Data Protection and Recruitment

Posted  17th March 2021

The session was centred on Best Practice as you move through the Recruitment process.

Starting with basics – What to consider as part of the Application form:

The overarching rules for recruitment are that we must collect data only for specific and legitimate purposes. This means we should think about:

a) the questions we need to ask and
b) for how long we keep their data.

It is also important to be transparent with candidates.

You should have some form of privacy statement included in / or appended into the forms explaining how the candidate data will be used. You do not necessarily need consent but it can be useful to get the candidate to give consent within the form. Especially if you are asking more sensitive type of data.

There is controversy about whether you can ask about convictions on an application form. Some agencies have reported that you cannot ask questions but that isn’t necessarily true. Keeping Children Safe in Education is unclear on this position and this may be determined by case law in the coming years. However, currently there is nothing legally preventing you from asking these questions, as long as you have a justifiable reason for doing so.


Considerations when it comes to References:

With regards to Employment References there are a few tips to bear in mind:

  • Schools are required to ask about previous employment history. The reference is an opportunity to obtain objective and factual information to support decisions.
  • References must always be obtained from the current employer.
  • It is worth considering when references will be obtained and if this will be prior to interview. If this is the case, you should make clear on the form that you will be obtaining the references prior to interview and give the candidate the option to confirm /object to this.
  • If the references were obtained prior to the interview, you will the be able to clarify any inconsistencies /gaps at interview.
  • It is important to stipulate who you would receive a reference from, for e.g., someone of sufficient standing, not just a colleague who would likely give a personal reference, as this scenario would raise alarm bells.
  • Be wary of open references that start off with “To whom it may concern”. This may suggest an agreed reference that might not be deemed suitable.
  • Also consider references for employees leaving your employment. Be transparent and let them know that from time-to-time you might be approached for a reference on them. Ask whether they would be comfortable with you providing this reference

Data Protection considerations during the interviewing process:

Ensure all questions are relevant and necessary to the job role. Try and refrain from asking questions and collection information that are not relevant to the post. For example, don’t prying into the candidate’s medical history if this is not necessary and there has been no indication they are not fit for the role.

If you do take any notes, or records at the interview, consider how long you intend to keep this for. A long period of time would not be suggested, except for successful applicants, as the purpose would only be to make a recruitment decision. Generally, a timeframe of 6 months seems like a good period to go by. A good reason to keep these records would normally be to safeguard against any discrimination claims by showing clear criteria to measure suitability.

Also think about how the notes will be kept:

  • If they are recorded electronically, they will automatically fall under the Data Protection Act.
  • If they are put on file or record, the Data Protection Act applies.
  • However, if you just take random notes and scribbles on a notepad during the interview, it may not be covered by Data Protection Act.
It would maybe be useful to let the everyone on the panel know about the above as well, as to make them aware that their notes could be disclosable if put on record / forms.

Once the decision to recruit has been taken, normally you would keep the unsuccessful applicants for a duration of 6 months. It may be worth informing candidates of this, as you inform them that they are unsuccessful. If you wish to keep them for longer, tell them in communication, and maybe even seek their consent to do so.

Other points to note about Pre-employment Checks:

  • DBS checks: You only need to record this check in your records for a maximum period. The actual DBS certificate should not be kept on file.
  • ID: You can keep a copy of ID on the staff file as this serves as proof of right to work in the UK.
  • Qualifications: The above applies for qualifications as well.
  • Overseas checks: The requirement is that those who lived / worked outside the UK must undergo same checks as other staff.

    A DBS check still needs to be carried out, even if the person hasn’t been to the UK. Additionally, the school must make any further checks it deems appropriate. Thus, any relevant events can be considered. For example, this can be overseas criminal records check or a letter of professional standing. It also does not state how far back to check. We determine what is reasonable.

  • Timeframe for retention: There is nothing stating for how long this information needs to be kept for. It would be best to treat is similarly to the DBS checks. Thus, record that it’s been checked and don’t keep it. It is only needed to evidence a suitable recruitment decision.


If you require any support in any of these steps, or would like to talk to someone surrounding some support for your school please do not hesitate to call us on 0203 326 9174 or email tara.jones@judicium.com.


The Rise of Internal SARs from Staff and How it Affects HR Processes
  October 02 2024

This is a summary taken from Judicium’s DPO ‘Sofa Session’ from 2nd October, with our Data Protection Consultant Sam Hall.

Read more

Get your Data Protection Ready for Summer Holidays
  July 10 2024

This is a summary taken from Judicium’s DPO ‘Sofa Session’ from 10th July, with our Data Protection Consultant Lane Baker.

Read more

6 Years On: Why Your Data Protection Culture Matters
  June 05 2024

This is a summary taken from Judicium’s DPO ‘Sofa Session’ from 5th June, with our Data Protection Consultant Bethany Parker.

Read more

Data Protection: Demystifying Data Mapping
  May 08 2024

This is a summary taken from Judicium’s DPO ‘Sofa Session’ from 8th May, with our Data Protection Consultant Jessica Gant.

Read more

Data Protection: What is a Lawful Basis?
  March 20 2024

This is a summary taken from Judicium’s DPO ‘Sofa Session’ from the 20th of March with Data Services Consultant Patrick Ballantine.

Read more

Tricky Subject Access Requests
  February 14 2024

This is a summary taken from Judicium’s DPO ‘Sofa Session’ from the 14th of February with Data Services Consultant Sam Hall.

Read more