Recruitment & Applicant Privacy Notice

For applicants and clinicians applying for NCI roles and NHS insourcing assignments

Version 1.0 | October 2026

1. About this notice

National Clinical Insourcing (NCI) recruits healthcare professionals to support clinical services delivered in partnership with NHS organisations. This notice explains how we collect, use, share, retain and protect personal information when you apply for a role, register your interest in working with us, or progress through our recruitment, compliance and onboarding processes.

It applies to applicants for employment and to clinicians and other workers considered for temporary, sessional, self- employed, personal service company or other contractual engagements, including Consultants and Surgeons recruited for NHS insourcing assignments.

This notice should be read alongside any other privacy information provided to you where a particular recruitment process requires additional processing.

2. Who is responsible for your information?

National Clinical Insourcing (NCI) is responsible for determining how personal information collected directly by NCI during its recruitment process is used. Where your information is shared with an NHS organisation or another organisation for credentialing, approval or delivery of a clinical service, that organisation may also act as a separate data controller for its own processing.

Privacy enquiries or requests concerning recruitment data can be sent to NCI using the contact details published on our website or the contact details provided during your recruitment process.

3. Who this notice applies to

people applying to vacancies advertised by NCI, including vacancies advertised through NHS Jobs;
Consultants, Surgeons and other doctors applying for clinical assignments;
nurses, allied health professionals, healthcare support workers and other clinical personnel;
applicants for non-clinical roles connected with NCI services;
individuals who send NCI a CV or register an interest in future opportunities; and
referees and other individuals whose details are provided as part of an application.

4. Information we may collect

The information we collect will depend on the role and the stage of recruitment. We will only seek information that is relevant to assessing suitability, completing appropriate checks, onboarding a successful applicant and meeting our legal, contractual, clinical governance and safeguarding responsibilities.

identity and contact information, including name, address, telephone number, email address and date of birth;
CV, employment history, education, qualifications, training, professional experience and specialist interests;
application responses, interview notes, assessments, correspondence and information about your availability;
professional registration and regulatory information, including GMC, NMC, HCPC or other relevant registration details, licence to practise, specialist registration and revalidation information where applicable;
evidence of identity, right to work and immigration status where required;
references and information supplied by previous employers, engagers or referees;
information required for NHS employment/checking standards or local NHS Trust credentialing and approval processes;
DBS and safeguarding information where the role is eligible for, and requires, such checks;
occupational health, immunisation, fitness-to-work or reasonable-adjustment information where relevant and lawful;
indemnity or insurance information where relevant to the engagement;
information about complaints, restrictions, investigations, regulatory matters or fitness-to-practise issues where relevant and lawful;
payment, company and engagement information if you progress to an assignment, including details needed to contract with and pay you or your personal service company; and
equal opportunities information where collected for lawful monitoring purposes.

5. How we obtain your information

directly from you through NHS Jobs, NCI application forms, email, telephone, interviews or other recruitment channels;
from referees and previous employers or organisations that have engaged you;
from professional regulators and official registers, such as the GMC or other relevant regulatory bodies;
through lawful pre-engagement screening, identity, right-to-work, DBS, occupational health or compliance providers;
from NHS organisations where this is necessary for credentialing, approval, onboarding or delivery of an assignment; and
from recruitment partners or other sources where you have authorised or would reasonably expect your information to be provided for recruitment purposes.

6. Why we use your information

to receive, administer and assess your application;
to communicate with you about the vacancy and recruitment process;
to assess your qualifications, experience, competence, suitability and availability;
to verify professional registration, identity, right to work, employment history, references and other credentials;
to undertake appropriate safeguarding, DBS, occupational health and compliance checks where required;
to present or submit suitable clinicians for approval by an NHS organisation where this is necessary for a specific service or assignment;
to meet contractual requirements, NHS standards, clinical governance obligations and applicable legal or regulatory requirements;
to make decisions about appointment, engagement or allocation to an assignment;
to establish and administer the contractual relationship if you are successful;
to maintain appropriate records of recruitment decisions, compliance and audit activity; and
where appropriate, to consider you for future suitable NCI opportunities.

7. Our lawful bases

Depending on the circumstances, NCI may rely on one or more lawful bases under UK data protection law. These can include taking steps at your request before entering into a contract, performance of a contract, compliance with a legal obligation, and NCI's legitimate interests in operating a safe, effective and compliant recruitment and clinical workforce process.

Where consent is the appropriate lawful basis for a specific activity, we will ask for it separately and you may withdraw that consent, subject to any processing that is otherwise required or permitted by law.

Where we process special category information, such as health information, or criminal offence information, we will only do so where an additional condition under applicable data protection legislation is satisfied and appropriate safeguards are in place.

8. Clinical vetting, DBS and professional checks

Clinical roles may require enhanced verification because successful applicants may provide care to NHS patients. Depending on the role, NCI may verify professional registration, specialist registration, licence to practise, qualifications, employment history, references, right to work, mandatory training, occupational health status, indemnity arrangements and other credentials.

Where a DBS or other criminal record check is appropriate and lawful for the role, NCI will process the minimum information necessary for the relevant recruitment, safeguarding and compliance purpose. Information obtained through

vetting will not be retained for longer than necessary; where appropriate, NCI may retain a record that a check was completed and its outcome rather than retaining underlying sensitive documentation.

9. Sharing information with NHS organisations

Where you apply for, or are considered for, an NCI clinical assignment, relevant information may be shared with the NHS Trust, NHS Foundation Trust or other healthcare organisation receiving the service. This may include your CV, professional registration details, qualifications, experience, references, compliance status and other information reasonably required to assess and approve you for the assignment.

We will not provide an NHS organisation with information that is irrelevant to its assessment or onboarding requirements. Once an NHS organisation receives your personal information, it may process that information under its own privacy arrangements and legal responsibilities.

10. Other organisations we may share information with

service providers that support NCI's recruitment, applicant tracking, IT, communications, compliance, payroll or administration;
professional regulators, disclosure bodies, occupational health providers or screening organisations where necessary and lawful;
professional advisers, auditors or insurers where reasonably necessary; and
law enforcement, regulators, courts or other public authorities where disclosure is required or permitted by law. NCI does not sell applicant personal information and does not share applicant information with third parties for their own direct marketing.

11. NHS Jobs

Where you apply through NHS Jobs, information you submit through that service will be processed in accordance with the privacy arrangements applicable to NHS Jobs and will also be made available to NCI as the recruiting organisation for the relevant vacancy. Once received by NCI, we process that information in accordance with this notice.

12. If your application is unsuccessful

NCI may retain a proportionate record of your application and recruitment outcome for a limited period for recruitment administration, audit, dispute management and legal compliance. We will set retention periods according to the nature of the information and the purpose for which it is held, and we will securely delete or anonymise information when it is no longer required.

Where we would like to retain your details for consideration for future opportunities beyond the ordinary recruitment retention period, we will ensure there is an appropriate lawful basis and, where required, ask you whether you would like us to do so.

13. If you are appointed or engaged

If you are successful, relevant recruitment information will form part of the records NCI needs to administer your employment or contractual engagement, maintain compliance and governance records, arrange assignments, communicate with NHS partners and make payments. Additional privacy information may apply to the ongoing relationship.

14. International transfers

NCI will take appropriate steps to protect personal information if a supplier or service used in the recruitment process involves transferring personal data outside the United Kingdom. Where required, we will use an appropriate legal transfer mechanism and safeguards.

15. Keeping your information secure

NCI uses appropriate technical and organisational measures designed to protect applicant information against unauthorised access, loss, alteration or disclosure. Access is limited to people and organisations that need the information for legitimate recruitment, compliance, governance or service-delivery purposes.

16. Your data protection rights

Depending on the circumstances, you may have rights to request access to your personal information, correction of inaccurate information, erasure, restriction of processing, data portability, or to object to certain processing. Where processing is based on consent, you may also withdraw that consent.

These rights are subject to legal conditions and exemptions. Requests can be made to NCI using the contact details provided during recruitment or published by NCI.

17. Complaints

If you have concerns about how NCI handles your personal information, please contact us first so that we can investigate. You also have the right to raise a concern with the Information Commissioner's Office (ICO), the UK's data protection regulator.

18. Changes to this notice

We may update this notice from time to time to reflect changes to our recruitment processes, legal requirements or regulatory guidance. The latest version will state its effective date.

Document owner: National Clinical Insourcing (NCI) Document: Recruitment & Applicant Privacy Notice Version: 1.0 Effective date: October 2026