Guidance

Privacy notices for public appointment candidates at DCMS

Published 31 July 2025

1. Who is collecting my data

The Department for Culture, Media and Sport (DCMS) supports culture, arts, media, sport, tourism and civil society across every part of England, by recognising the UK’s world-leading position in these areas and the importance of these sectors in contributing so much to our economy, way of life and our reputation around the world.

Our department champions sport for all at every level, supports our world-leading cultural and creative industries, and enhances the cohesiveness of our communities.

The HM Government Public Appointments Website is managed by the Cabinet Office, the Department for Culture, Media and Sport use the website to process DCMS Public Appointments (“we” and “us“, “DCMS“). 

DCMS is the data controller for the personal information we process, unless otherwise stated. A data controller decides why and how your personal data (personal information) is used. 

The Cabinet Office is considered a joint data controller for any personal data processed for DCMS public appointments, as advertised on the Public Appointments website. You can find out further information about how the Cabinet Office processes your personal data in the Cabinet Office’s privacy notice. 

This privacy notice also applies to the DCMS Public Appointments Network. 

2. Purpose of processing 

This  privacy notice is to set out how DCMS uses your personal data and special category data for the purpose of public appointments and explains your rights under the UK GDPR and the Data Protection Act 2018 (DPA 2018). 

Your personal information will be processed for the purpose of applying for a DCMS public appointments role, which is advertised on the Cabinet Office’s Public Appointments website. 

The Department for Culture, Media and Sport’s personal information charter (opens in a new tab) generally explains how we deal with your personal information. 

3. Privacy policies of other websites

Applications for public appointments roles will be available to the Cabinet Office (as site owners) via the Public Appointment’s website. Further details can be found at: The HM Government Public Appointments Website Privacy Notice 

4. What is personal data?

Personal data is any information relating to an identified or identifiable natural living person, otherwise known as a ‘data subject’. A data subject is someone who can be recognised, directly or indirectly, by information such as a name, an identification number, location data, an online identifier, or data relating to their physical, physiological, genetic, mental, economic, cultural, or social identity. These types of identifying information are known as ‘personal data’. Data protection law applies to the processing of personal data, including its collection, use and storage.

5. What personal data do we collect?

Most of the personal information we collect and process is provided to us directly by you, from the information you have added to your account on the HM Government Public Appointments Website or through the DCMS Public Appointments Network. 

Data collected for public appointment applications:

• name
• e-mail address
• contact details that you have provided
• employment history, qualifications
• CV / biography and other background information relevant to your application including sift and interview assessments made by the advisory assessment panel
• information you provide on interests relevant to the appointment you are applying for
• political activity
• geographical location
• principal employment sector
• number of government public appointments held
• alongside your own declaration of relevant interests, this may also include information related to your conduct or professional capacity gathered as part of departments conducting appropriate checks on information in the public domain
• health information as required to facilitate access and participation in the Appointment process or events (e.g. venue access and dietary requirements)
• socio-economic data; and
• data provided by you to us for any other reason

This list of data is not exhaustive and may change, depending on the appointment you are applying for and what data you supply to us as part of your application. 

6. Data collected for equality monitoring 

We are responsible for monitoring the diversity and inclusivity of our public appointments by assessing any diversity data collected as part of applications. This diversity data may include your: 

• age
• gender
• ethnicity
• sex
• sexual orientation
• declared disability (health conditions)
• religion, faith or belief
• geographical location
• principal employment sector
• number of government public appointments held
• socio-economic indicators

You have the choice to opt out from sharing any equality data, by selecting ‘prefer not to say’. You must opt out before the application window closes.

7. What is special category data (sensitive personal data) 

Special category data is data that pertains to sensitive factual information about you and requires an additional level of protection under the UK GDPR  because of its sensitive nature. Special category data collected, if you have provided it may include:

• personal data revealing racial or ethnic origin
• personal data revealing political opinions
• personal data revealing religious or philosophical beliefs
• data concerning health
• data concerning sexual orientation

You have the choice to opt out from sharing any type of special category data, by selecting ‘prefer not to say’. You must opt out before the application window closes.

8. What background checks will be carried out

We will also use your personal information to carry out a series of key background checks by a third-party organisation provider. These mandatory Baseline Personnel Security Standard (BPSS) checks are required for all appointees to ensure there are no issues that may impact your ability to take up an appointment. All appointments and reappointments are offered subject to BPSS checks being completed. 

Our pre employment checks, may cover the following areas: 

• right to work 
• verification of your identity 
• criminal records check 
• employment checks 

9. How will we use your data

We use your personal information and special category data for a wide range of purposes, to enable us to carry out our functions as a government department. This includes: 

• The data will be visible to departmental officials for the purpose of managing the Public Appointment Process for which you have applied. Data will also be available to other individuals involved in the process including government ministers, Advisory Assessment Panel members and members of the Commissioner for Public Appointments team, and our IT providers.
• To monitor the diversity and inclusivity of our processes, your special category data may be shared with the Advisory Assessment Panel that is responsible for sifting candidate CVs and interviewing candidates. The Advisory Assessment Panel may use your special category data to help ensure boards are representative of the United Kingdom. The data will help us understand the diversity of public appointees and to satisfy our public sector equality duty (PSED). You may opt out of this if you so wish by selecting “prefer not to say” for any or all categories, and your application will still be considered. You must opt out before the application deadline closes.
• If you are offered an interview for a public appointment your data may be shared with the employees and board members of the public body for which you are applying, for the purposes of scheduling the interview, informing you of the outcome and providing feedback after the interview. If you are successful in your application we will share your contact details with the public body so that staff can make arrangements for you to start your role. 
• We will process your personal data in order to communicate with you to invite you to events promoting public appointments.
• If you have not opted out of being contacted about future opportunities that may be of interest your data is retained for this purpose for as long as you choose to remain open to such contact.
• All DCMS public appointment processes are run in accordance with the Governance Code for Public Appointments. Section 5 of the code explains the role of Advisory Assessment Panels.

10. What is the lawful basis for processing my data

To process this personal data, our legal reason for collecting or processing this data is: Article 6(1)e: it is necessary to perform a public task (to carry out a public function or exercise powers set out in law, or to perform a specific task in the public interest that is set out in law). 

The lawful basis that we rely on to process your personal data will determine which of the following rights are available to you. Much of the processing we do in DCMS will be necessary to meet our legal obligations or to perform a public task. If we hold personal data about you in different parts of DCMS for different purposes, then the legal basis we rely on in each case may not be the same. 

11. What is the lawful basis for processing special category personal data

We process special category data (as defined in Article 9(1) of the UK GDPR ) because it meets the requirements of paragraph 8 to Schedule 1 of the Data Protection Act 2018, i.e. is necessary for the purposes of identifying or keeping under review the existence or absence of equality of opportunity or treatment between groups of people specified in relation to that category with a view to enabling such equality to be promoted or maintained and it is necessary for reasons of substantial public interest as set out in Article 9(2) of the UK GDPR, such as carrying out functions of the Crown, a minister, or a government department. The policy document explaining this is here.

12. What will happen if I do not provide this data

The Advisory Assessment Panel reserves the right to only consider applications that contain all elements as listed in the role advert (e.g. Name, Contact Details, CV, Supporting Statement, Declaration of Conflicts of Interest) and submitted before the published deadline for applications. If you do not provide the necessary information to assess your application, your application will be regarded as unsuccessful. You have the choice to opt out from sharing any type of special category data, by selecting ‘prefer not to say’ and your application will still be assessed. 

13. Who will your data be shared with

Personal information on your application will be processed by DCMS staff and other government departments and/or organisations who have a business need to see it or have an involvement in our public appointments work. We will also utilise anonymised diversity data for monitoring purposes. Depending on the position you have applied for, we may need to share your personal information with the following:

• Cabinet Office 
• No10 Downing Street officials 
• staff of the public body (you are applying to)
• government ministers and Government Appointed Special Advisors 
• assessment panel members
• Commissioner for Public Appointments staff 
• if the appointment you are applying for is made by His Majesty the King, your data will be shared as necessary with the Privy Council and Palace Officials

14. How long will my data be held for

• If you are successful and appointed we will hold your data relating to your application for the duration of your appointment plus two years.
• If you are unsuccessful we will hold your data relating to your application for two years from the date the successful appointee was announced.
• Records developed in support of data protection compliance will be held for 6 years. 
• On the HM Government Appointments Website, your account will retain a record of the appointments you have applied for after your application has been deleted, for as long as you choose to hold your account.
• You can unsubscribe the DCMS Public Appointments Network at any time, either by selecting “unsubscribe” button on the newsletter or emailing publicappointments@dcms.gov.uk to state you would like to be removed from our mailing list. 

15. Will my data be used for automated decision making or profiling

We will not normally use your data for any automated decision making. If we need to do so, we will let you know. 

16. Will my data be transferred outside the UK and if it is how will it be protected

Your personal data will be stored on our secured IT infrastructure, it may be transferred and stored securely within the European Economic Area (EEA). Where that is the case it will be subject to equivalent legal protection through an adequacy decision or reliance on Standard Contractual Clauses and International Data Transfer Agreements (IDATs).

17. Links to other websites

Where we provide links to websites of other organisations, this privacy notice does not cover how that organisation processes personal information. We encourage you to read the privacy notices of the other websites you visit.

18. What are your data protection rights?

The UK GDPR sets out data protection rights for individuals and these are known as data subject rights. This includes the rights to:

• be informed about the collection and use of your personal data (right to be informed)
• ask us for copy of the personal information we hold about you (right to access)
• ask us to change any information you think is inaccurate or incomplete (right to rectification)
• ask us to delete your personal information (right to erasure)
• ask us to stop using your personal information (right to restriction of processing)
• ask us to transfer your data electronically to another provider (right to data portability)
• object to the processing of your information (right to object)
• be informed about automated decision making and profiling (right not to be subject to automated decision making)
• withdraw consent at any time (where relevant).

It should be noted that for any Crown appointments, some data rights may be restricted. Some data subject rights that may be restricted include:

• right for rectification
• right to erasure 
• right to restriction of processing
• right to data portability
• right to object
• right to not be subject to automated decision-making

If you have any further questions about your data subject rights, please contact our DCMS Data Protection Officer. 

DCMS will ensure that we uphold your rights when processing your personal data. 

19. How do I contact DCMS

For general queries relating to the processing of your personal data for the purposes of your public appointment application contact us at: 

Head of Public Appointments

DCMS

100 Parliament Street

London 

SW1A 2NH

Or

Head of Public Appointments

DCMS

Bloc, 17 Marble Street

Manchester

M2 3AW

Email: publicappointments@dcms.gov.uk

Data subjects can request a copy of the personal data held about them, or exercise any of their data protection rights, by contacting dcmsdataprotection@dcms.gov.uk 

20. How do I make a complaint

If you’re unhappy with the way we have handled your personal data and want to make a complaint, please write to the department’s Data Protection Officer or the Data Protection Manager at the relevant agency. You can contact the department’s Data Protection Officer using the details below: 

Data Protection Officer

DCMS

100 Parliament Street

London

SW1A 2BQ

Email: dpo@dcms.gov.uk

21. How to contact the Information Commissioner’s Office

If you believe that your personal data has been misused or mishandled, you may make a complaint to the Information Commissioner, who is an independent regulator. You may also contact them to seek independent advice about data protection, privacy and data sharing. 

Information Commissioner’s Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF

Website: www.ico.org.uk 

Telephone: 0303 123 1113

Any complaint to the Information Commissioner is without prejudice to your right to seek redress through the courts. 

22. Changes to our privacy notice

We may make changes to this privacy policy. In that case, the ‘last updated’ date at the bottom of this page will also change. Any changes to this privacy policy will apply to you and your data immediately.

If these changes affect how your personal data is processed, DCMS will take reasonable steps to let you know.

This notice was last updated on 28/07/2025.