Personal data and recruitment

This notice explains how the Financial Conduct Authority (the ‘FCA’, ‘we’, ‘us’ or ‘our’) uses personal data about people who apply for roles with us. The FCA is the controller for this personal data. This means we decide how and why it is used.

If you apply for a contractor or temporary role, through a recruitment partner, that partner may also act as a controller for parts of the recruitment process, for example where it manages your employment relationship or makes its own decisions about your personal data. Where a recruitment partner acts only on our instructions, they will act as our processor.

Some information is needed so we can process your application. If information is optional, we will make this clear. Where we use information for statistics or diversity monitoring, we will use it in a way that protects your privacy.

Our careers page explains how you build your career with us. 

The personal data we collect and use

We collect different types of personal data, depending on the role and the stage of the recruitment process.

• Your full name, date of birth, gender.
• Contact details (such as email address, existing and previous postal addresses, contact numbers).
• Identity and background information, including criminal and credit checks.
• Special category data where relevant, such as health or disability information, or biometric data (such as your facial image) where used to uniquely identify you. We may also collect other equality and demographic information, such as age, sex and gender identity, and racial or ethnic origin, religious or philosophical beliefs, sexual orientation, socio-economic background for equality monitoring and reporting.
• Dependents and next of kin, marital or relationship status, lifestyle and social circumstances, emergency contact information.
• Employment and education history, professional memberships and licenses.

For some roles, we may also collect information for identity checks, background checks, vetting, security clearance or similar checks. This may include:

• Home addresses (existing and previous).
• Driving licence and/or national passport (including employment permit details).
• Credit reference history.
• Any relevant offences and criminal records history (spent convictions).

We may also collect or create information during recruitment, including:

• Any correspondence between you and the FCA.
• Any interview and assessment information, such as notes, scores and interviewer feedback.
• Any information needed to respond to questions, concerns, complaints or related reviews.
• Any information that you voluntarily provide to us during the course of this process.
• Information to help us set up an interview and/or assessment with you such as any reasonable adjustments that you may require.

How we collect this personal data

We collect personal data from you and, where needed, from other sources.

From you

You give us personal data when you apply for a role, contact us, attend interviews or assessments, provide information for checks, or complete onboarding forms. We also create some information during recruitment, such as interview notes, assessment records and recruitment decisions.

If you apply through a recruitment agency or other recruitment partner, they may provide us with information you have supplied to them.

If you accept an offer, we will collect further information to prepare you to start work. This may include contact details, bank details, emergency contact details, and information needed for payroll, benefits, IT access, security and administration. 

Personal data about you from third parties

We may also receive personal data from other organisations where this is needed for recruitment or checks. This may include current or previous employers, education providers, recruitment partners, identity checking providers, credit reference agencies, disclosure and barring bodies, security vetting bodies and right-to-work checking services.

When a role needs Security Check (SC) or Developed Vetting (DV) clearance, we will tell you this at the application stage. For more details see: SC - Guidance Pack for Applicants[1].

This will usually be limited to confirming information you have provided, such as employment history, qualifications, professional memberships, references, identity, right-to-work status, background checks or security vetting information.

Why we use this personal data

We use your personal data to:

• Assess your suitability for a role you have applied for.
• Run the recruitment process, including interviews, assessments and communications with you.
• Carry out identity, right-to-work, background, vetting and security checks where needed.
• Make and manage an offer, including onboarding if your application is successful.
• Respond to questions, concerns, complaints, reviews or investigations linked to recruitment.
• Meet legal, regulatory and FCA policy requirements.
• Improve our recruitment process and future recruitment campaigns.

We also use your personal data for equal opportunities monitoring and diversity and inclusion reporting. If we ask you for this information, it will be optional and we will explain this when we ask for it.

• Use the information for statistical or aggregated reporting purposes.
• Use recruitment feedback to improve future recruitment activity.

Where possible, we use this information in a statistical, grouped or anonymised form so that you cannot be identified.

The lawful basis for us using this personal data

Data protection law requires us to have a lawful basis for processing your personal data. Where we use special category data, such as health or ethnicity information, we also need a separate condition under Article 9 of UK GDPR. Where we use criminal offence data, we will only do so where appropriate safeguards are in place. We have an appropriate policy in place for such use.

The main lawful bases we rely on are:

• Article 6(1)(b): we need to use the information to take steps before entering into an employment contract or engagement, or to carry out that contract once agreed.
• Article 6(1)(c): we need to use the information to comply with the law.
• Article 6(1)(e): we need to use the information for a public task or FCA official function, where this applies.
• Article 6(1)(f): we need to use the information for legitimate interests, such as keeping unsuccessful applicant details for a limited time to manage recruitment and consider future FCA roles. We will only rely on this where your rights do not override our interests.
• Article 6(1)(a): you have given consent, for example if you agree to join a talent pool. You can withdraw consent at any time.

For special category data, we may rely on:

• Article 9(2)(b): we need to use the information for employment law, social security or social protection reasons.
• Article 9(2)(b) and Schedule 1, Part 1, paragraph 1 of the Data Protection Act 2018: we need to use health or disability information, including reasonable adjustments, to meet employment law duties.
• Article 9(2)(b) and Schedule 1, Part 1, paragraph 1 of the Data Protection Act 2018: we need special category data for checks linked to employment law duties.
• Article 9(2)(g) and Schedule 1, Part 2, paragraph 8 of the Data Protection Act 2018: we need to use the information for substantial public interest reasons, such as equality of opportunity or treatment.
• If we use criminal offence data, such as criminal records information, we will only do so where it is needed, proportionate and allowed by law.  

When we share personal data as part of recruitment process

We may share your personal data where needed for recruitment, onboarding, compliance, legal or regulatory reasons. We may share it with:

• Your current and past employers and education institutions, professional bodies.
• Recruitment and hiring partners, including background check companies.
• Other regulatory bodies if the FCA’s regulatory remit(s) are transferred or assumed by another body.
• HMRC for tax purposes.
• The police, regulatory bodies and courts where we must disclose your data to comply with a legal obligation, binding court order or warrant.
• Our legal and financial advisors.

When personal data is transferred outside of the UK or EEA

We may transfer personal data outside the UK or European Economic Area if this is needed for recruitment, legal, regulatory, security or administrative reasons.
If we transfer personal data internationally, we will make sure a lawful transfer route applies. This may be where:

1. The country has been recognised as providing adequate protection for personal data.
2. We have suitable safeguards in place, such as standard contractual clauses or a data transfer agreement.
3. A legal exception applies, for example because the transfer is needed for a contract with you or steps before a contract.
4. You have explicitly agreed to the transfer, where consent is appropriate. 

Data retention

We keep personal data only for as long as we need it. This includes keeping it for recruitment administration, legal and regulatory requirements, and to deal with legal claims. If you are successful and become employed or engaged by the FCA, our retention policy (PDF[2]) explains how long we keep employment-related information.

If your application is unsuccessful, we will keep your details for one year from the date of your application for recruitment administration and to consider you for future FCA roles. If we invite you to join our talent pool and you agree, we will keep your data for up to two years so we can contact you about future opportunities.

Learn about your rights

You can ask us to delete your personal data through our recruitment portal or by making a data subject rights request. We will consider your request under data protection law, including any legal, regulatory, security, recruitment or record-keeping reasons that may require us to keep certain information. Read more about your rights and how to exercise them on our main privacy page[3].