NHSP Privacy Notice Information

Privacy Notice


This Notice contains important information about how NHS Professionals Limited in its capacity as a recruiter for flexible workers will process your personal data in connection with your application for registration / the auto registration process.

You should read this Notice carefully and raise any questions you may have with fwhumanresources@nhsprofessionals.nhs.uk.

This Notice applies to NHS Professionals Limited, which is registered as a data controller with the Information Commissioner's office (registration number Z2165993) ("NHSP"). NHSP's address is Suites 1A & 1B, Breakspear Park, Breakspear Way, Hemel Hempstead, HP2 4TZ.


Personal data means information which identifies you and relates to you as an individual. NHSP will collect, use and store your personal data as may be necessary to process your application for registration as a flexible worker. We have set out below the main categories of personal data which we process on a day to day basis:

  • personal contact information (including your name, home address, personal telephone number(s) and personal e-mail address) *
  • business contact information (including e-mail address and telephone number)
  • ESR job title*
  • band
  • date of birth*
  • gender*
  • emergency contact information*
  • photograph
  • your documents evidencing your right to work (including information about your immigration status where relevant)
  • your cv
  • application form
  • references
  • professional memberships and qualifications
  • background vetting information
  • NI number*
  • bank account details (including name of bank / building society, bank account name, bank account number, bank sort code, and bank branch name)
  • professional registration membership body*
  • professional registration number*
  • registration expiry date*

*Collected directly from Trust in pre-authorised registration processes.

The list set out above is not exhaustive, and there may be other personal data which NHSP collects, stores and uses in the context of the registration / the auto registration process. NHSP will update this Notice from time to time to reflect any notable changes in the categories of personal data which it processes.

During the registration process, the majority of the personal data which we process will be collected directly from you and will be collected from a number of sources, including your CV, Declaration A / B form, DBS disclosure, application form, interview notes, cover letter and any other documents generated during the recruitment process. In limited circumstances your personal data may be provided by third parties, such as an NHS Trust.

During the pre-authorised registration processes, the majority of the personal data which we process will be collected directly from the NHS Trust and you.

In the event that your application / registration process is successful, this data may also be retained and processed for the purpose of your role as a NHSP flexible worker.

The majority of the personal data to be provided by you is mandatory in connection with our recruiting activities. Failure to provide mandatory personal data may affect our ability to accomplish the purposes stated in this Notice, including considering your suitability for the role and/or your registration.


(a)  Recruitment and Selection

The primary purpose for processing your personal data is to consider your application for registration. Your personal data will be used by NHSP's employees who are directly involved in the registration process to the extent strictly necessary, during all aspects of the registration process, for example to assess your application, during any interview and when finalising any registration decision.

(b)  Background Vetting

NHSP considers it owes a duty to its clients and business to ensure that it maintains the highest standards of honesty and integrity when registering individuals as flexible workers. As a result, it is NHSP's policy to undertake background checks on all applicants who are successfully registered.

Again, this list is not exhaustive and NHSP may undertake additional processing of personal data in line with the purposes set out above. NHSP will update this Notice from time to time to reflect any notable changes in the purposes for which it processes your personal data.

(c) Administering the FW Registration document

NHSP will use personal data to administer the FW Registration document and this will include using personal details to:

-       - Pay and deduct tax and National Insurance contributions

-       - Liaising with pension provider

-       - Gather evidence for possible grievance or disciplinary hearings

-       - Safeguarding the safety of patients and staff in any NHS organisation in which you work, have worked or may work

-       - Make decisions about continued engagement

-       - Make arrangements for the termination of a working relationship

-       - Complying with health and safety obligations

-       - To prevent fraud, including providing information to NHS Counter Fraud and Security Management Service Division, the police, the Home Office and HMRC

-       - Education, training and development requirements

-       - Ascertaining fitness to work

-       - Managing sickness absence

-       - To conduct data analytic studies to review and understand shift fill at Client Trusts

-       - Equal opportunities monitoring

If you fail to provide certain information when requested, we may not be able to perform the contract we have entered into with you (such as paying you), or we may be prevented from complying with our legal obligations (such as to ensure the health and safety of our workers).

NHSP will only use your personal information for the purposes for which we collected it, unless we reasonably consider that we need to use it for another reason and that reason is compatible with the original purpose. If we need to use your personal information for an unrelated purpose, we will notify you and will explain the legal basis which allows us to do so.

Please note that we may process your personal information without your knowledge or consent, in compliance with the above rules, where this is required or permitted by law.


Certain categories of data are considered "special categories of personal data" and are subject to additional safeguards. NHSP limits the special categories of personal data which it processes as part of the registration process as follows: 

  • Health Details

NHSP may also process health information to assess working capacity on health ground and this will be subject to appropriate confidentiality safeguards.  

In addition, NHSP will use particularly sensitive personal information in the following ways:

  • We will use information relating to leave of absence, which may include sickness absence or family related leave, to comply with employment and other laws
  • We will use information about your physical or mental health, or disability status, to ensure health and safety in the workplace is adhered to and assess fitness to work, to provide appropriate workplace adjustments, to monitor and manage sickness absence and to administer benefits

NHSP does not need your consent if we use special categories of your personal information in accordance with NHSP’s written policy, to carry out our legal obligations or exercise specific rights in the field of employment law. In limited circumstances, we may approach you for your written consent to allow us to process certain particularly sensitive data. If we do so, we will provide you with full details of the information that we would like and the reason we need it, so that you can carefully consider whether you wish to consent. You should be aware that it is not a condition of your contract with us that you agree to any request to consent from us.

  • Equal Opportunities Monitoring

NHSP is committed to providing equal opportunities for all of its flexible workers and from time to time it will process information relating to ethnic origin, race, nationality, sexual orientation and disability, alongside information relating to gender and age, for the purposes of equal opportunities monitoring.

We have implemented appropriate physical, technical, and organizational security measures designed to secure your personal data against accidental loss and unauthorized access, use, alteration, or disclosure.  This monitoring will always take place in accordance with appropriate safeguards as required under applicable law, including:

  • the provision of information relating to ethnic origin, race, nationality, sexual orientation and disability for the purposes of monitoring will be voluntary 
  • wherever possible, the monitoring will be conducted on the basis of using anonymised data, so individuals cannot be identified;
  • the information processed for monitoring purposes will be maintained separately from general management and HR records.


Given the nature of our business, we ask applicants to disclose their criminal record history and we carry out criminal record checks as part of our background vetting process and in compliance with our legal obligations in relation to your registration. In all cases, we carry out the checks in accordance with the applicable law.

We will always treat criminal record history as confidential and it will only be shared internally and with the designated Trust where you have applied to undertake assignments where there is a specific and legitimate purpose to do so. It will be used for the purpose of determining the success of your application for this position. It will also be used for purposes of enquiries in relation to the prevention and detection of fraud. We have implemented appropriate physical, technical, and organizational security measures designed to secure your personal data against accidental loss and unauthorized access, use, alteration, or disclosure.

Criminal record information will be deleted once the recruitment process has been completed, subject to any exceptional circumstances and/or to comply with particular laws or regulations.  Criminal record information will typically be retained for a maximum of [6] months, although the outcome of any check will remain on your record.


(a)  Access and Storage

Documents containing your personal data will be accessed and stored by the following individuals: managers and employees of the relevant department for the purposes of the registration process.

In all cases, NHSP takes appropriate steps to ensure that the documents are stored securely (whether in hardcopy or softcopy) and that access is restricted only to those employees with a legitimate purpose.

(b)  Transfer to third parties


  • NHS Trusts and NHSP Clients:

NHSP may have to share your personal data with the Trust/ NHSP Client you have applied to work at and/or work shifts with. This is usually to ensure that you can work at the Trust/ NHSP Client, complete necessary training and for reporting purposes.


  • NHSP will only share your personal data when necessary and where there is a legitimate reason to do so. If there is another reason for sharing your data, we will contact you to inform you and obtain consent if required. 
  • Data Processors:

An applicant’s personal data may be transferred to other third parties acting in their capacity as data processors. We use data processors who are third parties who provide elements of services for us. We have contracts in place with our data processors. This means that they cannot do anything with your personal information unless we have instructed them to do it. They will not share your personal information with any organisation apart from us. They will hold it securely and retain it for the period we instruct. 


  • Trust Authorisers

Where you have provided the name of a Trust authoriser as part of the application process, personal contact information (including your name, personal telephone number and personal e-mail address) and your Declaration A / B form will be shared with this individual.


  • Surveys

Your personal details, may also be provided to third parties for the purposes of carrying out survey’s into NHSP company’s performance.

There is no requirement for you to complete the surveys and a facility to opt out will be provided upon receipt of the first communication


  • Auditors

NHSP may be required to share your data with external auditors.

NHSP have contracts in place with our Auditors and your data will only be shared with the auditors for the sole purpose of the audit.


  • Transfer of Information outside the EEA

NHS Professionals may transfer your information overseas, as some of our third-party providers are not based in the UK. We will only transfer to organisations in other countries on the basis that it is lawfully permitted and in compliance with applicable laws.

In the event that your personal data is transferred outside the EEA (European Economic Area), NHS Professionals ensure a similar degree of protection is afforded to it by ensuring at least one of the following safeguards is implemented:

Please contact us if you want further information on the specific mechanism used by us when transferring your personal data out of the EEA.


(c)  Retention of personal data

Successful applicants - If your application for registration is successful, full details of how NHSP processes your personal data will be provided in due course. Any information which you have provided during the recruitment process that is irrelevant to your ongoing role as a flexible worker will be destroyed within a period of no longer than 6 months following the satisfactory completion of the background vetting checks.

Unsuccessful applicants - In the event that your application for registration is unsuccessful on this occasion, any information which you have provided during the registration process will be retained for a maximum period of no longer than 9 months in order to deal with any queries or issues relating to your application, following which it will be destroyed. The HR Department may write to an unsuccessful applicant to state that his/her CV will be retained on file for the purposes of future recruitment – individuals will be given the opportunity to object to their CVs being retained for this purpose at the relevant time.

Any third parties that your data has been shared will be advised that your application has been unsuccessful within 2 months of this decision.


NHSP will always seek to process your personal data in accordance with its obligations and your rights.

In certain circumstances, you have the right to seek the erasure or correction of your personal data, to object to particular aspects of how your data is processed, and otherwise to seek the restriction of the processing of your personal data. You also have the right to request the transfer of your personal data to another party in a commonly used format. If you have any questions about these rights, please contact fwhumanresources@nhsprofessionals.nhs.uk.  

You have a separate right of access to your personal data processed by NHSP. You may be asked for information to confirm your identity and/or to assist NHSP to locate the data you are seeking as part of NHSP's response to your request.  If you wish to exercise your right of access you should set out your request in writing to fwhumanresources@nhsprofessionals.nhs.uk using the details set out below.

Finally, you have the right to raise any concerns about how your personal data is being processed with the Information Commissioner's Office using the following contact details: https://ico.org.uk/concerns


Automated decision-making takes place when an electronic system uses personal information to make a decision without human intervention. NHSP are allowed to use automated decision-making in the following circumstances:

  1. Where we have notified you of the decision and given you 21 days to request reconsideration.
  1. Where it is necessary to perform the contract with you and appropriate measures are in place to safeguard your rights.
  1. In limited circumstances, with your explicit written consent and where appropriate measures are in place to safeguard your rights.

If NHSP make an automated decision on the basis of any particularly sensitive personal information, we must have either your explicit written consent or it must be justified in the public interest, and NHSP must also put in place appropriate measures to safeguard your rights.

You will not be subject to decisions that will have a significant impact on you based solely on automated decision-making, unless NHSP have a lawful basis for doing so and we have notified you.


NHSP has appointed a Data Protection Officer to oversee compliance with this Notice and to deal with any questions or concerns.   If you would like further information about the matters set out in this Notice, please contact the Data Protection Officer. 

The contact details for your Data Protection Officer are set out below:

Dean Field
Data Protection Officer

   Version 1.4