GDPR: Model recruitment, equal opportunities and TUPE documents updated

Our model policies and documents on recruitment, equal opportunities and transfer of undertakings (TUPE) are among the latest to be updated to comply with the General Data Protection Regulation (GDPR), which is in force from 25 May 2018.

GDPR data protection documents

Data protection documents to use in your GDPR compliance efforts include:

The GDPR requires employers to be transparent about the personal data that they hold and how it is used. They also have to show that they are complying with the GDPR's data protection principles.

Obligations under the GDPR apply to any information provided by, or created about, an individual during the recruitment process. Job applicants should be provided with a privacy notice and might submit a subject access request to the employer to access data about them.

Reference requests also involve processing personal data. Unlike many other employment processes, consent is a valid legal basis for processing data when a reference is being sought because it is freely given. The individual should have the right to withdraw his or her consent at any time.

Employers also need to think about how long they retain job applicants' personal data, for example to keep an unsuccessful job applicants' application on file.

There are a number of GDPR implications for employers' equal opportunities policies. In particular, employers could be processing special category personal data related to a disabled employee's health when implementing reasonable adjustments.

In relation to equal opportunities monitoring, employers can seek a job applicant's consent to the processing of his or her data. While employers should not generally rely on consent as the legal basis for processing data under the GDPR, it is appropriate here because applicants have a genuine choice about providing the information.

Employers involved in a TUPE transfer must be alert to the implications of the GDPR. During the early stages of the due diligence process, data could be anonymised so that individual employees are not identifiable. If an individual is identifiable, the GDPR will apply.

The following recruitment, equal opportunities and TUPE documents have been updated:

Recruitment

Equal opportunities

Transfer of undertakings

We have also updated our model documents in these areas:

Right to work in the UK

GDPR: Model right to work in the UK documents updated We have also revised our model right to work in the UK documents to comply with the GDPR.

Probation

Termination of employment

Volunteering

Working hours