Data protection: UK & EU GDPR
Recruitment information deserves careful handling. This page explains the controls present in the local Bridge & Talent site and the business decisions still required. It is not a certification of compliance.
The Nottingham context
The business must review its obligations under applicable UK data-protection law. EU GDPR may also be relevant depending on its activities and the people concerned. The applicable scope should be assessed before public recruitment begins.
Controls implemented on the site
- Separate candidate and employer accounts with restricted capabilities.
- CV storage outside the public web folder and authenticated download checks.
- Application access tied to the candidate, the vacancy’s employer and authorised administrators.
- Private enquiry records and no public application or CV listing.
- Form security checks, file-format and size validation, and login-attempt limits.
Principles for the operating business
Personal information needs a defined, lawful purpose and clear explanations. Collect only relevant information, keep it accurate, protect it and retain it only for justified periods. Responsibility includes being able to demonstrate how those choices are made. These operating duties extend beyond the website’s code.
Decisions required before launch
- Identify the controller, privacy contact and responsibilities of employers receiving applications.
- Document lawful bases, any sensitive-data conditions and the information supplied to applicants.
- Approve retention and deletion arrangements for active records, old CV snapshots, logs and backups.
- Confirm hosting, email and other providers, contracts and any international-transfer safeguards.
- Establish procedures for rights requests, security incidents and staff access reviews.
Human decisions and representative imagery
The job board does not automatically rank or reject candidates. Employer and team users review applications. AI-generated site imagery is illustrative and is not used to evaluate applicants or presented as verified staff or client identities.
Make a privacy request
Use the contact form for a request or concern, without including passwords or unnecessary sensitive documents. The privacy notice explains the actual data collected and current limitations.
Apply data protection to the recruitment journey
Each stage should have a clear purpose for the information it uses. A vacancy brief should focus on the work. A candidate profile should include relevant experience and contact information. An application should be shared only with people who need it for the recruitment process.
- Collect thoughtfully: avoid asking for details merely because a form could hold them.
- Limit access: check who needs to review applications and documents.
- Keep records understandable: distinguish the profile, submitted application and enquiry.
- Plan retention: agree a documented schedule before public operation; this draft does not invent one.
Questions to resolve before launch
The business needs to confirm its identity, privacy contact, purposes and lawful bases, processor arrangements and retention decisions. Hosting and email handling must be reviewed when those services are chosen. Where a processing activity needs specialist legal advice or additional assessment, that work must be completed for the actual circumstances.
Primary guidance
Review the ICO’s UK GDPR guidance and the European Commission’s GDPR principles alongside the business’s specific activities.