NS&I Prospective Employee Privacy Notice

NS&I is a "data controller". This means that we are responsible for deciding how we hold and use personal information about you. We are required under data protection legislation to notify you of the information contained in this privacy notice.

This notice applies to you because you are applying for work with us (whether as an employee, worker or contractor). This notice does not form part of any contract of employment or other contract to provide services, which may be issued. This notice can be updated at any time and will be published on the intranet and available on request from HR.

It is important that you read this notice, together with any other documentation that is provided on specific occasions when we are collecting or processing personal information about you, so that you are aware of how and why we are using such information.

Data protection principles

The kind of information we hold about you

In connection with your application for work with us, we will collect, store, and use the following categories of personal information about you:

• The information you have provided to us in your application form, curriculum vitae and covering letter including personal contact details such as name, title, addresses, telephone numbers, and personal email addresses, employment history and qualifications
• Date of birth
• Any information you have provided to us during interview
• Copy of driving licence, passport, birth and marriage certificates, decree absolute
• Recruitment information (including copies of right to work documentation, references and other information included in a CV or cover letter or as part of the application process)
• Full employment records for Civil Service employment (including contract, terms and conditions, job titles, work history, working hours, promotion, absences, attendances, training records and professional memberships)
• Secondary employment and volunteering information
• Evidence of how you meet the Civil Service nationality rules and confirmation of your security clearance. This can include passport details, nationality details and information about convictions/allegations of criminal behaviour
• Evidence of your right to work in the UK / immigration status

We may also collect, store and use the following "special categories" of more sensitive personal information:

• Information about your gender, race or ethnicity, religious beliefs, sexual orientation and political opinions for monitoring purposes
• Information about your health, including any medical condition, health and sickness records
• Information about criminal convictions/allegations and offences
• Financial check information
• If you are a trade union member and pay your subscriptions from your salary then this information is stored but is not further processed

How is your personal information collected?

We typically collect personal information about applicants through the application and recruitment process, either directly from candidates or sometimes from an employment agency or background check provider. We will sometimes collect additional information from third parties including former employers, credit reference agencies or other background check agencies, including a criminal record check and financial record check.  For some roles an enhanced security check is also required and you will be required to complete a separate consent form prior to any enhanced security checks taking place.  If you are transferring between Civil Service Departments we will also collect or pass on information to the other Department.

How we will use information about you

Situations in which we will use your personal information

We need all the categories of information in the list above (see: The kind of information we hold about you) in deciding whether to appoint you. We also need to process your personal information to decide whether to enter into a contract of employment with you; to enable us to comply with legal obligations, to carry out our functions as a government department/functions of the Crown; or where it is necessary to do so in the public interest. 

The situations in which we will process your personal information are listed below:

• Making a decision about your recruitment or appointment
• Determining the terms on which you work for us
• Checking you are legally entitled to work in the UK and to provide you with the security clearance appropriate for your role. For Civil Servants, to check eligibility to become and remain a Civil Servant
• Liaising with your pension provider, providing information about changes to your employment such as promotions, changing in working hours
• Assessing qualifications for a particular job, including decisions about promotions
• Ascertaining your fitness to work
• Complying with health and safety obligations
• Equal opportunities monitoring

Some of the purposes will overlap and there can be several grounds which justify our use of your personal information.

Having received your application form, CV or covering letter, we will then process that information to decide whether you meet the basic requirements to be shortlisted for the role. If you do, we will decide whether your application is strong enough to invite you for an interview.

If we decide to call you for an interview, we will use the information you provide to us at the interview and any other supporting information e.g. test, presentation etc. to decide whether to offer you role.

If we decide to offer you the role we will then take up references and carry out a criminal record and a financial record check before confirming your appointment.  For some roles it may also be necessary for you to have an enhanced level of security clearance and this will also be required before confirming your appointment.

If you fail to provide personal information

If you fail to provide certain information when requested, which is necessary for us to consider your application (such as evidence of work history or qualifications), we will not be able to process your application successfully, or we could be prevented from complying with our legal obligations (such as statutory rules governing civil service recruitment).

Change of purpose

We will only use your personal information for the purposes for which we collected it, unless we reasonably consider that we need to use it for another reason and that reason is compatible with the original purpose. If we need to use your personal information for an unrelated or new purpose, we will notify you and we will explain the legal basis which allows us to do so.

Please note that we may process your personal information without your knowledge or consent, in compliance with the above rules, where this is required or permitted by law.

How we use special category data

Our obligations as an employer

We will use your special category data in the following ways:

• We will use information about your physical or mental health, or disability status, to ensure your health and safety in the workplace and to assess your fitness to work, to provide appropriate adjustments during the recruitment process, for example whether adjustments need to be made, e.g. during a test or interview
• We will use information about your race or national or ethnic origin, religious, philosophical or moral beliefs, or your sexual life or sexual orientation, to ensure meaningful equal opportunity monitoring and reporting

Do we need your consent?

We do not need your consent if we use special categories of your personal information in accordance with our written policy to carry out our legal obligations, or for one of the other reasons outlined in the box above: ‘How we use special category data’. In limited circumstances, if the need arises, we will approach you for your written consent to allow us to process certain specific special category data. If we do so, we will provide you with full details of the information that we would like and the reason we need it, so that you can carefully consider whether you wish to consent. You should be aware that it is not a condition of any subsequent contract with us that you agree to any request for consent from us.

Information about criminal convictions

We will only collect information about criminal convictions or allegations of criminal behaviour where it is appropriate given the nature of the role and where we are legally able to do so. Where appropriate, we will collect information about criminal convictions/allegations as part of the recruitment process or if we are notified of such information directly by you in the course of the recruitment process. We will use information about criminal convictions/allegations and offences and your financial check information in line with NS&I’s Security Vetting Policy.

We are allowed to use your personal information in this way where it is in line with our data protection policy and where one of the following reasons arises:

• Where we need to carry out our legal obligations or exercise our employment-related legal rights, e.g. to comply with HM Government’s Baseline Personal Security Standard checks or any form of enhanced security vetting. If enhanced security vetting is required, this is undertaken by the Cluster Security Unit on our behalf and you will be requested to complete a separate application which will highlight the process involved.  This form will also include a section which outlines how your sensitive personal data will be handled in a separate privacy notice.
• Where it is substantially in the public interest to do so and necessary for performing our functions as a Government Department or a function of the Crown

Automated decision-making

Data sharing

Why might we share your personal information with third parties?

We will share your personal information with third parties where required by law, where it is necessary to administer the working relationship with you; where it is in the public interest to do so or where it is necessary for the purposes of processing your application, the performance of our functions as a Government Department or a function of the Crown.  This will, in some circumstances, involve sharing special categories of personal data and, where relevant, data about criminal convictions/allegations.  

Which third-party service providers process my personal information?

"Third parties" includes third-party service providers (including contractors and designated agents) and other entities within the Civil Service. The following activities are carried out by third-party service providers: payroll, pension administration, benefits provision and administration, IT services, security vetting. The following third-party service providers process personal information about you for the following purposes:

• third parties including former employers e.g. for references
• other Civil Service Departments, e.g. HM Treasury for Senior Manager Regime information, the Cabinet Office for data returns and the Office for National Statistics. If an employee moves between Civil Service Departments we will also share data between Departments
• the UK Security Vetting Service to enable enhanced security vetting checks to take place; these are processed by the Cluster Security Unit on behalf of NS&I following your consent
• credit reference agencies to undertake financial checks
• other background criminal record checking agencies
• Civil Service Pensions for pensions information
• Atos for information on our IT systems or as our landlord
• our occupational health provider to assist in organising occupational health assessments and risk assessments
• professional advisers, e.g. lawyers and tax advisers for specific advice
• our landlords for CCTV and access information

How secure is my information with third-party service providers?

All our third-party service providers are required to take appropriate security measures to protect your personal information in line with our policies. We do not allow our third-party service providers to use your personal data for their own purposes. We only permit them to process your personal data for specified purposes and in accordance with our instructions.

When might you share my personal information with other organisations within the Civil Service?

We will share your personal information with other Civil Service organisations as part of our regular reporting activities on departmental performance, in the context of a business reorganisation or restructuring exercise, for system maintenance support and hosting of data; business planning/talent management initiatives, succession planning, statistical analysis; and general management and functioning of the Civil Service.  Personal data is also shared with the Office for National Statistics, mainly for statistical purposes.

Data may also be shared with HM Treasury relating to NS&I’s Senior Manager Regime and the Cabinet Office for Senior Civil Service data and other statistical returns, e.g. apprenticeship information.  If an employee transfers into or out of NS&I to another Government Department, we may also share data with the other Department.

What about other third parties?

If required, we will need to share your personal information with a regulator or to otherwise comply with the law.

International data transfers

Data security

We have put in place appropriate security measures to prevent your personal information from being accidentally lost, used or accessed in an unauthorised way, altered or disclosed. In addition, we limit access to your personal information to those employees, agents, contractors and other third parties who have a business need to know. They will only process your personal information on our instructions. Details of these measures can be obtained from the HR Team.

We have put in place procedures to deal with any suspected data security breach and will notify you and any applicable regulator of a suspected breach where we are legally required to do so.

Data retention

How long will you use my information for?

We will only retain your personal information for as long as necessary to fulfil the purposes we collected it for, including for the purposes of satisfying any legal, accounting, or reporting requirements. Details of retention periods for different aspects of your personal information are available in our retention policy which is available from the NS&I HR Team.  To determine the appropriate retention period for personal data, we consider the amount, nature, and sensitivity of the personal data, the potential risk of harm from unauthorised use or disclosure of your personal data, the purposes for which we process your personal data and whether we can achieve those purposes through other means, and the applicable legal requirements.

We will keep applications for two years and if you are unsuccessful at interview, NS&I will securely shred all personal information provided at interview within three months.

In some circumstances we will anonymise your personal information so that it can no longer be associated with you, in which case we will use such information without further notice to you. Once you are no longer an employee, worker or contractor of the company we will retain and securely destroy your personal information in accordance with the HR data mapping grid.

Rights of access, correction, erasure, and restriction

Your duty to inform us of changes

It is important that the personal information we hold about you is accurate and current. Please keep us informed if your personal information changes during your working relationship with us.

Your rights in connection with personal information

Under certain circumstances, by law you have the right to:

• Request access to your personal information (commonly known as a "data subject access request"). This enables you to receive a copy of the personal information we hold about you and to check that we are lawfully processing it. If you wish to make a data subject access request for your personal information, please use the DSAR form from NS&I’s website. Please note that as part of this process, we may require evidence of your identity along with an address where we can send securely your response.
• Request correction of the personal information that we hold about you. This enables you to have any incomplete or inaccurate information we hold about you corrected.
• Request erasure of your personal information. This enables you to ask us to delete or remove personal information where there is no good reason for us continuing to process it. You also have the right to ask us to delete or remove your personal information where you have exercised your right to object to processing (see below).
• Object to processing of your personal information where we are relying on a legitimate interest (or those of a third party) and there is something about your particular situation which makes you want to object to processing on this ground. You also have the right to object where we are processing your personal information for direct marketing purposes.
• Request the restriction of processing of your personal information. This enables you to ask us to suspend the processing of personal information about you, for example if you want us to establish its accuracy or the reason for processing it.
• Data protection complaints If you are unhappy about the way we have used your information, or responded to your data subject rights request, please contact HR first, and we will do our best to put things right for you. If you’re not satisfied with our response, you can ask us to undertake an internal review of your complaint. If you remain unhappy with the outcome, you can refer your complaint to the Information Commissioner’s Office (ICO) – see below for their contact details.
• Additional rights You also have the right to a judicial review where you consider that your rights under data protection legislation have been infringed, or as a result of us processing your personal data in non-compliance with the legislation. Where you have suffered material or non-material damage as a result of an infringement of the data protection legislation, you have the right to seek compensation from us for the damage suffered.  Additionally, you have the right to representation, to mandate a not-for-profit body, organisation or association to lodge a complaint with NS&I, or with the ICO, to seek a judicial review and receive compensation on your behalf where allowed for by the Data Protection Act 2018.

If you want to review, verify, correct or request erasure of your personal information or object to the processing of your personal data, please contact hr@nsandi.com.

No fee usually required

You will not have to pay a fee to access your personal information (or to exercise any of the other rights). However, we are allowed under the law to charge a reasonable fee if your request for access is clearly unfounded or excessive. Alternatively, we can refuse to comply with the request in such circumstances.

What we need from you

We sometimes need to request specific information from you to help us confirm your identity and ensure your right to access the information (or to exercise any of your other rights). This is another appropriate security measure to ensure that personal information is not disclosed to any person who has no right to receive it.

Right to withdraw consent

In the limited circumstances where you have provided your consent to the collection, processing of your personal information for a specific purpose, you have the right to withdraw your consent for that specific processing purpose at any time. To withdraw your consent, please contact hr@nsandi.com. Once we have received notification that you have withdrawn your consent, we will no longer process your information for that purpose, unless we have another legitimate basis for doing so in law, and subject to our retention policy, we will dispose of your personal data securely.

Data Protection Officer

We have appointed a data protection officer (DPO) to oversee compliance with this privacy notice. If you have any questions about this privacy notice or how we handle your personal information, please contact the DPO:

The Data Protection Officer 
NS&I 
Riverside House 
2a Southwark Bridge Road 
London 
SE1 9HA

The Information Commissioner's Office (ICO), is the UK supervisory authority for data protection issues.

The Information Commissioner's Office 
Wycliffe House 
Water Lane 
Wilmslow 
Cheshire 
SK9 5AF 
Phone: 0303 123 1113

https://ico.org.uk/global/contact-us/