This notice provides further information about:

• recruitment and pre-employment checks;
• information we collect and hold about you;
• where we obtain your information from;
• how we use your information during recruitment and employment;
• who we may share your information with;
• workforce administration, payroll and pensions;
• digital services and technologies;
• your data protection rights and choices;
• how you can raise a concern or complaint about the use of your information.

The Dudley Group NHS Foundation Trust (referred to in this notice as ‘the Trust’) issues this privacy notice in the interests of transparency over how we use (‘process’) the personal data that we collect from job applicants and employees (‘you’). It does not form part of your contract of employment and may be amended from time to time.

The Trust is responsible for ensuring that personal information processed about you including special category (sensitive) data is processed in accordance with applicable Data Protection Legislation including UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 (DPA 2018) and the Data (Use and Access) Act 2025 (DUAA)

‘Personal data’ means any information that relates to an identified or identifiable individual.

‘Special Category Data’ means more sensitive personal information relating to categories listed below which required additional protection under data protection legislation:

• the racial or ethnic origin of the individual,
• their political opinions,
• their religious or philosophical beliefs,
• their membership of a trade union,
• their physical or mental health or condition,
• their sexual life,
• the commission or alleged commission by them of any offence,
• any proceedings for any offence committed or alleged to have been committed by them, the disposal of such proceedings or the sentence of any court in such proceedings,
• genetic data; and
• biometric data where processed to uniquely identify a person for example a photo in an electronic passport

For the purposes of data protection legislation, The Dudley Group NHS Foundation Trust is the ‘data controller’. This means the Trust is responsible for deciding how and why your personal information is collected, used, stored and shared.

The kind of information we hold about you:

We will collect, store and use the following categories of personal data about you:

• Personal contact details such as name, title, addresses, telephone numbers and personal email addresses
• Date of Birth
• Gender
• Marital status and dependants
• Next of kin and emergency contact information
• National Insurance number
• Bank account details, payroll records and tax status information
• Salary, leave type, pension and benefits information
• Start date
• Location of employment or workplace
• Copies of driving license, passport or any other form of identification documents
• Recruitment information (including copies of right to work documentation, personal reference contacts and other information included in a CV or cover letter or as part of the application process)
• Employment records (including job titles, work history, working hours, training records, curriculum details and professional memberships)
• Performance information
• Disciplinary and grievance information
• CCTV footage and other information obtained through electronic means such as swipe card records
• Information about your use of our information and communications systems
• Photographs

We may also collect, store and use the following special category personal data:

• Information about your race or ethnicity, religious beliefs, sexual orientation and political opinions
• Trade union memberships
• Information about your health and wellbeing including any medical condition, sickness records
• Information relating to reasonable adjustments and disabilities
• biometric data
• Information about criminal convictions and offences

It is necessary for us to process personal data of both job applicants and employees for the following reasons:

1. We will need the information in order to identify the individual for the purposes of recruitment;
2. We will need to maintain that information for the general purposes of the ongoing employment relationship including performing the employment contract and maintaining the health and safety of individuals on our premises.

Some examples of the specific situations in which we will use your personal data are:

• making decisions about your recruitment or appointment and determining the terms on which you work for us;
• checking you are legally entitled to work in the UK;
• paying you and, if you are an employee, deducting tax and National Insurance contributions;
• providing benefits to you;
• liaising with your pension provider;
• business management and planning, including accounting and auditing;
• conducting performance reviews, managing performance and determining performance requirements;
• making decisions about salary reviews and pay;
• assessing qualifications for a particular job or task, including decisions about promotions;
• gathering evidence for possible grievance or disciplinary hearings;
• making decisions about your continued employment or engagement;
• making arrangements for the termination of our working relationship;
• education, training and development requirements;
• dealing with legal disputes involving you, or other employees, workers and contractors, including accidents at work;
• ascertaining your fitness to work;
• managing sickness absence;
• complying with health and safety obligations;
• to prevent fraud;
• to ensure compliance with our IT policies;
• to ensure network and information security, including preventing unauthorised access to our computer and electronic communications systems and preventing malicious software distribution;
• equal opportunities monitoring and
• to record any gifts, hospitality and other inducements and actual or potential conflicts of interest that arise during your employment and record your annual declaration of interest if you are deemed a decision maker.

Our legal basis for processing personal data of applicants and staff is that:

1. Processing the personal data is necessary for the purpose of carrying out the employment contract or to take steps to enter into an employment contract;
2. Processing is necessary to comply with a legal obligation (for example we are obliged under employment law to include in a written statement of employment terms the identity of the parties to the employment contract; and to ensure your health and safety); and/or
3. Processing the data is necessary for the purposes of our ‘legitimate interests’ as the data controller (except where such interests are overridden by the interests, rights or freedoms of the individual).
4. Processing is necessary for the performance of the task carried out in the public interest or in the exercise of official authority vested in the controller.
5. Processing is necessary for the purposes of preventative or occupational medicine, for assessing the working capacity of the employee, medical diagnosis, provision of health or social care or treatment or management of health or social care systems and services on the basis of union or member state law or a contract with health professionals.

The Trust may use approved digital services and technologies, including artificial intelligence tools, to support recruitment, workforce administration, information management, training, analysis and other employment-related functions. The use of such technologies is subject to applicable Trust policies, information governance arrangements and data protection requirements.

Our ‘legitimate interests’ for these purposes are:

1. the need to process information on applicants and staff for the purposes of assessing suitability for employment and then carrying out the employment contract;
2. the need to collect and use information for the purposes of safeguarding the health and safety of job applicants and employees;
3. the need to access, use and share employee information where necessary to support Group model working, workforce administration and legitimate employment-related functions; and
4. the need to process employee information for the purposes of ensuring network and information security.

We may from time to time process special category personal data of the kind described above.

Where necessary, we will either obtain explicit consent to process such information or rely on another lawful basis and condition permitted under the data protection legislation including where processing is necessary for us to carry out our obligations as an employer. That will be assessed on a case-by-case basis.

There is no strict statutory or contractual requirement for you to provide this data to us. However, if you do not provide information that is necessary for us to assess suitability for employment or to administer the employment relationship, it may not be practically possible for us to employ you or continue certain employment related processes.

Your personal information may be received by the following categories of people:

• Our Human Resources (HR) department;
• In the case of job applicants, the interview panel members and prospective managers;
• Any individual authorised by us to maintain personnel files and employment records;
• Our professional advisers;
• Insurance companies and any other third party necessary to comply with any legal disclosure; and
• Appropriate external regulators and authorities (such as the Police, HMRC, UKHSA and HSE)
• Authorised employees of The Dudley Group NHS Foundation Trust and Sandwell and West Birmingham NHS Trust where information is required to support Group model working arrangements.

We do not envisage that your data would be transferred to a country outside the UK/European Economic Area (EEA). If we perceive the need to do so, we will explain the purpose, lawful basis and safeguards that apply to the transfer.

To enable effective staff administration, the Trust will share your information with external organisations that process information on our behalf in order to comply with our obligations as an employer. This includes payroll and pensions processing and occupational health services as outlined below:

1. Payroll and Pensions: Data shared for purposes of payroll and pensions provision (NHS Pensions).
2. Occupational Health Services: Data shared for purposes of occupational health medical assessments and support services
3. Employee Records: The information which you provide during the course of your employment (including the recruitment process) will be shared with the NHS Business Services Authority for maintaining your employment records, held on the national NHS Electronic Staff Record (ESR) system.
4. Staff Survey: Data shared for purposes of a national requirement for NHS staff to be surveyed. Data will be shared securely with the contracted companies.
5. Membership Engagement Services Limited: As a member of staff you are automatically enrolled into the Foundation Trust membership base with the option to ‘opt out’. The trust’s legal basis for processing is that it’s necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller. We share your information in order that they can host the membership database. It is not given to any other third party unless we are legally required to do so.

Information may be obtained from a number of sources during your recruitment and ongoing employment with the Trust including:

• Disclosure and Barring Service (DBS) disclosures, where applicable, which will tell the organisation about any criminal convictions you may have
• Referees providing confidential information about your suitability to the role
• Inter Authority Transfer (IAT) – Information held by your previous NHS employer
• Information from Her Majesty’s Revenue and Customs (HMRC) relating to your pay and employment
• Information about your right to work and visa applications
• Pension information when transferring between the NHS organisations
• Information from your manager and HR team relating to your performance, sickness absence and other work-related matters
• Confirmation of your registration with a professional body

We will keep personal information for no longer than is necessary for the purpose for which it was processed. In some circumstances, we are legally required to retain information for a specific period in accordance with the Trust’s records management policies and Records Management Code of Practice.

The Trust will use your information to administer your employment and associated functions. Personal information will only be shared with colleagues who have legitimate need to access it in order to carry out their duties such as your line manager, HR teams and authorised staff.

The Trust maintains electronic and paper records relating to your recruitment and employment, with information held by the HR team and where appropriate locally with your line manager.

All paper records are kept in secure locked cabinets or cupboards and only relevant staff will have access to this information. Electronic information is accessed on a need-to-know basis using the Trust’s ESR system. Some information may also be held on the Trust’s secure electronic drives, where access is restricted to appropriate individuals.

Should we be required to transfer any of your personal data outside the UK/EEA for example where we are communicating with you abroad in relation to your pre-employment documentation, you can expect a similar degree of protection in respect of the transfer of your personal information. The Trust applies appropriate technical, organisational and physical security measures to protect personal information from unauthorised access, alteration, disclosure, loss or destruction.

Under the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 (DPA 2018) and the Data (Use and Access) Act 2025 (DUAA), you have a number of rights in relation to your personal information. Some rights may only apply in certain circumstances and may be restricted where permitted by law.

1. The right to erasure

You have the right to request that your personal data is deleted if:

• it is no longer necessary for us to store that data having regard to the purposes for which it was originally collected; or
• in circumstances where we rely solely on your consent to process the data (and have no other legal basis for processing the data), you withdraw your consent to the data being processed; or
• you object to the processing of the data for good reasons which are not overridden by another compelling reason for us to retain the data; or
• the data was unlawfully processed; or
• the data needs to be deleted to comply with a legal obligation.

However, we can refuse to comply with a request to delete your personal data where we process that data:

• to exercise the right of freedom of expression and information;
• to comply with a legal obligation or the performance of a public interest task or exercise of official authority;
• for public health purposes in the public interest;
• for archiving purposes in the public interest, scientific research, historical research or statistical purposes; or the exercise or defence of legal claims.

2. The right to data portability

You have the right to receive the personal data which you have provided to us, in a structured, commonly used and machine-readable format and have the right to transmit those data to another controller without hindrance from the controller to which the personal data have been provided (us) where:

• the processing is based on consent or on a contract; and
• the processing is carried out by automated means.

Note: This right only applies if the processing is carried out by “automated means” which means it will not apply to most paper-based data or by your explicit consent if you wish for the data to be transferred to other organisations for example when you leave the trust.

3. The right to withdraw consent

Where the Trust relies on your consent to process personal information, you have the right to withdraw that consent at any time. However, most employment-related processing is carried out under other lawful bases and not consent. Withdrawal of consent will not affect the lawfulness of processing carried out before consent is withdrawn.

4. The right to object

Where we process your personal data for the performance of a legal task or in view of our legitimate interests you have the right to object on “grounds relating to your particular situation”. If you wish to object to the processing of your personal data you should do so in writing to HR or to your line manager stating the reasons for your objection. Where you exercise your right to object we must stop processing the personal data unless:

• we can demonstrate compelling legitimate grounds for the processing, which override your interests, rights and freedoms; or
• the processing is for the establishment, exercise or defense of legal claims.

5. The right of access

Where you are aware of the personal data we hold on you, you have the right to request access to that data. This is sometimes referred to as making a “subject access request”. Subject access requests may be submitted to the Trust’s Data Protection Officer using the contact details contained within this notice.

6. The right to rectification

If any of the personal data we hold on you is inaccurate or incomplete, you have the right to have any errors rectified. Where we do not take action in response to a request for rectification you have the right to complain about that to the Information Commissioner’s Office.

7. The right to restrict processing

In certain prescribed circumstances, such as where you have contested the accuracy of the personal data we hold on you, you have the right to block or suppress the further processing of your personal data.

8. Rights related to automated decision making and profiling

The UK GDPR defines “profiling” as any form of automated processing intended to evaluate certain personal aspects of an individual, in particular to analyse or predict:

• performance at work;
• economic situation;
• health;
• personal preferences;
• reliability;
• behaviour;
• location; or
• movement

You have the right not to be subject to a decision when it is based on automated processing; and it produces a legal effect or a similarly significant effect on you. However, that right does not apply where the decision is necessary for purposes of the performance of a contract between you and us.

We may use your information related to your performance or attendance record to make a decision as to whether to take disciplinary action. We consider that to be necessary for the purposes of conducting the employment contract. In any event that is unlikely to be an automated decision in that action will not normally be taken without an appropriate manager discussing the matter with you first and then deciding whether the data reveals information such that formal action needs to be taken. In other words there will be “human intervention” for the purposes of the UK GDPR and you will have the chance to express your point of view, have the decision explained to you and an opportunity to challenge it.

If you have any questions or concerns about how we collect, use, share or protect your personal information, please contact the Trust’s Information Governance Team for advice and support.

Where appropriate, concerns may be referred to relevant teams including Human Resources, management teams or other authorised departments, so that they can be reviewed and investigated in accordance with Trust policies and procedures.

If your concern relates specifically to how your personal information has been handled and you remain dissatisfied following the Trust’s response, you may contact the Trust’s Data Protection Officer for further advice and review.

Contact details are provided below.

Data Protection Officer
Information Governance Department,
Trust Headquarters, South Block, 2nd  Floor,
Russells Hall Hospital, Pensnett Road,
Dudley, West Midlands
DY1 2HQ
Telephone: 01384 456 111 Ext: 1208
Email: dgft.dpo@nhs.net 

If you require this privacy notice in an alternative format, accessible version or another language, please contact the Information Governance Team at dgft.info.gov@nhs.net and we will make reasonable efforts to meet your needs.

Complaints to Regulatory Authority:

If you remain dissatisfied after contacting the Trust, you have the right to raise your concerns with the Information Commissioner’s Office (ICO), the UK’s independent authority responsible for upholding information rights.

You may contact them at any time using the details below:

The Information Commissioner’s Office (ICO)
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF
Telephone: 0303 123 1113
Website: www.ico.org.uk

Information Governance, Data Protection and Freedom of Information policies are available on request from dgft.foi@nhs.net.

We may update this privacy notice from time to time. The latest version will always be available on the Trust’s website.

This notice was last updated in August 2026.