Privacy notice

Thank you for showing an interest in working for the Scottish Government. 

As part of any recruitment process, the Scottish Government and associated public bodies collects and processes personal data relating to job applicants and applicants for public appointments. 

This privacy notice explains how we collect, use and store your personal information in the context of applying for employment or a public appointment and for use in our recruitment processes.  It also sets out the situations where we may share your personal data.  The privacy notice also explains your rights and how to contact us. 

We may collect, process and store different personal data from you depending on what stage you are at in the recruitment process and whether you are applying for employment or you are applying for a public appointment. Below we have listed what personal data you may provide us during the recruitment or appointment process. As mentioned above you will not have to supply all this information at the application stage, but as part of joining the Scottish Government or taking up a public appointment, our pre-employment check process will require this information. 

The personal data we may collect from you at application stage includes:   

• contact details such as name, title, addresses, telephone numbers, and personal email addresses 

• evidence of how you meet the requirements of the role, including CVs and references 

If you are successful for the role or public appointment you are applying for we may collect: 

• evidence of how you meet the Civil Service nationality rules and confirmation of your security clearance – this can include nationality details and information about any convictions, allegations and offences as part of Baseline Personnel Security Standard checks 

• evidence of your right to work in the UK and immigration status 

• diversity and equal opportunities monitoring information – this can include information about your race or ethnicity, religious beliefs, sexual orientation, disability and other ‘special category data’ 

• information about your health, including any medical needs or conditions 

• other information required for some applications, for example verification of qualifications 

• copies of driving licence, passport, birth certificates and proof of current address, such as bank statements and council tax bills 

• information regarding outside interests. This will include any paid outside occupation or work that will be undertaken in addition to your position as a civil servant. It will also include any other outside interests that you, a close family member or friend currently holds that may conflict with or restrict your ability to carry out your duties as a civil servant. 

If you contact us regarding your application at any point we will record that correspondence.  

Our lawful basis for using your data 

When you apply for a role or Public Appointment with the Scottish Government we process your data under a number of lawful bases (Article 6): 

Standard personal data: 

• Contractual: it is necessary for the performance of a contract to which you are a party – an employment contract. This relates to information that we need to recruit and employ you. 

• Contractual: it is necessary in order to take steps at your request prior to entering into a contract for employment. This relates to information that we collect as part of the application and selection process. 

• Legal obligation: it is necessary to comply with a legal obligation placed on us as the data controller – we are required to report on equality of opportunity; and onboarding processes have specific requirements 

• Public task: processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the data controller. In this case, Oracle Cloud facilitates recruitment of high-quality candidates to roles and appointments across government departments, agencies and other public bodies. It provides recruitment tools and processes that support Civil Service recruitment strategy, and we also monitor the effectiveness of recruitment processes. 

• Consent: for the digital right to work checks, personnel checks, work history checks, and participation in user research interviews we rely on your consent. 

Sensitive personal data (Article 9) is personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, and the processing of genetic data, biometric data for the purpose of uniquely identifying a natural person, data concerning health or data concerning a natural person’s sex life or sexual orientation. 

The legal basis for processing your sensitive personal data is: 

• it is necessary for reasons of substantial public interest for the exercise of a function of the Crown, a Minister of the Crown, or a government department; the exercise of a function conferred on a person by an enactment; the exercise of a function of either the Scottish Government; or the administration of justice; and an appropriate policy document is in place. Oracle Cloud facilitates recruitment of high-quality candidates to roles across government departments, agencies and other public bodies. It provides recruitment tools and processes that support Civil Service recruitment strategy. 

• it is necessary for the purposes of performing or exercising our obligations or rights as the controller, or your obligations or rights as the data subject, under employment law, social security law or the law relating to social protection. External recruitment is required to follow the Civil Service Commission Recruitment Principles. Personal data is processed to ensure that these requirements are met. We are required under the Equality Act 2010 to make appropriate reasonable adjustments for candidates with a disability. 

• processing is of a specific category of personal data and it is necessary for the purposes of identifying or keeping under review the existence or absence of equality of opportunity or treatment between groups of people specified (in paragraph 8(2) of Part 2 of Schedule 1 to the Data Protection Act 2018) in relation to that category with a view to enabling such equality to be promoted or maintained; and it is not carried out for the purposes of measures or decisions with respect to a particular data subject; and you have not declined consent; and you have not given notice that you do not wish your data to be processed for these purposes; and the processing is not likely to cause substantial damage or substantial distress to an individual. Diversity and inclusion data is used anonymously: ethnicity, religion and sexual orientation. 

• it is necessary for archiving purposes, scientific or historical research purposes or statistical purposes, and it is in the public interest. Analysis of applications and recruitment outcomes (including online tests), impact on protected groups, timescales for recruitment, and other research may be carried out. 

• for the provision of a digital route for carrying out Right to Work checks, the legal basis for providing a digital version of your face and identity documents, is because you explicitly consent. 

• for user research activities such as surveys, interviews or workshops, the legal basis is because you explicitly consent. 

The processing by us of personal data relating to criminal convictions (Article 10) and offences or related security measures is not carried out under official authority, but is authorised because it meets the following condition: 

• it is necessary for reasons of substantial public interest. This is ensuring that individuals with access to official information and assets will meet the required standards of propriety. 

Why we need your data 

We need your data in order to: 

• Progress your application 

• check that you’re the right candidate for the role 

• Carry out pre-employment and pre-appointment checks to ensure you have the right eligibility to take up the role and no conflict of interest concerns 

• get in contact with you 

• send you notifications for vacancy roles or job or public appointment alerts 

How your personal information is collected 

We usually collect your personal information when you enter it in Oracle. For certain roles or appointments, we might also collect information from third parties about you. 

These include: 

• former employers and people named by candidates as references 

• Disclosure Scotland 

• third parties relating to conflict of interest reasons. 

Employment reserve lists 

We maintain a reserve list of candidates who met our requirements but were not successful in securing the specific post they applied for. We’ll ask for your consent to be added to this list. We will refer to the list when other roles are advertised and will contact you if you match the role. We will ask for your consent before moving you forward for the role. Your data will be kept for as long as you are on a reserve list, this could be up to one year. If the role you are applying for requires certain conflict of interest responses to be given, these may be asked for again to ensure we have the most up to date information.   

Recipients of data 

Personal information you provide in the recruitment process will be made available to Scottish Government HR staff who need the information to administer the recruitment process and, if successful, carry out the processes necessary to onboard you to your new role or Public Appointment. These HR staff work in our Resourcing, Onboarding, Payroll, IT and Security teams. There will be certain roles and appointments which require your data to be shared with our additional data processors. These additional data processors can vary depending on which role you apply for. For certain roles, should you be successful in obtaining an interview and assessment, your information may be shared with our assessment provider The Keil Centre. If you are an external candidate and are not currently a Civil Servant, your information may be shared with Access, who will carry out your pre-employment checks on our behalf. You will always be notified before we do either of these actions. The following information will be shared with our additional data processors depending on their role: 

• contact details such as name, title, addresses, telephone numbers, and personal email addresses 

• copies of driving licence, passport, birth certificates and proof of current address, such as bank statements and council tax bills 

• evidence of how you meet the requirements of the role, including CVs and references 

• evidence of how you meet the Civil Service nationality rules and confirmation of your security clearance – this can include nationality details and information about any convictions, allegations and offences as part of Baseline Personnel Security Standard checks 

• evidence of your right to work in the UK and immigration status 

• other information required for some applications, for example verification of qualifications 

• if you contact us regarding your application, a record of that correspondence 

• details of your use of our recruitment tools and services, such as your candidate profile and alerts for vacancies 

• the status of your application and updates on how it moves forward  

If you are successfully recruited for employment, we will upload your details to our HR system. 

Employees will sign a terms and conditions of employment and agree to additional terms on how your data is handled and stored. 

We will also share data relating to the recruitment or appointment process for Freedom of Information purposes or other instances where we are required to share by for example, for public interest, by court order, or to prevent fraud or other crime. 

Where Scottish Government is managing the recruitment of employees or of public appointees on behalf of a public body or, we will share your information with that public body.  

Data security 

We have put in place measures to protect the security of your information. 

Third parties will only process your personal information on our instructions and where they have agreed to treat the information confidentially and to keep it secure. 

We have put in place appropriate security measures to prevent your personal information from being accidentally lost, used or accessed in an unauthorised way, altered or disclosed. In addition, we only give access to your personal information to those HR staff from the teams listed previously in section six of this notice. 

We have put in place procedures to deal with any suspected data security breach and will notify you and any applicable regulator of a suspected breach where we are legally required to do so. 

Data retention 

We will only retain your personal information for as long as necessary to fulfil the purposes we collected it for – including legal, accounting, or reporting requirements. 

This will depend on: 

• the amount, nature, and sensitivity of the personal data 

• the potential risk of harm from unauthorised use or disclosure of your personal data 

• the purposes for which we process it 

• whether we can achieve those purposes in other ways 

For recruitment to employment the retention period for documents supporting recruitment, application and sifting is 2 years. 

For recruitment to public appointments the retention period for documents supporting the public appointments process is 5 years. 

If you are unsuccessful, personally identifiable data is removed 2 years after your most recent application.  You can request the deletion of your personal information by contacting us at ScottishGovernmentrecruitment@gov.scot.   

Your rights 

You have the right to: 

• request access to your personal information (known as a ‘data subject access request’) – you’ll receive a copy of the personal information we hold about you, so you can check that we are lawfully processing it. It also allows you to request an electronic copy of any data you have provided in a structured, commonly used and machine-readable format 

• request that we correct incomplete or inaccurate personal information that we hold about you 

• request we delete your online profile which will remove all your personal information that we hold.  

• withdraw your consent for any data processed under the lawful basis of consent (see below) 

• object to the processing of your personal information 

• request we restrict the processing of your personal information – you can ask us to stop processing your personal information, for example if you want us to establish its accuracy or the reason for processing it  

To make any of these requests or to ask us to transfer a copy of your personal information to another party, contact the Scottish Government Resourcing team at ScottishGovernmentrecruitment@gov.scot. Please note that these rights are not absolute and will be processed on a case by case basis. 

Accessing your data 

You will not have to pay a fee to access your personal information or to exercise any of the other rights. However, if your request for access is clearly unfounded or excessive we may refuse the request. 

In some cases we will need some information to confirm your identity. This is to ensure that your personal information is not disclosed to someone who has no right to access it.  

Questions and complaints 

If you have concerns about the way we process and handle your personal information, in the first instance you should raise your concerns to the People Directorate:   

Resourcing Team
People Directorate 
Scottish Government 
Saughton House
Broomhouse Drive
Edinburgh

EH11 3XD  

If you are not satisfied with the response, you can escalate to Scottish Government Data Protection Officer by email to DataProtectionOfficer@gov.scot  

If you are not satisfied with the response or believe we are not processing your personal data in accordance with the law you may make a complaint to the Information Commissioner’s Office (ICO): 

Information Commissioner’s Office 
Wycliffe House 
Water Lane 
Wilmslow 
Cheshire 
SK9 5AF 

Changes to this privacy notice 

We may change this privacy notice. When we make changes to this notice, the ‘last updated’ date at the top of this page will also change. Any changes to this privacy notice will apply to you and your data immediately. If these changes affect how your personal data is processed, we will take reasonable steps to let you know.