This privacy notice covers the use of MHRA recruitment platform, Taleo Recruit, and sets out how we handle your personal data when you apply for a job.

The data we collect

The personal data we may collect from you includes:

  • contact details such as name, title, addresses, telephone numbers, and personal email addresses
  • copies of driving license, passport, birth certificates and proof of current address, such as bank statements and council tax bills
  • evidence of how you meet the requirements of the job, including CVs and references
  • evidence of how you meet the Civil Service nationality rules and confirmation of your security clearance – this can include nationality details and information about convictions, allegations and offences as part of Baseline Personnel Security Standard checks
  • evidence of your right to work in the UK and immigration status
  • diversity and equal opportunities monitoring information – this can include information about your race or ethnicity, religious beliefs, sexual orientation, disability and other ‘special category data’
  • information about your health, including any medical needs or conditions
  • other information required for some applications
  • if you contact us regarding your application, a record of that correspondence
  • details of your use of our recruitment tools and services, such as your candidate profile and alerts for vacancies
  • the status of your application and updates on how it moves forward

Our legal basis for using your data

We process personal data throughout the application on different legal bases.

Contract Processing your data is necessary to move your application forward before signing a contract of work. This concerns employment or pre-employment checks.

Legal obligation the law requires that candidates are entitled to work in the UK.

Public task When we carry out National Security vetting for some roles, we must process personal data to perform a task that’s in the public interest or in the exercise of our official authority.

Processing criminal convictions and sensitive information We collect, use and hold sensitive information such as criminal convictions on the lawful bases of contract, legal obligation and public task.

Processing special category data

Personal data is defined as ‘special category’ when it reveals racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership. It includes: - genetic data - biometric data that uniquely identifies a person - data concerning health - data concerning someone’s sex life or sexual orientation

We process this data when it’s necessary for reasons of substantial public interest for the exercise of our functions. This applies to information about criminal convictions, allegations and offences during baseline security clearance checks.

Why we need your data

We need your data in order to:

  • move your application forward
  • check that you're the right candidate for the role
  • get in contact with you
  • send you notifications for vacancy roles or job alerts

How your personal information is collected

We usually collect your personal information when you enter it in Taleo Recruit. We might also collect information from third parties.

These include:

  • former employers and people named by candidates as references
  • credit reference agencies
  • the Disclosure and Barring Service (DBS)
  • other background check agencies
  • other government departments

Applications automatically declined

During the application process you'll be asked eligibility questions. You won’t have to disclose sensitive information, and everyone still has an equal opportunity to apply. The system will automatically decline your application if you don't meet the eligibility criteria.

Data security

We have put in place measures to protect the security of your information.

Third parties will only process your personal information on our instructions and where they have agreed to treat the information confidentially and to keep it secure.

We have put in place appropriate security measures to prevent your personal information from being accidentally lost, used or accessed in an unauthorized way, altered or disclosed. In addition, we only give access to your personal information to those employees, agents, contractors and other third parties who need to work on your recruitment process.

We have put in place procedures to deal with any suspected data security breach and will notify you and any applicable regulator of a suspected breach where we are legally required to do so.

Data retention

We will only retain your personal information for as long as necessary to fulfil the purposes we collected it for - including legal, accounting, or reporting requirements.

This will depend on:

  • the amount, nature, and sensitivity of the personal data
  • the potential risk of harm from unauthorized use or disclosure of your personal data
  • the purposes for which we process it
  • whether we can achieve those purposes in other ways

For documents supporting recruitment, application and sifting the retention period is 1 year.

Your rights

You have the right to:

  • request access to your personal information (known as a ‘data subject access request’) - you'll receive a copy of the personal information we hold about you, so you can check that we are lawfully processing it. It also allows you to request an electronic copy of any data you have provided in a structured, commonly used and machine-readable format
  • request that we correct incomplete or inaccurate personal information that we hold about you
  • request we delete or remove your personal information - you can do this when there is no good reason for us to keep it - you can ask us to delete or remove your personal information where you have exercised your right to object to processing (see below)
  • withdraw your consent for any data processed under the lawful basis of consent (see below)
  • object to the processing of your personal information where we are relying on the legal basis that we are carrying out our public task (see legal bases above)
  • request we restrict the processing of your personal information - you can ask us to stop processing your personal information, for example if you want us to establish its accuracy or the reason for processing it

To make any of these requests or to ask us to transfer a copy of your personal information to another party, contact

Accessing your data

You will not have to pay a fee to access your personal information or to exercise any of the other rights. However, if your request for access is clearly unfounded or excessive we may:

  • refuse the request

In some cases we will need some information to confirm your identity. This is to ensure that your personal information is not disclosed to someone who has no right to access it.

Questions and complaints

If you have a complaint, you can also contact the Information Commissioner, who is an independent regulator set up to uphold information rights.

Changes to this privacy notice


We may change this privacy notice. When we make changes to this notice, the ‘last updated’ date at the top of this page will also change. Any changes to this privacy notice will apply to you and your data immediately. If these changes affect how your personal data is processed, we will take reasonable steps to let you know.