Privacy notice

Thank you for showing an interest in working for the Scottish Government.

As part of any recruitment or appointment process, the Scottish Government and associated public bodies collects and processes personal data relating to job applicants and applicants for public appointments.

This privacy notice explains how we collect, use and store your personal information in the context of applying for employment or a public appointment and for use in our recruitment processes.  It also sets out the situations where we may share your personal data. The privacy notice also explains your rights and how to contact us.

We may collect, process and store different personal data from you depending on what stage you are at in the recruitment process and whether you are applying for employment or you are applying for a public appointment. Below we have listed what personal data you may provide us during the recruitment or appointment process. As mentioned above you will not have to supply all this information at the application stage, but as part of joining the Scottish Government or taking up a public appointment, our pre-employment check process will require this information.

The personal data we may collect from you at application stage includes:

• contact details such as name, title, addresses, telephone numbers, and personal email addresses
• evidence of how you meet the requirements of the role, including CVs and references
• diversity monitoring information and diversity data for legal compliance (i.e. information on age, sex, trans status, marital status, sexual orientation, disability, national identity, ethnicity, religion, socio-economic background and caring responsibility), and specifically for Public Appointments, biological sex as registered at birth for the specific purpose set out below.

If you are successful for the role or public appointment you are applying for we may collect:

• evidence of how you meet the Civil Service nationality rules and confirmation of your security clearance – this can include nationality details and information about any convictions, allegations and offences as part of Baseline Personnel Security Standard checks
• evidence of your right to work in the UK and immigration status
• updated diversity and equal opportunities monitoring information
• information about your health, including any medical needs or conditions
• other information required for some applications, for example verification of qualifications
• copies of driving licence, passport, birth certificates and proof of current address, such as bank statements and council tax bills
• information regarding outside interests. This will include any paid outside occupation or work that will be undertaken in addition to your position as a civil servant. It will also include any other outside interests that you, a close family member or friend currently holds that may conflict with or restrict your ability to carry out your duties as a civil servant.

If you contact us regarding your application at any point we will record that correspondence.

In addition to collecting personal data from applicants to public appointments, the Scottish Government may also collect data about an individual’s biological sex as registered at birth from individuals who are already serving as members of public boards.

This applies only to boards that fall within the scope of the Gender Representation on Public Boards (Scotland) Act 2018, which sets out which public authorities and boards are covered.

We collect this information from Board Members and applicants for two purposes:

• To comply with statutory duties under the 2018 Act, including enabling Ministers to determine whether the gender representation objective has been met and to fulfil statutory reporting obligations.

• To support equality and diversity monitoring across the public appointments system, ensuring board membership reflects the diversity of the people of Scotland.

Providing this information is voluntary. Respondents may select “prefer not to say”. Where data is provided, it will be handled securely, used only for the purposes set out above, and retained in line with statutory requirements and the Scottish Government’s corporate retention schedules.

Data on sex is collected in several ways, for different purposes. The collections and purposes outlined below adhere to current guidance. The Scottish Government’s Office of the Chief Statistician is currently considering the implications of the UK Supreme Court judgment on sex, and are already committed to reviewing guidance by the end of 2026 as part of the non-binary equality action plan. A small number of professional analysts, resourcing and public appointment officials have access to only the data they need, in order to fulfil the purposes of collecting it. Great care will be taken to ensure that no disclosive information is accessed or reported.

• Upon application to work in the Scottish Government, those who are provided with a record on our Oracle HR system, individuals have the opportunity to provide and update data on their sex and trans status as part of a diversity monitoring form on our Oracle recruitment and HR system. Individuals can self-report on their sex however they wish to be identified, including the option to ‘prefer not to say’ or provide no response.

• Data on sex is collected in a mandatory way for those paid by the Scottish Government, to create a payroll account, linked to HM Revenue & Customs records, when an individual becomes an employee in the organisation. This is not self-reported, rather it is taken from legal documents provided during the security checks stage of onboarding. This information is stored on our Oracle HR system and cannot be changed in a self-service way.

• Data on biological sex as registered at birth is collected for Public Appointment applicants and board members only, for compliance with duties outlined in the Gender Representation on Public Boards (Scotland) Act 2018 and have the option to ‘prefer not to say’ or provide no response.

1. Our lawful basis for using your data

When you apply for a role or Public Appointment with the Scottish Government we process your data under a number of lawful bases (Article 6):

Standard personal data:

• Contractual: it is necessary for the performance of a contract to which you are a party – an employment contract. This relates to information that we need to recruit and employ you.

• Contractual: it is necessary in order to take steps at your request prior to entering into a contract for employment. This relates to information that we collect as part of the application and selection process.

• Legal obligation: it is necessary to comply with a legal obligation placed on us as the data controller – we are required to report on equality of opportunity; and onboarding processes have specific requirements

• Public task: processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the data controller. In this case, Oracle Cloud facilitates recruitment of high-quality candidates to roles and appointments across government departments, agencies and other public bodies. It provides recruitment tools and processes that support Civil Service recruitment strategy, and we also monitor the effectiveness of recruitment and appointment processes through diversity monitoring.

• Public task: processing is necessary for compliance with duties under the Gender Representation on Public Boards (Scotland) Act 2018.

• Consent: for the digital right to work checks, personnel checks, work history checks, and participation in user research interviews we rely on your consent.

Sensitive personal data (Article 9) is personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, and the processing of genetic data, biometric data for the purpose of uniquely identifying a natural person, data concerning health or data concerning a natural person’s sex life or sexual orientation.

The legal basis for processing your sensitive personal data is:

• it is necessary for reasons of substantial public interest for the exercise of a function of the Crown, a Minister of the Crown, or a government department; the exercise of a function conferred on a person by an enactment; the exercise of a function of either the Scottish Government; or the administration of justice; and an appropriate policy document is in place. Oracle Cloud facilitates recruitment of high-quality candidates to roles across government departments, agencies and other public bodies. It provides recruitment tools and processes that support Civil Service recruitment strategy.

• it is necessary for the purposes of performing or exercising our obligations or rights as the controller, or your obligations or rights as the data subject, under employment law, social security law or the law relating to social protection. External recruitment is required to follow the Civil Service Commission Recruitment Principles. Personal data is processed to ensure that these requirements are met. We are required under the Equality Act 2010 to make appropriate reasonable adjustments for candidates with a disability.

• processing is of a specific category of personal data and it is necessary for the purposes of identifying or keeping under review the existence or absence of equality of opportunity or treatment between groups of people specified (in paragraph 8(2) of Part 2 of Schedule 1 to the Data Protection Act 2018) in relation to that category with a view to enabling such equality to be promoted or maintained; and it is not carried out for the purposes of measures or decisions with respect to a particular data subject; and you have not declined consent; and you have not given notice that you do not wish your data to be processed for these purposes; and the processing is not likely to cause substantial damage or substantial distress to an individual. Diversity and inclusion data is used anonymously: ethnicity, religion and sexual orientation.

• it is necessary for archiving purposes, scientific or historical research purposes or statistical purposes, and it is in the public interest. Analysis of applications and recruitment outcomes (including online tests), impact on protected groups, timescales for recruitment, and other research may be carried out.

• for the provision of a digital route for carrying out Right to Work checks, the legal basis for providing a digital version of your face and identity documents, is because you explicitly consent.

• for user research activities such as surveys, interviews or workshops, the legal basis is because you explicitly consent.

• It is necessary for reasons of substantial public interest in connection with statutory obligations under the Gender Representation on Public Boards (Scotland) Act 2018.

The processing by us of personal data relating to criminal convictions (Article 10) and offences or related security measures is not carried out under official authority, but is authorised because it meets the following condition:

• it is necessary for reasons of substantial public interest. This is ensuring that individuals with access to official information and assets will meet the required standards of propriety.

2. Why we need your data

We collect personal data to enable recruitment and public appointment processes to be conducted fairly, openly, and lawfully. This includes:

• Enabling the Scottish Government to recruit staff in accordance with the Civil Service Commission Recruitment Principles.

• Enabling Ministers to make lawful appointment recommendations under the Code of Practice for Ministerial Appointments to Public Bodies in Scotland.

• Complying with statutory obligations under the Gender Representation on Public Boards (Scotland) Act 2018, including collection and reporting of biological sex as registered at birth data and operation of tie-break provisions.

• Supporting wider equality and diversity monitoring across both resourcing and public appointments, to assess whether recruitment and appointment processes are inclusive and representative of the people of Scotland.

• get in contact with you

3. How your personal information is collected

We usually collect your personal information when you enter it in Oracle. For certain roles or appointments, we might also collect information from third parties about you.

These include:

• former employers and people named by candidates as references

• Disclosure Scotland

• third parties relating to conflict of interest reasons.

4. Employment reserve lists

We maintain a reserve list of candidates who met our requirements but were not successful in securing the specific post they applied for. We’ll ask for your consent to be added to this list. We will refer to the list when other roles are advertised and will contact you if you match the role. We will ask for your consent before moving you forward for the role. Your data will be kept for as long as you are on a reserve list, this could be up to one year. If the role you are applying for requires certain conflict of interest responses to be given, these may be asked for again to ensure we have the most up to date information.

5. Recipients of data

Personal information you provide in the recruitment process will be made available to Scottish Government HR staff who need the information to administer the recruitment process and, if successful, carry out the processes necessary to onboard you to your new role or Public Appointment. These HR staff work in our Resourcing, Onboarding, Payroll, IT and Security teams. There will be certain roles and appointments which require your data to be shared with our additional data processors. These additional data processors can vary depending on which role you apply for. For certain roles, should you be successful in obtaining an interview and assessment, your information may be shared with our assessment providers The Keil Centre or SHL. If you are an external candidate and are not currently a Civil Servant, your information may be shared with Access, who will carry out your pre-employment checks on our behalf. You will always be notified before we do either of these actions. The following information will be shared with our additional data processors depending on their role:

• contact details such as name, title, addresses, telephone numbers, and personal email addresses

• copies of driving licence, passport, birth certificates and proof of current address, such as bank statements and council tax bills

• evidence of how you meet the requirements of the role, including CVs and references

• evidence of how you meet the Civil Service nationality rules and confirmation of your security clearance – this can include nationality details and information about any convictions, allegations and offences as part of Baseline Personnel Security Standard checks

• evidence of your right to work in the UK and immigration status

• other information required for some applications, for example verification of qualifications

• if you contact us regarding your application, a record of that correspondence

• details of your use of our recruitment tools and services, such as your candidate profile and alerts for vacancies

• the status of your application and updates on how it moves forward

Data regarding an applicant’s biological sex as registered at birth will be accessed by authorised Resourcing and Public Appointments officials, and a small number of professional analysts. It will be used for the purpose of assessing board composition, applying statutory tie-break provisions, diversity monitoring and supporting annual statutory reporting under the 2018 Act.

If you are successfully recruited for employment, we will upload your details to our HR system.

Employees will sign a terms and conditions of employment and agree to additional terms on how your data is handled and stored.

We will also share data relating to the recruitment or appointment process for Freedom of Information purposes or other instances where we are required to share by for example, for public interest, by court order, or to prevent fraud or other crime.

Where Scottish Government is managing the recruitment of employees or of public appointees on behalf of a public body or, we will share your information with that public body.

6. Data security

We have put in place measures to protect the security of your information.

Third parties will only process your personal information on our instructions and where they have agreed to treat the information confidentially and to keep it secure.

We have put in place appropriate security measures to prevent your personal information from being accidentally lost, used or accessed in an unauthorised way, altered or disclosed. In addition, we only give access to your personal information to those HR staff from the teams listed previously in section six of this notice.

We have put in place procedures to deal with any suspected data security breach and will notify you and any applicable regulator of a suspected breach where we are legally required to do so.

7. Data retention

We will only retain your personal information for as long as necessary to fulfil the purposes we collected it for – including legal, accounting, or reporting requirements.

This will depend on:

• the amount, nature, and sensitivity of the personal data
• the potential risk of harm from unauthorised use or disclosure of your personal data
• the purposes for which we process it
• whether we can achieve those purposes in other ways

For recruitment to employment the retention period for documents supporting recruitment, application and sifting is 2 years.

For recruitment to public appointments the retention period for documents supporting the public appointments process is 5 years. If the appointee is reappointed, data will be kept for up to 2 years after the final term has ended. Data regarding an applicant or Board Member’s biological sex as registered at birth will be retained for the purposes of statutory compliance and reporting under the Gender Representation on Public Boards (Scotland) Act 2018 and general monitoring.

If you are unsuccessful, personally identifiable data is removed 2 years after your most recent application.  You can request the deletion of your personal information by contacting us at ScottishGovernmentrecruitment@gov.scot. 

8. Your rights

You have the right to:

• request access to your personal information (known as a ‘data subject access request’) – you’ll receive a copy of the personal information we hold about you, so you can check that we are lawfully processing it. It also allows you to request an electronic copy of any data you have provided in a structured, commonly used and machine-readable format

• request that we correct incomplete or inaccurate personal information that we hold about you

• request we delete your online profile which will remove all your personal information that we hold.

• withdraw your consent for any data processed under the lawful basis of consent (see below)

• object to the processing of your personal information

• request we restrict the processing of your personal information – you can ask us to stop processing your personal information, for example if you want us to establish its accuracy or the reason for processing it

• You have the right to choose “prefer not to say”, or not respond when asked to provide your biological sex as registered at birth data. This will not affect your application. However, it may limit the ability to apply positive action measures under the 2018 Act.

To make any of these requests or to ask us to transfer a copy of your personal information to another party, contact the Scottish Government Resourcing team at ScottishGovernmentrecruitment@gov.scot. Please note that these rights are not absolute and will be processed on a case by case basis.

9. Accessing your data

You will not have to pay a fee to access your personal information or to exercise any of the other rights. However, if your request for access is clearly unfounded or excessive we may refuse the request.

In some cases we will need some information to confirm your identity. This is to ensure that your personal information is not disclosed to someone who has no right to access it.

10. Questions and complaints

If you have concerns about the way we process and handle your personal information, in the first instance you should raise your concerns to the People Directorate:

Resourcing Team, People Directorate
Scottish Government
Saughton House
Broomhouse Drive
Edinburgh
EH11 3XD

If you are not satisfied with the response, you can escalate to Scottish Government Data Protection Officer by email to DataProtectionOfficer@gov.scot

If you are not satisfied with the response or believe we are not processing your personal data in accordance with the law you may make a complaint to the Information Commissioner’s Office (ICO):

Information Commissioner’s Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF

11. Changes to this privacy notice

We may change this privacy notice. When we make changes to this notice, the ‘last updated’ date at the top of this page will also change. Any changes to this privacy notice will apply to you and your data immediately. If these changes affect how your personal data is processed, we will take reasonable steps to let you know.