Privacy notice - recruitment for staff vacancies

What information does the College collect?

As part of any recruitment process, the College collects and processes personal data relating to job applicants. The College is committed to being transparent about how it collects and uses that data and to meeting its data protection obligations.

The College collects a range of information about you. This includes:

• your name, address and contact details, including email address and telephone number;
• details of your qualifications, skills, experience and employment history;
• information about your current level of remuneration, including benefit entitlements;
• whether or not you have a disability for which the College needs to make reasonable adjustments during the recruitment process;
• whether or not you have a disability for which the College needs to make reasonable adjustments during the recruitment process;
• information about your entitlement to work in the UK; 
• equal opportunities monitoring information, including information about your ethnic origin, sexual orientation, health, and religion or belief;
• In line with RCPCH’s commitment to safeguarding and the welfare of young children, successful applicants must undergo all necessary checks, including past employer references, a Disclosure and Barring check, and disclosure of any unspent convictions. This may require us to collect personal data about you from third parties, such as references supplied by former employers, information from employment background check providers and information from disclosure barring service checks.  We will also conduct online searches on shortlisted candidates for this purpose, which may include social media.

The College collects this information in a variety of ways. For example, data might be contained in application forms, CVs or resumes, obtained from your passport or other identity documents, or collected through interviews or other forms of assessment, including online tests.

Data will be stored on your application record in the HR management system and on other IT systems (including email).

Why does the College process personal data?

The College needs to process your personal data to assess your suitability for a role you have applied for and to help us develop and improve our recruitment process. The legal bases we rely on for processing your personal data are:

• Article 6(1)(b) of the UK GDPR, which relates to processing necessary to perform a contract or to take steps at your request, before entering a contract
• Article 6(1)(f) for the purpose of our legitimate interests.
• In some cases, the College needs to process data to ensure that it is complying with its legal obligations (article 6(1)(c) of UK GDPR. For example, it is required to check a successful applicant's eligibility to work in the UK before employment starts.
• The College may also need to process data from job applicants to respond to and defend against legal claims (article 9 (f) in relation to special category data and legitimate interest (article 6(1)(f) where it relates to personal data).
• If you provide us with any information about reasonable adjustments you require under the Equality Act 2010 the lawful basis we rely on for processing this information is article 6(1)(c) to comply with our legal obligations under the Act.
• The lawful basis we rely on to process any information you provide as part of your application which is special category data, such as health, religious, sexual orientation or ethnicity information are article 9(2)(b) of the UK GDPR, which relates to our obligations in employment and the safeguarding of your fundamental rights or article 9(2)(g) - necessary for reasons of substantial public interest in relation to safeguarding.
• For some roles, the College is obliged to seek information about criminal convictions and offences. Where the College seeks this information, it does so because it is necessary for it to carry out its obligations and exercise specific rights in relation to employment. The lawful basis we rely to process this data are Article 6(1)(e) for the performance of our public task. In addition we rely on the processing condition at Schedule 1 part 2 paragraph 6(2)(a).

Who has access to data?

Your information will be shared internally for the purposes of the recruitment exercise, this may also include contractors, consultants or college representatives if they are part of the recruitment process. This includes members of the People and Culture team, interviewers involved in the recruitment process, managers in the business area with a vacancy and IT staff if access to the data is necessary for the performance of their roles.

CDD will carry out right to work checks on behalf of RCPCH and will be a Data Controller for this purpose. We will share your data with the CDD Service so that they can perform these checks. More information on how they process your information is available on the CDD privacy notice. If you are not happy for CDD to do this, please let us know by contacting recruitment@rcpch.ac.uk and we can carry out these checks using an alternative method. This will not affect your application. 

If your application for employment is successful, the College will then share your data with former employers to obtain references for you, employment background check providers to obtain necessary background checks and the Disclosure and Barring Service to obtain necessary criminal records checks.

Transferring your data outside the European Economic Area

The organisation will not transfer your data outside the European Economic Area.

How does the College protect data?

The College takes the security of your data seriously. It has internal policies and controls in place to ensure that your data is not lost, accidentally destroyed, misused or disclosed, and is not accessed except by our employees in the proper performance of their duties. 

For how long does the College keep data?

If your application for employment is unsuccessful, the College will hold your data on file for 6 months after the end of the relevant recruitment process. At the end of that period, your data is deleted or destroyed.

If your application for employment is successful, personal data gathered during the recruitment process will be transferred to your personnel file and retained for six years from the end of your employment. CDD will keep a copy of the right to work checks for 30 days, after which the only copy will remain on your personnel file and will be kept in line with this retention. 

Understanding GDPR and your data rights

To help you understand more about the information in this and all our privacy notices, see our page, Understanding GDPR and your data rights. This explains common words and phrases used in our privacy notices, describes our use of artificial intelligence (AI) and details the rights you have in relation to the processing of your personal data under UK General Data Protection Regulation (UK GDPR).

We undertake end-to-end tracking of exam user journeys so that we can monitor and make improvements to our exams. This includes information about what pages you visit, how long you are on the site, how you got here and what you click on. We also use cookies for authentication purposes and to validate an active browsing session.

Additionally, we use a third party, CDD Services to carry out right to work checks. If you are not happy for your details to be provided to CDD Services for this purpose, please let us know by contacting: recruitment@rcpch.ac.uk and we can use an alternative method to complete these checks. This will not affect your application.

If you would like to exercise any of these rights, please contact the Information Governance team at information.governance@rcpch.ac.uk. If you make a request we have one month to respond to you.

How to complain

If you are unhappy with how we are using your personal data, you should contact us in the first instance so that we can understand and try to resolve your concern. If we can't resolve the issue you have the right to complain to the Information Commissioners Office (ICO) at casework@ico.org.uk.

Automated decision-making

The application process includes a number of ‘killer questions’ which end the application process if answered ‘no’ (eg right to work in the UK). If ended, the application will be rejected and not considered. If you are unhappy with the decision made, you can contact the College and ask for a review: recruitment@rcpch.ac.uk.

Last updated June 2025