Welsh Government jobs and public appointments service: privacy notices

This notice sets out how we will use your personal data, and your rights under UK GDPR.

The lawful basis relied upon by the Controller for the processing of personal data is: Article 6(1)(e) UK GDPR, processing is necessary for the performance of a task carried out in the public interest and in the exercise of official authority vested in the Welsh Government. Where applicable, processing is also necessary for compliance with legal obligations relating to public sector recruitment under Article 6(1)(c) UK GDPR.

The lawful basis for processing special category personal data is: Article 9(2)(b) UK GDPR, processing is necessary for the purposes of carrying out obligations and exercising rights in the field of employment. Where equality monitoring and assurance of fair and open recruitment are concerned, processing also relies on Article 9(2)(g) UK GDPR, substantial public interest, as provided for in the Data Protection Act 2018.

Standard recruitment

As data controller, Welsh Government will process the personal data you provide as part of the recruitment process in line with our public task and the official authority vested in us.

We will process it in order to:

• assess your suitability for a role with Welsh Government
• carry out pre-employment checks
• make necessary arrangements for you to join the organisation
• monitor the effectiveness of recruitment processes
• meet our legal requirements

The information we ask for and why

Our HR Recruitment Team will use the contact details you provide to contact you about your application.

We ask for information to assess your eligibility and suitability for the role you have applied for. You do not have to provide this but it may affect your application if you don’t (for example if you do not provide us with evidence of qualifications required for the role).

Some information is used for pre-employment eligibility checks (Baseline Personnel Security Standards - BPSS). You must provide this information.

Equality and diversity

We monitor and analyse diversity information to ensure that our employment practices are fair, transparent and promote equality. We are committed to recruiting, retaining and developing a workforce that reflects the diverse communities that we serve.

Your cooperation in providing us with accurate data will help us to meet our legal obligations set out under the Equality Act 2010.

Any information provided on your application form will be with your consent and treated as strictly confidential. It will not be used in any way which allows any individual to be identified and will be removed before the application forms are sent to the panel who will sift and interview you.

If you complete the Disability Confident Guaranteed Interview Scheme section of the application form, this information will be shared with those setting the minimum criteria for interview.

If you provide information on reasonable adjustments you need to participate in the recruitment exercise, this information may be shared with the interview panel and assessors to put your adjustment into practice.

In these instances, we will process your personal data to ensure equality of opportunity and treatment.

How we store your information

We keep your personal data for as long as needed for recruitment:

• Your personal data will only be shared with service providers who process it on our behalf, such as our recruitment system vendor. They are required to keep your data secure and only use it as we instruct.
• If your application is unsuccessful, we will usually keep your data for up to 2 years after the recruitment process ends.
• If you are successful, your data will become part of your employee record and will be kept in line with our employee data retention policy.
• In some cases, we may keep your data for longer where there is an ongoing recruitment need or where you have agreed to be considered for future roles.

Assessments

We may ask you to do any combination of the following:

• participate in assessment events
• complete tests or occupational personality profile questionnaires 
• attend an interview 

For example, you might complete a written test or we may take interview notes. This information is held by the Welsh Government. Information will be generated by you and by us and, on occasion, third parties.

In certain recruitment schemes you may be directed to an external platform (such as that of the Government Recruitment Service) on which to complete assessments. They will have their own privacy statement for you to view.

Pre-employment checks

Enhanced security clearance

Some roles at the Welsh Government require a higher level of security clearance. This will be made clear on the advert for the post or appointment. If this is the case, you will be asked to submit information via the National Security Vetting process to United Kingdom Security Vetting.

United Kingdom Security Vetting

United Kingdom Security Vetting (UKSV) will send Welsh Government the findings. If you fail national security vetting Welsh Government will need to review your suitability for a role. This may include:

• a review of how you can perform your duties
• changing your responsibilities
• moving you of out a post or withdrawing you from employment

National Security Vetting

Some applicants will require National Security Vetting (NSV) to protect against threats from hostile intelligence services. Welsh Government uses NSV to inform decisions on employment.

How we share your information with other public bodies

The Welsh Government may share information with other public bodies. These include: 

• the Civil Service Commission (to allow the commission to discharge its statutory responsibilities in relation to compliance, complaints and investigation)
• the Advisory Committee on Business Appointments (to allow the committee to provide advice under the UK government’s Business Appointments Rules)
• the Office of the Commissioner for Public Appointments (to allow the commissioner to process case work in compliance with the Governance Code for Public Appointments)

Your rights

You have the right:

• to see the personal data we are processing about you
• to ask us to rectify inaccuracies in that data
• to object to processing (in certain circumstances)
• for your data to be ‘erased’ (in certain circumstances)
• to lodge a complaint with the Information Commissioner’s Office (ICO)

Contact details

For more information you can contact the Resourcing Hub by email: resourcinghub@gov.wales.

If you wish to exercise your rights under the UK General Data Protection Regulation (UK GDPR), please contact:

The contact details for the Information Commissioner’s Office are:

The following section applies only if you are applying for a public appointment.

This notice sets out how we will use your personal data, and your rights. It is made under Articles 13 and/or 14 of the General Data Protection Regulation (GDPR).

As data controller, Welsh Government will process the personal data you provide as part of the recruitment process in line with our public task and the official authority vested in us.

1. Purpose

Our purposes for processing your personal data are:

• to recruit for public appointments in Wales including dealing with applications, selection, appointment, pre-employment checks vetting, and making necessary arrangements for you to join the organisation
• to monitor and promote diversity in public appointments, including the effectiveness of our outreach and recruitment activities and to shape future work to improve board representation
• to monitor the effectiveness of recruitment processes and ensure that our employment practices are fair, transparent and promote equality, and
• to produce statistics

2. The data

We will process the following personal data: your application, including name (at the appropriate point), contact details, location, employment history, qualifications, CV, personal statement and other background information relevant to your application; sift and interview assessments; and conflicts of interest and political activity.

Diversity data will also be requested, although you may decline to provide this if you wish by selecting ‘prefer not to say’. This includes age, gender, ethnicity, sexual orientation, disability, and faith. We monitor and analyse diversity information to ensure that our employment practices are fair, transparent and promote equality. We are committed to recruiting, retaining and developing a public bodies that reflect the diverse communities that they serve.

We may also process other information gathered by Welsh Government as part of due diligence, including information obtained from public sources including social media.

Information relating to your nationality, address, family history and criminal convictions may be required in order to enable you to hold the necessary security clearance for your new role.

3. Lawful basis

Our legal basis for receiving and using your information is that it is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the data controller. In this case that is to ensure that high quality candidates are identified via robust recruitment processes in line with the Governance Code for Public Appointment published pursuant to Public Appointments (No. 2) Order in Council 2023. We also have a public task to monitor and promote diversity under our public sector equality duty.

Where a contract of employment exists, we also process your data on the legal basis that it is necessary for the performance of a contract to which you are a party, and it is necessary in order to take steps at your request prior to entering into a contract.

Sensitive personal data is personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, and the processing of genetic data, biometric data for the purpose of uniquely identifying a natural person, data concerning health or data concerning a natural person’s sex life or sexual orientation.

We may process sensitive personal data for the purposes of equality and diversity monitoring, to make reasonable adjustments for applicants, and if it comes to light during due diligence checks. Our lawful basis for processing your sensitive personal data is:

• It is necessary for the purposes of performing or exercising our obligations or rights as the controller, or your obligations or rights as the data subject, under employment law, social security law or the law relating to social protection (reasonable adjustments)
• processing is of data concerning ethnicity, religious or philosophical belief, health including disability or sexual orientation, it is necessary for the purposes of identifying or keeping under review the existence or absence of equality of opportunity or treatment between groups of people with a view to enabling such equality to be promoted or maintained (diversity monitoring)
• processing is necessary for reasons of substantial public interest for the exercise of a function of the Crown, a Minister of the Crown, or a government department (diversity monitoring and due diligence)
• It relates to personal data which are manifestly made public by you (due diligence)

4. Recipients

We will share your information, including CVs and statements, with the members of the Advisory Assessment Panel. Your diversity data will be removed before the application forms are sent to the panel who will sift and interview you, except where reasonable adjustments are requested or needed, or whereby a named departmental official is responsible for representing the minister's views.

If you complete the Disability Confident Guaranteed Interview Scheme section of the application form, this information will be shared with those setting the minimum criteria for interview. If you provide information on reasonable adjustments you need to participate in the recruitment exercise, this information may be shared with the interview panel and assessors to put your adjustment into practice. In these instances, we will process your personal data to ensure equality of opportunity and treatment.

Diversity and other data will be shared with the Commissioner of Public Appointments (OCPA) for the exercise of their statutory functions. This may include age, gender, ethnicity, sexual orientation, recorded disability, faith and geographical location, Welsh language, principal employment sector, number of government public appointments held, declarable political activity, and any other such information. Your name will not normally be included in the information that is collected and shared with OCPA, unless relating to appointments including but not limited to direct appointments, extensions, third terms. You can see how OCPA handles personal data shared with it in its privacy notice.

Diversity and other information (including CVs, personal statements, conflict of interest, political activity) may be shared with Welsh Parliament / Senedd Cymru, as needed, for the exercise of their scrutiny functions and may be published on their webpages. This includes to monitor the effectiveness of our outreach and recruitment activities, ensure that our employment practices are fair, transparent and promote equality, track progress over time as we work to make boards more inclusive and representative, and to facilitate scrutiny on the appropriateness of candidates for certain key Chair roles. Whilst we rely on the lawful basis of public task (as above) to share your diversity and other information with the Senedd, we rely on your consent as a lawful basis to share your name and contact information where the role is subject to a pre-appointment hearing.

As your personal data will be stored on our IT infrastructure it will also be shared with our data processors who provide email, and document management and storage services.

5. Retention

The information you provide will be kept for as long as is needed for the public appointments process

• Your personal data will be shared with service providers who process it on our behalf, such as our recruitment system vendor. They are required to keep your data secure and only use it as we instruct.
• If your application is unsuccessful, we will usually keep your data for up to 2 years after the recruitment process ends.
• If you are successful, your data will be held for the duration of your appointment plus 2 years. It will be held in line with our data retention policy.

If you are the successful candidate, your letter of appointment (and any subsequent re-appointments) will be retained permanently as part of the public record.

6. International transfers

As your personal data will be stored on our IT infrastructure, and shared with our data processors, it may be transferred and stored securely outside the UK. Where that is the case it will be subject to equivalent legal protection through an adequacy decision, Standard Contractual Clauses or a UK international Data Transfer Agreement.

7. Your rights

You have the right to request information about how your personal data are processed, and to request a copy of that personal data.

You have the right to request that any inaccuracies in your personal data are rectified without delay.

You have the right to request that any incomplete personal data are completed, including by means of a supplementary statement.

You have the right to request that your personal data are erased if there is no longer a justification for them to be processed.

You have the right in certain circumstances (for example, where accuracy is contested) to request that the processing of your personal data is restricted.

You may have the right to request a copy of any personal data you have provided, and for this to be provided in a structured, commonly used and machine-readable format.

You have the right to object to the processing of your personal data.

8. Complaints

If you consider that your personal data has been misused or mishandled, you may make a complaint to the Information Commissioner, who is an independent regulator. The Information Commissioner can be contacted at:

Any complaint to the Information Commissioner is without prejudice to your right to seek redress through the courts.

9. Contact details

The data controller for your personal data is the Welsh Government.

In relation to equality and diversity data, the Welsh Government and the Office for the Commissioner of Public Appointments are joint data controllers. The contact details for the Welsh Government Data Protection Officer (DPO) are:

The Data Protection Officer provides independent advice and monitoring of the Welsh Government’s use of personal information.