another organisation determines its own purposes and means of processing, it is a separate controller, and its privacy notice also applies. Section 8 explains the main organisations involved.

2. Who this notice covers

people who apply for employment, secondment, fixed-term, bank, or other worker roles with the Trust
candidates introduced by a recruitment agency or partner organisation
people who take part in interviews, assessments, or other selection activity
preferred candidates completing pre-employment checks and onboarding
people who choose to join a recruitment talent pool

3. Information we use

We use only information that is relevant to the role and stage of recruitment. This may include:

Identity and contact information: name, address, email address, telephone number, date of birth, identity documents and, where needed, National Insurance number.

Application and selection information: application form, curriculum vitae, employment history, correspondence, interview notes, scores, assessment results, declarations, preferences, and information you provide about your suitability.

Qualifications and professional status: qualifications, training, professional registration, licences, memberships, and restrictions on practice.

Pre-employment checks: identity and right-to-work results, references, employment history, professional checks, fraud-prevention checks, and security screening appropriate to the role.

Health and adjustments: information needed to arrange reasonable adjustments, undertake a proportionate work-health assessment, or identify restrictions relevant to safe work.

Equality monitoring: age, sex, race or ethnicity, disability, religion or belief, sexual orientation and other characteristics used for lawful equality monitoring.

Criminal offence information: criminal record and barred-list information where the role and law permit or require a Disclosure and Barring Service check.

Immigration and right-to-work information: nationality, immigration status, share-code or document information, and evidence of permission to work in the United Kingdom.

Technical and audit information: account identifiers, dates and times, system logs, security records, and an audit trail of recruitment activity.

Equality-monitoring information is kept separate from selection decisions wherever practicable. Hiring managers normally receive only information needed to arrange adjustments or understand a work-related restriction, not detailed clinical information.

4. Where information comes from

We obtain most information directly from you. We may also obtain information from:

NHS Jobs and other recruitment or applicant-tracking services
recruitment agencies, staffing providers or partner organisations
referees and current or former employers
professional, educational, and regulatory bodies
identity, right-to-work, employment-verification and screening providers
the Disclosure and Barring Service and relevant public authorities
occupational-health providers
publicly available professional sources where a check is necessary and proportionate

If another source provides information about you, we will give you any further privacy information required by law within the applicable period, unless an exemption applies.

5. Why we use information

administer vacancies and applications
assess suitability and make recruitment decisions
arrange interviews, assessments, and reasonable adjustments
communicate with you and maintain a recruitment audit trail
verify identity, right to work, employment history, references, qualifications, and professional registration
complete role-appropriate pre-employment, work-health, criminal-record, and security checks
prepare an offer, contract, and onboarding record
meet employment, immigration, equality, regulatory and NHS workforce requirements
prevent fraud, protect public funds, and maintain security
monitor equality of opportunity and improve recruitment
undertake workforce planning and produce aggregated or anonymised management information
maintain a talent pool where you have chosen to join one

6. Our lawful bases

We must have a lawful basis for each use of personal information. The basis depends on the purpose and the information involved.

Our lawful bases for use of personal information
Processing	UK GDPR basis	Additional condition where applicable
Receiving and assessing applications; interviews; selection; preparing an offer	Article 6(1)(b): steps taken at your request before entering an employment contract	Not applicable unless special category or criminal-offence data is involved
Right-to-work and other checks required by law; legal claims and regulatory duties	Article 6(1)(c): compliance with a legal obligation	Article 9(2)(b) for employment and social-protection law where special category data is necessary
Recruiting and maintaining a capable NHS workforce; governance, fraud prevention, and public accountability	Article 6(1)(e): task in the public interest or exercise of official authority	Article 9(2)(g) and an applicable Data Protection Act 2018 Schedule 1 condition where substantial public interest applies
Work-health assessment and occupational-health advice	Article 6(1)(b), 6(1)(c) or 6(1)(e), according to purpose	Article 9(2)(h): occupational medicine and assessment of working capacity, subject to professional confidentiality
Equality monitoring	Article 6(1)(c) or 6(1)(e), according to purpose	Article 9(2)(g) with the relevant Data Protection Act 2018 Schedule 1 condition, including equality of opportunity or treatment where applicable
Criminal-record and barred-list checks	Article 6(1)(c) or 6(1)(e), according to the role and duty	Article 10 and an applicable Data Protection Act 2018 Schedule 1 condition, including employment law where applicable
Optional talent pool	Article 6(1)(a): consent	If special category data is included, we will identify a separate Article 9 condition. You may withdraw consent at any time.

We do not rely on consent for processing that is necessary to assess an application, comply with law or perform our public functions. Where we rely on consent for an optional purpose, refusing or withdrawing consent will not affect the lawfulness of earlier processing or your treatment in recruitment.

7. Information you must provide

You must provide enough information for us to assess your application and, if you receive a conditional offer, complete the checks required for the role. If you do not provide necessary information, we may be unable to progress the application, make an offer or confirm your appointment. Information requested only for equality monitoring or an optional talent pool is voluntary and will be identified as such.

8. Who receives information

Access within the Trust is limited to people who need the information for recruitment, workforce, information-governance, security, legal, audit, or management purposes.

Where necessary and proportionate, we may share information with:

NHS Jobs and the NHS Business Services Authority
NHS Shared Business Services, Sopra Steria or another recruitment administration provider
Oleeo or another applicant-tracking provider
Mistho or another employment-verification provider
TrustID or another identity and right-to-work provider
UCheck, the Disclosure and Barring Service and relevant barring or police authorities
occupational-health providers
referees, former employers, recruitment agencies, and staffing partners
professional, educational, and regulatory bodies
NHS England or another NHS body where a lawful requirement applies
auditors, legal advisers, courts, regulators, law-enforcement bodies, and government departments where law permits or requires disclosure

Some recipients process information only on our documented instructions under contract. Others decide their own purposes and are separate controllers. Their own privacy information will apply to that processing. We do not sell applicant information.

9. International transfers

While the Online NHS Trust does not normally transfer applicant data outside the United Kingdom, a supplier or its approved sub-processor may store or access information outside the United Kingdom. Before making a restricted transfer, we require an applicable adequacy regulation, appropriate safeguards such as the United Kingdom International Data Transfer Agreement or Addendum, or another lawful exception. We assess the transfer and apply additional safeguards where needed. You may contact our Data Protection Officer for information about the safeguard used for a particular transfer.

10. Automated processing

We do not currently make recruitment decisions that have legal or similarly significant effects on you based solely on automated processing. Digital systems may support administration, searching, scoring or checks, but a person remains responsible for significant recruitment decisions.

11. How long we keep information

We keep personal information only for as long as necessary, in line with law, the NHS Records Management Code of Practice and the Trust's approved retention schedule.

Unsuccessful applications: Normally six months after the recruitment process ends. We may keep a record longer where needed for a legal claim, investigation, or another documented reason.

Successful applications: Relevant recruitment and pre-employment information becomes part of the workforce record and is kept under the applicable workforce retention period.

Talent pools or reserve lists: Up to 12 months from consent or entry unless you withdraw consent sooner or we tell you a different period when you join.

Verification and checking records: Only for the period justified by law, the relevant code, or our retention schedule. We limit copies and detailed results, particularly for Disclosure and Barring Service and occupational-health information.

When the retention period ends, we securely delete or anonymise the information, unless law requires continued retention.

12. How we protect information

We use proportionate organisational and technical controls, including role-based access, contractual confidentiality, staff training, secure systems, audit records, and retention controls. We require processors to protect information and notify us of relevant incidents.

13. Your rights

Depending on the circumstances and lawful basis, you may have the right to:

receive clear information about our processing
ask for access to your personal information
ask us to correct inaccurate or incomplete information
ask us to erase information where the right applies
ask us to restrict processing where the right applies
object to processing based on public task, subject to lawful grounds for continuing
receive information you provided in a portable format where processing is automated and based on consent or contract
withdraw consent at any time where consent is the basis
challenge a significant decision based solely on automated processing and obtain the safeguards available under law

These rights are not absolute. We may need to retain or continue using information to meet a legal duty, exercise official authority, establish or defend legal claims, or complete another lawful purpose. We will explain our decision if an exemption or restriction applies.

14. Questions, rights requests, and complaints

If you have questions about this notice or how your personal information is used, please contact the Online NHS Trust Data Protection Officer at onlinetrust.dataprotection@nhs.net.

If you remain dissatisfied, you may complain to the Information Commissioner's Office via this link: Make a data-protection complaint.

15. Changes to this notice

We review this notice when law, recruitment processes, suppliers, or data uses change. We will publish the current version through our recruitment channels and draw material changes to applicants' attention where appropriate.