Using the General Data Protection Regulation (GDPR) to protect your personal data.

From the outset of the recruitment process, employers will ask you to share a lot of personal data to enable them to contact you and assess your suitability for a role.

It has become common practice for employers to ask prospective employees about their criminal convictions and many will also carry out formal criminal record checks.

If you’re being asked to disclose details of your conviction, then an employer should be able to provide you with details of the lawful basis and condition they rely on when asking. You should also be able to access a copy of or link to their privacy policy which should set out the purpose of processing your data, how it will be used and stored, the data retention periods and who you data could be shared with.

But, what should you do if you’ve given this information to an employer and your application is unsuccessful?

The information you’ve disclosed is extremely sensitive and personal and you should expect that an employer will handle your personal information responsibly and in line with the law and good practice. However, to be sure that an organisation is not holding onto your information unlawfully, you have the right to ask that an organisation deletes all information they hold about you. This is officially referred to as ‘the right to erasure’.

GDPR significantly strengthens the rights you have over the processing of your personal data and we’d recommend that you use it to your advantage by always requesting that an organisation delete your personal data if an application you’ve made for a job is unsuccessful.

For more information

• For practical self-help information – More information is available on GDPR and data protection – Guide for individuals and your right to be forgotten.
• Questions – If you have any questions about this, you can contact our helpline.