Human Resources (employment) - Privacy Notice

This Privacy Notice is designed to help you understand how and why the Human Resource Team at Selby District Council processes your personal data. This notice should be read in conjunction with the Council’s Corporate Privacy Notice.


As part of our recruitment process, Human Resources, on behalf of Selby District Council, collect and process personal data relating to job applicants. Selby District Council is committed to being transparent about how it collects and uses that data and to meeting its data protection obligations.

Who are we?

Selby District Council is a ‘Data Controller’ as defined by Article 4(7) of the UK General Data Protection Regulation (UK GDPR). 

Human Resources are responsible for all aspects of the employment contract across four key areas of Employee Resourcing, Employee Relations, Employee Development and Organisational Development.

The Council has appointed Veritau Ltd to be its Data Protection Officer. Their contact details are: Data Protection Officer, Veritau, West Offices, Station Rise, York, YO1 6GA,, telephone 01904 552848.

What personal information do we collect?

Throughout your employment, we will collect the following personal data. This information includes, but is not limited to:

•    Personal identifiers (your name, address, date of birth etc)
•    Contact Information (email address and phone number)
•    National Insurance Number
•    Previous job experience and qualifications (including copies of certificates and employment references)
•    Information about your employment attendance, and performance (including disciplinary information)
•    Information about your right to work 
•    Emergency contact information of those individuals you identify
•    Financial information, including bank account information, tax, and pension contributions to facilitate salary payments 

We also collect the following sensitive/ special category data:
•    Information about your ethnicity, religious beliefs, and trade union membership (for the purposes of equality monitoring) 
•    Relevant medical information which affects your employment – Beechtree Surgery (the Council’s occupational health provider) retain medical referral information
•    Criminal Convictions

Why do we collect your personal information? 

We process your information to fulfil our obligations associated with your employment contract, this includes but is not limited to the following purposes:
•    To manage the recruitment process and conduct pre-employment checks required to begin your employment with the Council
•    To maintain employee records throughout your employment e.g. training records
•    To be able to contact you throughout your employment
•    To record and monitor leave and absence taken during your employment
•    To monitor your work performance and conduct e.g. disciplinary
•    To manage grievances in relation to your employment 
•    To manage council payroll 
•    To meet our health and safety obligations e.g., Occupational health to assess working capacity 
•    To process a termination of your contract 

Who do we obtain your information from?

During the recruitment process, we obtain most of your information directly from yourself via jobs applications, interviews and forms you fill out. Once employed, we collect information from you during your work. 

We may collect information from external third parties, these include:

•    Contacts you provide as references for example, your previous employer(s)
•    Beechtree Surgery - our Occupational Health provider
•    EmploymentCheck - the Council’s Disclosure and Barring service

Who do we share this information with?

Throughout your employment, we may share your information internally, with the following areas of the Council:

•    Finance
•    Legal

Externally to the Council, we may share your personal data with the following parties:

•    HMRC
•    Department of Work and Pension, if applicable
•    North Yorkshire Pension Fund
•    Any salary sacrifice arrangement you sign up to 
•    Your trade union, if applicable
•    EmploymentCheck in order to conduct criminal record checks, if applicable
•    Prospective future employers, landlords, letting agents, or mortgage brokers where you have asked them to contact the Council to seek a reference  
•    Beechtree Surgery

How long do we keep your information for?

General Employment
P45 is held for six years after leaving the Council.

Personnel file – includes application forms, clearances, contract, letters, sickness documentation - is held for six years after leaving the Council. 
Payroll record is held for six years after leaving – we retain a skeleton record after this time.
Payslip and claims information is held for six years after leaving the Council.
LGPS scheme information is held for 20 years after leaving the Council.
Occupational Health (OH) Information – includes referrals, medical reports etc - is held for six years after leaving the Council or 40 years after leaving the Council if subject to the statutory retention period for medical records.
Training records (includes data held on any Training Admin System) is held for six years after leaving the Council.

Recruitment selection paperwork – successful applicants - this is transferred to personnel file then held for six years after leaving the Council.
DBS clearances (Positive and Negative) are held for six years after leaving the Council.

What is our lawful basis for processing your information?

Selby District Council relies on the following lawful basis to process your personal data:

UK GDPR Article 6(1)(b)- processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract

UK GDPR Article 6(1)(c) – processing is necessary for compliance with a legal obligation to which the controller is subject. 

For the processing of personal data relating to criminal convictions and offences, processing meets Schedule 1, Part 1 of the Data Protection Act 2018 as below:

•    (1) Employment, social security and social protection

When processing special category data, the Council will rely on the following lawful basis:
UK GDPR Article 9(2)(b) - processing is necessary for the purposes of carrying out the obligations and exercising specific rights of the controller or of the data subject in the field of employment and social security and social protection law in so far as it is authorised by law meeting Schedule 1, Part 1 of the Data Protection Act 2018 as below:

•    (1) Employment, social security and social protection

UK GDPR Article 9 (2)(g) – processing is necessary for reasons of substantial public interest with processing meeting Schedule 1, Part 2 of the Data Protection Act 2018 as below:

•    (8) Equality of opportunity or treatment 

In relation to occupational health information the Council will rely on: 

UK GDPR Article (9)(2)(h) - processing is necessary for the purposes of preventive or occupational medicine, for the assessment of the working capacity of the employee medical diagnosis, the provision of health or social care or treatment or the management of health or social care systems and services on the basis of domestic law meeting Schedule 1, Part 1 of the Data Protection Act 2018 as below:

•    (2) Health and Social Care Purposes 

The legislations, policies and guidance that relate to this service includes, but is not limited to:
•    Employment Rights Act 1996 as amended
•    Health and Safety at Work Act 1974
•    Heath Act 2006
•    The Equality Act
•    Misuse of Drugs Act 1971 as amended
•    Part-time workers (prevention of less favourable treatment) regulations 
•    Agency Workers regulations
•    ACAS Code of Practice – Disciplinaries and Grievance
•    Baseline Personnel Security Standard
•    Disclosure and Barring Service

For more information about how the Council uses your data, including your privacy rights and the complaints process, please see our Corporate Privacy Notice.