GDPR compliance for healthcare staffing agencies — a practical guide

Healthcare staffing agencies occupy a particularly sensitive position under UK data protection law. You handle not just ordinary personal data — names, addresses, contact details — but special category data including health information, criminal records data (DBS certificates), and professional registration numbers. A single data breach can trigger ICO enforcement action, reputational damage, and loss of NHS framework contracts.

This guide sets out the key obligations under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018 (DPA 2018) that every healthcare staffing agency should understand.

Who does this apply to?

If your agency collects, stores, or processes personal data about candidates, clients, or workers — and every healthcare staffing agency does — you are a data controller under UK GDPR. This means you are legally responsible for how that data is used, protected, and deleted.

If you use a staffing platform or payroll provider that processes data on your behalf, they are a data processor. You must have a written Data Processing Agreement (DPA) in place with every processor. This is not optional.

The six lawful bases for processing

Every piece of processing activity must have a lawful basis. For healthcare staffing agencies, the most commonly applicable bases are:

Lawful Basis

When it applies

Contract	Processing necessary to fulfil your contract with a candidate or client (e.g. booking a shift, processing a timesheet)
Legal obligation	Processing required by law (e.g. right-to-work checks, DBS disclosure obligations under the Rehabilitation of Offenders Act)
Legitimate interests	Processing for genuine business purposes where the candidate's rights are not overridden (e.g. marketing to existing candidates about relevant shifts)
Consent	Where no other basis applies — marketing to new candidates, processing certain health data

Note that consent is often the wrong lawful basis for employment-related processing. Because of the power imbalance between an agency and a candidate seeking work, consent given in an employment context is rarely freely given and therefore not valid. Use contract or legitimate interests where you can justify them.

Special category data: the higher standard

Healthcare staffing agencies routinely handle data that falls into the special category bucket under Article 9 UK GDPR:

• Health data: Hepatitis B vaccination records, occupational health assessments, pregnancy and maternity
• Criminal records data: DBS certificates and disclosure information (technically governed by Article 10 and Schedule 1 DPA 2018)
• Biometric data: Where you use fingerprint or facial recognition for time and attendance

Special category data requires both a lawful basis (Article 6) and an additional condition (Article 9). For healthcare staffing, the most relevant additional conditions are:

• Employment law obligation (Schedule 1, Part 1, para 1 DPA 2018) — covers processing necessary to comply with your obligations as an employer or agency
• Substantial public interest (Schedule 1, Part 2 DPA 2018) — covers processing for safeguarding purposes and occupational health
• Explicit consent — where no other condition applies

You must document which conditions you rely on for each category of special category data.

DBS certificates: what you can and cannot do

DBS (Disclosure and Barring Service) checks are a legal requirement for most healthcare roles. However, many agencies are unaware of the specific rules governing how DBS information can be handled.

Key rules:

1. You cannot retain copies of DBS certificates beyond a reasonable period for the purpose of verification. The DPA Code of Practice on Employment suggests no longer than 6 months in most cases.

2. You cannot share DBS information with third parties (including client NHS trusts) without the individual's consent, except where legally required.

3. You must have a DBS policy — a written policy on the use of DBS disclosures in employment decisions.

4. Spent convictions — the Rehabilitation of Offenders Act 1974 applies. Most healthcare roles are exempt (you can ask about spent convictions), but you must process this information with appropriate safeguards.

If you subscribe to the DBS Update Service on behalf of candidates, you can check the status of an existing DBS certificate online. This is far more efficient than re-applying for a new certificate every time a candidate joins a new agency.

Retention periods: how long can you keep candidate data?

One of the most frequently asked questions we receive from agencies is: "How long can we keep candidate records?"

There is no single answer, but the following is a reasonable framework:

Data type

Recommended retention period

Reason

Active candidate records	Duration of relationship + 1 year	Legitimate interests (re-engagement)
Compliance documents (DBS, NMC, training)	7 years from last placement	Employment law, HMRC requirements
Timesheet and payroll data	7 years	HMRC record-keeping obligations
Right-to-work documents	2 years after end of employment	Immigration Rules
Unsuccessful applications	6 months	ICO Employment Practices Code
Communication logs (SMS, WhatsApp, email)	2 years	Legitimate interests (dispute resolution)

After the retention period expires, data must be securely deleted — not just moved to an archive. You should have automated deletion workflows in place, not a manual process that depends on someone remembering.

The right to erasure ("right to be forgotten")

Candidates have the right to request that you delete their personal data. This right is not absolute — it does not apply where you have a legal obligation to retain the data (e.g. HMRC payroll records) — but you must respond to requests within one month.

When you receive an erasure request, you must:

1. Verify the identity of the requester

2. Identify all systems where their data is held (your ATS, email, messaging platforms, payroll, your staffing software)

3. Delete the data from all systems, or document why a legal exemption applies

4. Inform any processors who hold the data

This is operationally complex for agencies using multiple disconnected systems. A unified staffing platform with a built-in GDPR data export and deletion workflow significantly reduces the compliance burden.

Data subject access requests (DSARs)

Any individual whose data you hold can request a copy of all personal data you hold about them. You have one calendar month to respond, and you cannot charge a fee for most requests.

DSARs from candidates or former candidates are relatively common, particularly when an employment relationship has ended on difficult terms. You should have a clear process for handling them.

Security obligations

UK GDPR requires "appropriate technical and organisational measures" to protect personal data. For healthcare staffing agencies, this means at minimum:

• Encryption at rest: All candidate data stored in your systems should be encrypted. AES-256 is the current standard.
• Encryption in transit: All data transmitted between your systems and users should use TLS 1.2 or higher.
• Access controls: Role-based access — only staff who need access to specific data should have it. Consultants should not be able to access payroll data; finance staff should not be able to access DBS records.
• Multi-factor authentication: Required for any system containing personal data.
• Breach response plan: You must be able to notify the ICO of a data breach within 72 hours of becoming aware of it. You should have a written breach response procedure.

ICO registration

Almost all healthcare staffing agencies are required to register with the Information Commissioner's Office (ICO) as data controllers. Registration costs £40–£2,900 per year depending on your size. Failure to register is a criminal offence.

You can check whether you need to register and do so at ico.org.uk/registration.

Practical next steps

If you are not already fully compliant, prioritise the following:

1. Conduct a data audit: Map every category of personal data you hold, where it is stored, the lawful basis for processing, and how long you retain it. Our compliance checklist for onboarding locum staff covers the document types you should be tracking.

2. Update your privacy notices: Candidates must be informed about how their data is used at the point of collection. Most agencies' privacy notices are out of date.

3. Sign DPAs with all processors: Your staffing software provider, payroll provider, background check provider, and cloud storage provider.

4. Implement automated retention and deletion: Manual processes will fail. Use a platform with built-in data lifecycle management.

5. Train your team: Every staff member who handles personal data must understand their obligations.

UK GDPR compliance is not a one-time project. It requires ongoing attention as your business evolves and as ICO guidance develops. The cost of getting it right is modest. The cost of getting it wrong — financially and reputationally — is not.