How to write a candidate screening privacy notice
A screening privacy notice tells candidates which checks you will run, why, where the information comes from, who will see it, how long you will keep it and what rights they have. Articles 13 and 14 of the UK GDPR set the minimum content. Article 13 covers what candidates give you, and applies when you collect it. Article 14 covers what you get from referees, disclosure bodies, screening providers and public sources, and gives you a reasonable period of no more than one month.
The ICO's draft recruitment guidance adds that you must tell candidates if you intend to vet them: what information you need, why, who will have access, the processes, how long you will keep it and, where possible, the third party sources. If you process criminal record information you will usually also need an appropriate policy document.
What Articles 13 and 14 require
Most of the list is the same for both articles. The differences matter for screening, because so much of the data comes from third parties.
Article 12 says the information must be concise, transparent, intelligible and easily accessible, using clear and plain language. The ICO adds that you must actively provide it: a website link works only if you make candidates aware of it.
| Item | From the candidate (Art 13) | From other sources (Art 14) |
|---|---|---|
| Your identity and contact details, and your data protection officer's | Yes | Yes |
| Purposes and lawful basis, and the legitimate interests if you rely on them | Yes | Yes |
| The categories of personal data concerned | No | Yes |
| Recipients or categories of recipients | Yes | Yes |
| Transfers outside the UK and the safeguards relied on | Yes, where applicable | Yes, where applicable |
| How long you will keep it, or the criteria you use to decide | Yes | Yes |
| Rights of access, rectification, erasure, restriction, objection and portability | Yes | Yes |
| Right to complain to you, and to the Information Commission | Yes | Yes |
| The source, including whether it was publicly accessible | No | Yes |
| Whether the data is a statutory or contractual requirement, and the consequences of not providing it | Yes | No |
| Automated decision-making covered by Article 22C, with meaningful information about the logic | Yes | Yes |
Two changes from the Data (Use and Access) Act 2025
Since 19 June 2026, Articles 13 and 14 include the right to make a complaint to the controller under section 164A of the Data Protection Act 2018. You must facilitate complaints, for example with a form that can be completed electronically and by other means, and acknowledge each within 30 days.
On 30 September 2026 the Information Commission replaced the Information Commissioner, and Articles 13 and 14 now refer to the right to complain to the Commission under section 165 of the Data Protection Act 2018. The regulator still uses the name ICO, so you can describe it as the Information Commission (ICO). The ICO's guidance on the right to be informed and its draft recruitment guidance both say they are under review because of the Act, so check them before you finalise.
What the ICO says candidates must be told about checks
For verification (checking what the candidate told you), the ICO says you must explain your process as early as possible, for example in the application form: the methods, the specific information you will verify, how long you will keep it and any external sources.
For vetting (your own enquiries of third parties), the list in the summary applies, and you could also say at what stage you will assess the information. For some roles the ICO expects more: any special checks, such as safeguarding or disclosure of spent convictions, whether it may be an offence to apply (for example for someone on the children's barred list), and whether you will seek information from third parties beyond the candidate's referees.
For criminal records, the ICO says you must tell candidates what level of check the role needs and how you will carry it out at the beginning of the process.
Criminal offence data and the appropriate policy document
Under Article 10 of the UK GDPR and section 10 of the Data Protection Act 2018, most employers need a condition in Part 1, 2 or 3 of Schedule 1 to that Act to process criminal convictions data. The employment condition in paragraph 1, and with limited exceptions, the substantial public interest conditions in Part 2, are met only if you have an appropriate policy document in place when the processing happens.
Paragraph 39 says it must explain your procedures for complying with the Article 5 principles and your retention and erasure policies, indicating how long the data is likely to be kept. You must keep it, review it and make it available to the Commission on request, free of charge, until 6 months after the processing stops. The ICO says publishing it is good practice but not required, and that candidates should get enough information to understand how you process their criminal offence data and how long you will keep it.
Do not assume that the candidate agreeing to a DBS check gives you a condition for processing. In an ICO example about a delivery company checking its self-employed riders, the ICO says that consent would not be freely given and could not be withdrawn, so it was not valid as a condition.
Information from referees, the DBS and screening providers
Under Article 14 you must tell candidates the categories of data you obtain and where it came from. Give this within a reasonable period and no later than one month, or earlier if you contact the candidate or disclose the data to someone else first. Saying in advance which referees, disclosure body and screening provider you will use, and what each will send you, covers much of this early.
Exceptions include where the candidate already has the information or providing it would be impossible or involve disproportionate effort. If you rely on that exception you must take appropriate measures to protect the candidate, including making the information publicly available, and for data from public sources such as social media the ICO says you must carry out a DPIA. In recruitment you will usually be in contact with the candidate, so this exception will rarely apply.
The ICO says an employer is typically the controller. A screening provider processing data on your instructions under contract will usually be your processor for that work, although it may be a controller for some activities; name it or its category as a recipient.
When to give it
The ICO says a combination of techniques, including layering and just-in-time notices, is often most effective.
| Stage | What to provide |
|---|---|
| Advert or application form | Article 13 information, how you verify information, and which checks the role needs and when |
| Before any check starts, usually at conditional offer | The full screening notice: each check, its purpose, basis, sources, recipients and retention, and how to raise a discrepancy |
| When third party data arrives | Any Article 14 information the candidate does not already have, within one month at the latest |
| Before any new use | Notice of the new purpose before you start processing for it |
Illustrative example wording
This wording is an illustrative starting point to adapt and check, not legal advice. Fill each bracket with what your roles actually justify, delete what does not apply, and check the result against Articles 13 and 14 and current ICO guidance.
- Who we are: [organisation name] is the controller. Contact [email and address]. [Our data protection officer is [name and contact details].]
- The checks for this role: if we offer you the role, the offer will depend on [list only the checks this role needs, for example a right to work check, [number] employment references and a [level] criminal record check through [DBS, Disclosure Scotland or AccessNI]].
- Why: [the legal requirement, naming the provision, or the specific risk in this role that the check addresses]. Our lawful basis is [basis]. For criminal record information we rely on [Schedule 1 condition][, and we have an appropriate policy document as that condition requires].
- When: we will start these checks only after a conditional offer, [unless the law requires an earlier check for this role].
- Where the information comes from: you, the referees you name, [disclosure body] and [screening provider], which acts for us under a written contract.
- Who will see it: [roles]. [Transfers outside the UK: [none, or the country and safeguard].]
- How long we keep it: [your retention period for each item]. After recruitment we keep a record of the outcome and our decision for [period].
- If something does not match: we will tell you and give you the chance to explain before we decide.
- Automated decisions: [we do not make significant decisions about you based solely on automated processing] or [describe the decision, meaningful information about the logic involved, its significance and likely consequences for you, and how you can make representations, ask for a person to review it and contest it].
- Your rights: you can ask for access to your information, and for it to be corrected, erased or restricted, object to our use of it and, in some cases, ask for portability. You can complain to us at [contact], and we will acknowledge your complaint within 30 days. You can also complain to the Information Commission, known as the ICO (ico.org.uk).
Sources
- UK GDPR Article 12: Transparent information, communication and modalities · legislation.gov.uk
- UK GDPR Article 13: Information to be provided where personal data are collected from the data subject · legislation.gov.uk
- UK GDPR Article 14: Information to be provided where personal data have not been obtained from the data subject · legislation.gov.uk
- UK GDPR Article 10: Processing of personal data relating to criminal convictions and offences · legislation.gov.uk
- UK GDPR Article 22C: Safeguards for automated decision-making · legislation.gov.uk
- Data Protection Act 2018, section 3: Terms relating to the processing of personal data · legislation.gov.uk
- Data Protection Act 2018, section 10: Special categories of personal data and criminal convictions etc data · legislation.gov.uk
- Data Protection Act 2018, section 164A: Complaints by data subjects to controllers · legislation.gov.uk
- Data Protection Act 2018, Schedule 1, paragraph 1: Employment, social security and social protection · legislation.gov.uk
- Data Protection Act 2018, Schedule 1, paragraph 5: Requirement for an appropriate policy document · legislation.gov.uk
- Data Protection Act 2018, Schedule 1, paragraph 39: Requirement to have an appropriate policy document in place · legislation.gov.uk
- Data Protection Act 2018, Schedule 1, paragraph 40: Retention of appropriate policy document · legislation.gov.uk
- Right to be informed · ICO
- Data protection and recruitment · ICO
- Verifying candidates · ICO
- Pre-employment vetting of candidates · ICO
- Responsibility for data protection compliance during the recruitment process · ICO
- Criminal offence data: what are the conditions for processing? · ICO
General information for employers in the UK, not legal advice. HRjoy advises on screening policy and fair process. We do not run checks ourselves; where you need checks run, we can introduce you to our screening partners. Check the official sources for your situation.
Questions
Something else? Ask us.
Does screening need its own privacy notice?
Articles 13 and 14 set out what candidates must be told, not the format, and the ICO expects extra detail for roles with special checks. A short screening section in your recruitment notice, followed by a fuller notice when checks start, usually works well.
Can we rely on the candidate's consent for screening?
Rarely. The ICO says employers in a position of power may not be able to show consent is freely given, and in its example of a company running criminal record checks on its riders, it says consent was not a valid condition. Identify the lawful basis and Schedule 1 condition that genuinely apply. Our consent guide covers this in more detail.
Do we need to mention software that scores or filters candidates?
If any significant decision is based solely on automated processing, Articles 13 and 14 require you to say so and give meaningful information about the logic involved and the likely consequences. Article 22C also requires safeguards, including the right to obtain human intervention and contest the decision.
Related checks
- Criminal record checks for employers Which criminal record check a role can lawfully have in England, Wales, Scotland and Northern Ireland, and how to run it fairly.
- Right to work checks: who to check and how from October 2026 Who needs a right to work check from 1 October 2026, including workers and sub-contractors, how each of the three methods works and follow-ups.
- Employment references: what employers can ask and when When to ask for references, what to ask, the sector rules for care, schools, early years and FCA firms, and how to treat candidates fairly.
- Social media checks on job candidates When a UK employer can review a candidate's public social media, what to tell them, who should look, and what to do with what you find.
Guides
- Do employers need candidate consent for background checks? Why consent is rarely the right lawful basis for UK background checks, what candidates must be told, and where their permission is still needed.
- The UK background screening checklist for employers A stage-by-stage background screening checklist for UK employers: who owns each step, what to record, and when to delete it.
- Choosing background screening software: an evaluation framework for UK employers Criteria for UK employers assessing background screening software: statutory check routes, processor contracts, data handling and automated decisions.
Related answers
- How should employers handle an employee subject access request? Employers should recognise the request, which can be made verbally or in writing, confirm the person's identity if needed, make a reasonable and proportionate search and respond without undue delay and within one month. Complex requests can be extended by up to two months. A fee usually cannot be charged, and information about other people may need redacting.
- What should employers consider when using AI in recruitment? Employers remain responsible under data protection and equality law when they use AI to source, screen or score candidates. The ICO expects a data protection impact assessment, a lawful basis, clear contracts with the provider, checks for bias, transparency with candidates and minimal data collection. Employers should also plan reasonable adjustments for disabled applicants.