Purpose of this notice
NHS Property Services Limited is the controller of the personal data we process about candidates during recruitment. This notice explains how and why we collect, use, share and retain personal data about you when you apply for work with us, including as an employee, worker, contractor, agency worker or other prospective member of our workforce.
This notice is intended to meet our transparency obligations under the UK General Data Protection Regulation, the Data Protection Act 2018 and relevant ICO guidance. It has also been written to reflect the Data (Use and Access) Act 2025.
Who to contact
If you have questions about this notice or how we handle your personal data, you can contact our recruitment team at careers@property.nhs.uk. You may also contact our Data Protection Officer using the contact details provided at the end of this notice.
Data protection principles
We will handle your personal data in accordance with data protection law. This means we will ensure that personal data is:
-
used lawfully, fairly and transparently;
-
collected for specified, explicit and legitimate purposes;
-
adequate, relevant and limited to what is necessary;
-
accurate and, where necessary, kept up to date;
-
kept for no longer than necessary; and
-
protected by appropriate security measures.
Personal data we collect
We may collect and use the following categories of personal data during the recruitment process:
- identity and contact details, such as your name, address, personal email address, telephone number and title;
- application information, such as your CV, covering letter, application form, employment history, qualifications, skills, experience and professional memberships;
- recruitment process information, such as interview notes, assessment results, test outcomes, selection decisions and communications with you;
- right to work, identity verification and pre-employment screening information;
- reference information and information provided by former employers, referees or recruitment agencies;
- salary expectations, current salary information where provided, notice period and availability; and
- information from publicly available professional sources, such as a LinkedIn profile, where relevant to the role.
We may also collect and use special category data where this is relevant and lawful, including:
-
health or disability information, for example to consider reasonable adjustments or fitness for work;
-
diversity and inclusion information, such as race or ethnic origin, religion or belief, disability, sex, sexual orientation or other equality monitoring information; and
-
criminal convictions or offences information, including Disclosure and Barring Service checks, where this is necessary and appropriate for the role.
How we collect personal data
We usually collect personal data directly from you. We may also collect information from recruitment agencies, referees, former employers, professional bodies, occupational health providers, identity verification providers, DBS providers and publicly available professional sources where this is relevant to the role.
How and why we use your personal data
We use candidate personal data for the following purposes:
- to assess your skills, qualifications, experience and suitability for the role;
- to administer and manage the recruitment process;
- to communicate with you about your application;
- to arrange and conduct interviews, assessments or tests;
- to make recruitment decisions and, where appropriate, offer you a role;
- to complete pre-employment checks, including right to work, references, identity verification and DBS checks where required;
- to consider and implement reasonable adjustments;
- to monitor equality, diversity and inclusion in recruitment;
- to keep appropriate records of recruitment decisions; and
- to comply with legal, regulatory, audit, safeguarding and governance obligations.
Our lawful bases under Article 6 UK GDPR are usually:
-
steps prior to entering into a contract, where we process information to assess your application and decide whether to offer you work;
-
legal obligation, where we must check your right to work, meet employment law obligations, comply with safeguarding requirements or respond to legal or regulatory obligations;
-
legitimate interests, where we need to run an effective, fair and accountable recruitment process, manage workforce planning, protect our organisation and defend or bring legal claims; and
-
consent, only where we specifically ask for it and where consent is appropriate, such as retaining your details in a talent pool for future opportunities.
Where we rely on legitimate interests, we will only do so where we have considered the impact on your rights and freedoms and are satisfied that our interests are not overridden by your interests or fundamental rights.
If your application is successful, relevant recruitment information will be transferred to your employment or contractor record and processed under the applicable workforce privacy notice.
If you do not provide information
If you do not provide information that we reasonably need to consider your application or complete required checks, we may be unable to progress your application or make an offer of work. For example, if we require evidence of qualifications, right to work information or references and you do not provide them, we may not be able to continue with the recruitment process.
Special category data and criminal convictions data
We will only use special category data where we have an Article 9 UK GDPR condition and, where required, a relevant condition under Schedule 1 of the Data Protection Act 2018.
We may use health or disability information to assess and make reasonable adjustments, consider fitness for work and meet employment, health and safety or equality law obligations. We may use equality monitoring information to understand and improve the fairness and effectiveness of our recruitment process. Equality monitoring information is not used to make recruitment selection decisions and is reported in an anonymised or aggregated way wherever possible.
Where criminal convictions or offences information is required, we will process it only where this is necessary for the role, proportionate, and authorised by law. This may include DBS checks for roles involving safeguarding, access to sensitive environments, statutory requirements or other trust and assurance requirements. We will only request the level of check that is appropriate for the role.
Automated decision-making, profiling and recruitment technology
We use a recruitment platform to manage and support the recruitment process. The platform may be used to receive and store applications, CVs and covering letters; manage candidate accounts; communicate with candidates; schedule interviews; record interview and assessment outcomes; manage pre-employment checks; retain recruitment records; and produce recruitment management information.
We may use Microsoft Copilot, within our Microsoft 365 environment, solely to provide administrative and analytical support when reviewing high volumes of technical applications. Copilot may be used to summarise CVs against pre-defined role criteria aligned to the approved role profile; highlight skills, experience and qualifications explicitly evidenced in the CV against the essential criteria; and structure candidate information into a consistent, standardised format to support timely and equitable human review.
Copilot will not be used to rank, score, shortlist, reject, assess suitability, make recommendations about candidates, or make recruitment decisions. Copilot outputs are used only to support human reviewers by presenting information in a clearer and more consistent format. Recruitment colleagues remain responsible for considering the full application, applying the approved selection criteria, exercising judgement and making all shortlisting, interview, assessment, offer and rejection decisions.
We do not use AI-assisted recruitment tools to infer special category data, such as health, disability, race, ethnic origin, religion or belief, sex or sexual orientation, for recruitment selection purposes. Equality monitoring information is kept separate from recruitment selection decisions wherever possible and is used to monitor fairness and inclusion at an aggregate level.
If you have questions or concerns about how Copilot or any other AI-assisted tool has been used in relation to your application, you may ask us for further information, raise concerns, make representations, contest the outcome or request human review where applicable. We will consider such requests in line with UK data protection law, ICO guidance and the safeguards under the Data (Use and Access) Act 2025.
Who we share personal data with
We may share candidate personal data with people and organisations who need it for recruitment, screening, governance or legal purposes. This may include hiring managers, interview panel members, HR colleagues, recruitment agencies, recruitment system providers, occupational health providers, referees, former employers, DBS providers, identity verification providers, professional advisers, auditors, regulators and public authorities where required.
Where we use service providers to process personal data on our behalf, we require them to process personal data only on our instructions, keep it secure and meet appropriate data protection standards.
International transfers
We will not transfer your personal data outside the UK unless appropriate safeguards are in place. Where an international transfer is required, we will use safeguards recognised under UK data protection law, such as adequacy regulations, the UK International Data Transfer Agreement, the UK Addendum to the EU Standard Contractual Clauses, or another lawful transfer mechanism.
Data security
We use appropriate technical and organisational measures to protect personal data against accidental or unlawful loss, misuse, unauthorised access, disclosure, alteration or destruction. Access to candidate personal data is limited to those who need it for recruitment, employment, legal, audit or governance purposes.
We have procedures to respond to suspected personal data breaches and will notify affected individuals and the ICO where we are legally required to do so.
How long we keep your personal data
If your application is unsuccessful, we will normally keep your recruitment records for six months after we have communicated the outcome of the recruitment process. We keep records for this period so that we can respond to queries, demonstrate that the recruitment process was fair and transparent, and deal with any legal claims.
If your application is successful, relevant recruitment information will be transferred to your personnel or contractor file and retained in line with our workforce retention requirements. Certain records, such as right to work checks, DBS information or occupational health information, may be subject to different retention periods depending on legal, regulatory or operational requirements.
If we would like to retain your details for future opportunities, we will tell you separately and ask for your consent where appropriate. We will explain how long we intend to keep your details and how you can withdraw your consent.
Your rights
Depending on the circumstances, you may have the right to:
- request access to your personal data;
- request correction of inaccurate or incomplete personal data;
- request erasure of your personal data;
- object to processing based on legitimate interests;
- request restriction of processing;
- request portability of personal data where this right applies;
- withdraw consent where we rely on consent; and
- raise concerns about automated decision-making or request human review where applicable.
These rights are not absolute and may not apply in every situation. We will usually respond to requests within one month, unless the request is complex or we receive a number of requests from you. To exercise your rights, please contact DPO@property.nhs.uk.
Consent
We do not generally rely on consent for core recruitment processing because much of this processing is necessary to assess your application, take steps before entering into a contract, comply with legal obligations or pursue legitimate interests. Where we do rely on consent, you may withdraw it at any time by contacting careers@property.nhs.uk.
Complaints and Data Protection Officer
We have appointed a Data Protection Officer to oversee compliance with data protection law. If you have any questions, concerns or complaints about how we handle your personal data, please contact the DPO in the first instance at DPO@property.nhs.uk.
We will acknowledge and respond to complaints in line with applicable data protection requirements.
You also have the right to complain to the Information Commissioner’s Office, the UK regulator for data protection issues. You can contact the ICO via its website or by telephone on 0303 123 1113, or https://ico.org.uk/make-a-complaint//
Changes to this notice
We may update this notice from time to time to reflect changes in law, ICO guidance, our recruitment processes or the systems we use. The latest version will apply to the personal data we process about candidates.