Data Protection Act 2018 and GDPR Privacy Notice

Job Applicant Information and how your Personal Data will be used by SPS

Data Controller

The controller of your personal data is the Scottish Prison Service, Calton House, 5 Redheughs Rigg, Edinburgh, EH12 9HW. SPS acts on behalf of Scottish Ministers.

Data Protection Officer (DPO)

The SPS Data Protection Officer (DPO) is the Head of Information Management who can be contacted at the above address. 

The main information we collect when you apply for a job with SPS

The information we collect associated with our recruitment and assessment practices include:

  • Your name, address, contact details, including email address and telephone number(s);
  • Details of your qualifications, skills, experience, employment history and previous disciplinary matters;
  • Information on criminal convictions you may have;
  • Whether you do or do not have a disability for which SPS needs to make reasonable adjustments during the recruitment process;
  • Information regarding your entitlement to work as a Civil Servant and remain in the UK; and
  • Equal opportunities monitoring information, including information about your ethnic origin, sexual orientation, health and religion or belief.

What we do with the Personal Data you provide us when applying for a job with SPS

Your personal data is managed in a secure manner and only SPS employees or partners working with SPS with a need to see the information have access to it. The information we hold is used in a range of ways when assessing suitability of candidates for roles at SPS. These will typically involve processing your application form/CV, psychometric tests (such as situational judgement tests, numerical and verbal reasoning tests and personality profiling assessments), interview (face to face), and behavioural assessments (such as role plays, group exercise, presentation and written assessment).

We may share your data, where there is a legal basis for doing so, with some or all of the following:

The Civil Service Commissioners; internal and external auditors associated with ensuring that our recruitment practices observe the Civil Service Recruitment Principles; our Occupational Health provider; contracted third parties associated with our selection processes and pre-employment vetting where they may need to contact you to complete health questionnaires and/or on-line assessments; the host organisation of our Applicant Tracking System (ATS); and Disclosure Scotland where enhanced background vetting checks are required including where you will be working with Protected Children, Adults, or both (PVG Scheme).

Legal Basis for Processing your Personal Data

In terms of Data Protection legislation, the legal basis for processing your personal data is generally:

  • processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract; or
  • processing is necessary for compliance with a legal obligation to which the controller is subject.

If the data is a special category of personal data then the legal basis is generally:

  • processing is necessary for the purposes of carrying out the obligations and exercising specific rights of the controller or of the data subject in the field of employment.

In the majority of circumstances the SPS does not require your permission to process your personal data. However where any processing of your personal data is based upon consent you may withdraw that consent at any time. 

In certain circumstances there may be other legal bases for processing your personal data.

How long we keep your Personal Data 

We only retain your personal data for as long as is necessary. The timeframes differ depending on the type of personal data being processed and the retention and destruction policies specified by SPS and the Civil Service Commission. 

What are your rights?

Access to Personal Data - you can request to see the personal data that SPS is processing about you.

Rectification of Personal Data - if you believe the personal data that SPS is processing about you is incorrect or incomplete you are entitled to request to have that data corrected. 

Erasure of Personal Data or Restriction of its processing - you have the right to ask for your personal data to be erased or to restrict processing of that data.

Requests should be made in writing to the Resourcing Team, SPS College, Brightons, Falkirk, FK2 0DE. If you are not satisfied with the response received you may contact the SPS Data Protection Officer at SPS headquarters (see address above).

Complaints to the Information Commissioners Office (ICO)

if you wish to make a complaint about how the SPS is processing your personal data you can do so to: 

Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF.