Applicant and Recruitment Privacy Policy
Applicant and Recruitment Privacy Policy
DAC Beachcroft is an international legal business which operates through separately constituted and regulated legal entities providing legal and/or claims handling services in accordance with the relevant laws of the Jurisdictions in which the different entities operate.
DAC Beachcroft is committed to protecting the data of all people we deal with. Our Applicant and Recruitment Privacy Policy ("Policy") is divided into separate sections for ease of reference. Each section sets out important information about how DAC Beachcroft may collect and use data depending upon the categories of individuals whose data we process (such reference to “data” means all forms of personal data).
This Policy applies if you are applying to join us as an employee, member, contractor, consultant, temporary or agency staff, trainee solicitor, apprentice, or applying for work experience. It applies globally, and contains jurisdiction-specific provisions detailed in the Appendix below. Unless a capitalised term is defined in the body of this Policy or the context requires otherwise, the term has the meaning ascribed to it in the table set out in the Appendix.
The use of words and/or phrases such as "DAC Beachcroft", "we", "us" or "our" is for convenience only and refers to any of the entities listed on our website, each of which is a separate data controller in its own right.
WHAT DATA WE COLLECT AND WHERE DO WE GET IT FROM
DAC Beachcroft will collect, use and store your data for a wide variety of reasons in connection with your relationship with us and we collect your data from a range of sources.
The table below sets out the main categories of data that we collect and the sources we collect it from. The table is not exhaustive.
|
Type of data |
Source of data |
|
Contact and personal information including your name, home address, personal telephone number(s) and/or personal e-mail address), date of birth and gender |
You, recruitment agencies and where appropriate existing colleagues |
|
Work history and other relevant experience including information contained in CV, cover letter and/or job application form |
You, recruitment agencies, former employers, third party referencing and vetting (see further below) and publicly available resources such as LinkedIn |
|
Education information including degrees awarded, transcripts and other information provided in support of the job application |
You, recruitment agencies, third party referencing and vetting (see further below) and publicly available resources such as LinkedIn |
|
Reward history |
You and recruitment agencies |
|
Interviews including information collected during phone screenings/interviews, interviews virtually and/or interviews in person such as details regarding the type of employment sought, desired salary, willingness to relocate, job preferences, other information related to compensation and/or benefits and information related to previous applications to us or previous employment history with us |
You, our IT and other systems, building access records and CCTV recordings |
|
Reference information and information received from background checks (where applicable) |
You, former employers, third party referencing and vetting (see further below), official bodies such as regulators or criminal records bureaus |
|
Right to work, documents evidencing your right to work (including information about your immigration status where relevant) |
You, third party referencing and vetting (see further below) and official bodies such as regulators
|
|
Photographs and filmed footage |
You |
Referencing and vetting
As part of our referencing and vetting referred to above, we may contact certain third parties in order to verify your personal information (including personal information that you provide as part of the application and recruitment process). These third parties may include:
- former employers in order to verify your previous employment history, this may include contacting your current or former accountants where you are or were self-employed or an agency where you were paid through the agency (this information will be treated as confidential);
- universities and/or other establishments for higher education that you attended in order to verify your education history;
- other institutes in order to verify other qualifications (such as CIPD);
- verification agencies to verify your credit reference, directorships, identification and criminal record checks; and/or
- professional bodies in order to verify membership.
We will only seek this information in relation to successful candidates that have accepted a conditional offer of employment with us and we will specifically inform such candidates that we will be contacting these third parties in advance of doing so.
Please note that the majority of the data to be provided by you is mandatory in connection with our recruiting activities. Failure to provide mandatory data may affect our ability to accomplish the purposes stated in this Policy, including considering your suitability for employment and/or entering into an employment contract with you.
HOW WE USE YOUR DATA
DAC Beachcroft uses your data for a variety of purposes in order to take steps necessary to enter into a contract with you, to comply with legal obligations or otherwise in pursuit of our legitimate business interests.
We have set out in the table below the main purposes for which your data may be processed and the ‘lawful basis’ for the processing i.e. the legal reason we are able to process your data. The list below is non-exhaustive, and is subject to any Applicable Data Protection Legislation in your Jurisdiction. For information regarding how we use cookies and similar technologies in connection with your use of our website, applications and digital platforms or forms of communication, please read our Cookies Policy.
Personal data
|
What we use your personal data for |
Our reasons / lawful basis |
|
Corresponding with you or to others (electronically and/or physically (e.g. by letter, fax, telephone (including within any recording or transcription), email, secure sharing portal or SMS), which may include the use of third party suppliers (such as electronic signature providers)) |
For legitimate interest |
|
Verifying candidate information and carrying out confidential reference checks, employment and background (including social and adverse media) screening checks, where applicable and/or in order to prevent fraud |
For a legitimate interest |
|
To identify and evaluate job applicants, including assessing skills, qualifications and experience |
For a legitimate interest |
|
Communicating with you about the recruitment process and your application |
For a legitimate interest |
|
To comply with our legal, regulatory, or other corporate governance requirements |
For a legitimate interest |
|
For the purposes of conducting data analytics to review and better understand the operation of our recruitment processes |
For a legitimate interest |
|
To consider you for other roles that may be appropriate for you |
For a legitimate interest
|
|
For the purposes of marketing and promotional activity |
For a legitimate interest
|
|
For retention on your employment record (if you are offered and accept employment with us) so we may use it in connection with your employment (in accordance with our Colleague Privacy Policy available internally) |
To perform our contract with you For a legitimate interest To comply with legal and regulatory obligations |
Special Categories of Personal Data
|
What we use special categories of personal data for |
Our reasons / lawful basis |
|
To comply with obligations owed to disabled colleagues |
To perform our contract with you
To comply with legal and regulatory obligations
For legitimate interest
To comply with employment law |
|
To carry out criminal record checks as part of our background vetting process |
Consent To comply with legal and regulatory obligations For legitimate interest
Consent For substantial public interest |
|
To conduct equal opportunities and treatment monitoring relating to recruitment, progression and remuneration |
Your special categories of personal data will be treated as highly confidential and will only be shared internally where there is a specific and legitimate purpose to do so.
When possible, monitoring relating to equal opportunities, treatment and engagement will be conducted using anonymised data (when anonymising data is not possible, monitoring will be conducted on a confidential basis) so individual colleagues cannot be identified. Data used for monitoring purposes will be maintained separately from general management and HR records.
WHEN WE SHARE DATA
DAC Beachcroft may, as follows, share your data with the following main parties in certain circumstances and where it is necessary to achieve the purposes detailed above:
- Recruitment agencies;
- Referencing & vetting specialists;
- Occupational health providers;
- HMRC (in the UK), Revenue (in Ireland) and/or any other applicable government body;
- Criminal records bureaus;
- Public domain (this includes within DAC Beachcroft's internal publications, printed media, external website, and social media sites);
- Accountants, lawyers and other professional advisers;
- Our regulators;
- Service providers (for example (but not limited to) screening check providers, online application service providers and video interviewing platform providers); and /or
- Diversity and inclusion partners
The list above is not exhaustive.
INTERNATIONAL TRANSFERS OF DATA
As a leading international law business, DAC Beachcroft may transfer data to recipients located outside the jurisdiction where services are being provided or received. For example, this may be in relation to cross-jurisdictional legal advice, or where we are sharing information with our colleagues within the DAC Beachcroft Group, our global network and/or third party service providers.
Each Jurisdiction (where members of the DAC Beachcroft Group operate) has its own data protection laws and regulations. To ensure consistency and compliance with applicable laws and regulations, all DAC Beachcroft Group entities have entered into our Intra-Group Data Processing and Transfer Agreement, which incorporates the most up to date EU Standard Contractual Clauses ("SCCs") and the UK International Data Transfer Addendum to those EU SCCs.
Where we transfer data internationally (and, in the case of transfers to a country where an adequacy decision is not available), we ensure the relevant contractual measures are in place as required by the applicable legislation in that Jurisdiction.
As a leading international legal practice, we have robust IT security systems and policies in place to ensure appropriate protection of your data. This is underpinned by our ISO 27001 and Cyber Essentials Plus accreditations, which are certified by independent auditors.
OUR USE OF ARTIFICIAL INTELLIGENCE
In order to process your application, we use an online application service provided by Pinpoint. When applying for a job role with us, Pinpoint collects and processes your data on our behalf. Some of the processing activities carried out by Pinpoint involve the use of Artificial Intelligence.
Artificial Intelligence (or "AI") is a term used for a range of technologies that can replace manual processes and solve complex tasks by carrying out functions that previously required human action. Tasks that we have traditionally undertaken by thinking and reasoning may be undertaken by, or with the help of, AI.
We use AI to support our existing activities. This means that how we collect your personal information and the types of personal information we use do not change.
We use AI to expediate and improve the way we manage candidate applications. For example, AI helps us to:
- produce high quality notes during the interview process;
- identify skills within candidate CV's and apply those skills identified as a tag to the candidate record for easy identification; and
- create digestible summaries of interview comments.
HOW WE KEEP DATA SECURE
We have appropriate technical and organisational measures in place to protect data. We limit access to data to those who have a genuine business need to access it. Those processing data will do so only in an authorised manner and are subject to a duty of confidentiality. We continually test our systems and are ISO 27001 (UK and Ireland offices only) and Cyber Essentials PLUS certified (all offices), which means we follow industry standards for information security.
We also have procedures to deal with any suspected data breach. We will notify you and any applicable regulator of a suspected data security breach where we are legally required to do so.
HOW LONG WE KEEP DATA
DAC Beachcroft's policy is to retain data only for as long as needed to fulfil the purpose(s) for which it was collected, or otherwise as required under Applicable Data Protection Legislation and/or regulations and/or business continuity purposes. Under some circumstances we may anonymise your data so that it can no longer be associated with you. We reserve the right to retain and use such anonymous data for any legitimate business purpose without further notice to you.
DAC Beachcroft will typically retain data for periods set out below subject to any exceptional circumstances and/or to comply with any Applicable Data Protection Legislation in your Jurisdiction or regulations and/or business continuity purposes:
For unsuccessful candidates:
- We will typically retain your data collected during the recruitment process for a maximum period of 2 years from the end of the process subject to any exceptional circumstances and/or to comply with particular jurisdictional laws and/or regulations and/or business continuity purposes.
- We may retain your data for a longer period than 2 years in order to follow up with you in relation to future vacancies; if you do not wish for your data to be maintained for this purpose, please inform us at Recruitment.optout@dacbeachcroft.com.
For successful candidates:
- If you are offered and accept employment with us, the data we collected during the application and recruitment process will become part of your employment record and we may use it in connection with your employment in accordance with our Colleague Privacy Policy available internally.
YOUR RIGHTS IN RELATION TO YOUR DATA
DAC Beachcroft will always seek to process your data in accordance with our obligations, our rights and your rights.
You will not be subject to decisions based solely on automated data processing without your prior consent.
In certain circumstances, you have the right to seek the erasure or correction of your data, to object to particular aspects of how your data is processed, and otherwise to seek the restriction of the processing of your data. You also have the right to request the transfer of your data to another party in a commonly used format.
You have a separate right of access to your data processed by DAC Beachcroft. You may be asked for information to confirm your identity and/or assist DAC Beachcroft to locate the data you are seeking as part of DAC Beachcroft's response to your request. If you wish to exercise your rights, please contact our Office of the General Counsel using the details outlined below ('How to contact us').
HOW TO MAKE A COMPLAINT
Should you have any concerns or wish to raise a complaint regarding our processing of your data, we would like the opportunity to work with you to resolve them. You can report a concern or raise a complaint by contacting our Office of the General Counsel using the details outlined below ('How to contact us').
You also have the right to raise any concerns or complain to the relevant Data Protection Supervisory Authority (as detailed in the Appendix) about how your data is being processed. We have elected the Data Protection Commission ('DPC') as our Lead Supervisory Authority within the EU.
HOW TO CONTACT US
If you have any questions about this Policy, want to exercise any of your rights in relation to your data as set out above or want to raise any concerns or complain about how your data is being processed, please use our contact details below in the first instance:
Email: ogc@dacbeachcroft.com
Post: Office of the General Counsel
DAC Beachcroft
St Paul's House
23 Park Square South
Leeds
United Kingdom
LS1 2ND
DO YOU NEED EXTRA HELP?
If you would like this Policy in another format (for example audio or large print), please contact us (see ‘Where can you get further information’ above).
CHANGES TO THIS POLICY
We may update this Policy from time to time to reflect changes in our practices, legal obligations, or technology.
This Policy was last updated in May 2026.
APPENDIX – JURISDICTIONS
This Appendix contains jurisdiction-specific information for every applicable DAC Beachcroft entity.
Further details on the DAC Beachcroft Group can be found on our website.
UNITED KINGDOM
DAC Beachcroft LLP, DAC Beachcroft Claims Limited, DAC Beachcroft Services Limited, DAC Beachcroft (International) Limited
|
Jurisdiction |
England & Wales |
|
Data Protection Officer |
|
|
Data Protection Regulatory Authority |
Information Commissioner's Office (ICO). Website: https://ico.org.uk/ Contact: +44 (0) 303 123 1113 or casework@ico.org |
|
Certification Bodies |
Solicitors Regulatory Authority (SRA). International Organisation for Standardization (ISO). |
|
Applicable Data Protection Legislation |
Data Protection Act 2018. The UK General Data Protection Regulation (GDPR). The above list is non-exhaustive. The laws cited are applicable as amended, updated or re-enacted from time to time. |
DAC Beachcroft (N. Ireland) LLP
|
Jurisdiction |
Northern Ireland |
|
Data Protection Officer |
|
|
Data Protection Regulatory Authority |
Information Commissioner's Office (ICO). Website: https://ico.org.uk/ Contact: +44 (0) 303 123 1113 or casework@ico.org |
|
Certification Bodies |
Law Society of Northern Ireland. International Organisation for Standardization (ISO). |
|
Applicable Data Protection Legislation |
Data Protection Act 2018. The UK General Data Protection Regulation (GDPR). The above list is non-exhaustive. The laws cited are applicable as amended, updated or re-enacted from time to time. |
DAC Beachcroft Claims Scotland LLP, DAC Beachcroft Scotland LLP
|
Jurisdiction |
Scotland |
|
Data Protection Officer |
Alan Taylor (DAC Beachcroft Claims Scotland LLP) Mathew McGee (DAC Beachcroft Scotland LLP) |
|
Data Protection Regulatory Authority |
Information Commissioner's Office (ICO). Website: https://ico.org.uk/ Contact: +44 (0) 303 123 1113 or casework@ico.org |
|
Certification Bodies |
Law Society of Scotland. International Organisation for Standardization (ISO). |
|
Applicable Data Protection Legislation |
Data Protection Act 2018. The UK General Data Protection Regulation (GDPR). The above list is non-exhaustive. The laws cited are applicable as amended, updated or re-enacted from time to time. |
ASIA PACIFIC
DAC Beachcroft Hong Kong
|
Jurisdiction |
Hong Kong |
|
Data Protection Officer |
|
|
Data Protection Regulatory Authority |
Office of the Privacy Commissioner for Personal Data (PCPD). Website: https://www.pcpd.org.hk/ Contact: +852 2827 2827 |
|
Certification Bodies |
Law Society of Hong Kong |
|
Applicable Data Protection Legislation |
Personal Data (Privacy) Ordinance. The above list is non-exhaustive. The laws cited are applicable as amended, updated or re-enacted from time to time. |
DAC Beachcroft Pte. Ltd
|
Jurisdiction |
Singapore |
|
Data Protection Officer |
|
|
Data Protection Regulatory Authority |
Personal Data Protection Commission (PDPC). Website: https://www.pdpc.gov.sg/ Contact: +65 6377 3131 |
|
Certification Bodies |
Legal Services Regulatory Authority (LSRA). |
|
Applicable Data Protection Legislation |
The Personal Data Protection Act 2012. The above list is non-exhaustive. The laws cited are applicable as amended, updated or re-enacted from time to time. |
EUROPE
DAC Beachcroft France Association d'Avocats à Responsabilité Professionnelle Individuelle (AARPI)
|
Jurisdiction |
France |
|
Data Protection Officer |
|
|
Data Protection Regulatory Authority |
National Commission for Information Technology and Freedoms ("Commission nationale de l'informatique et des libertés – CNIL"). Website: https://www.cnil.fr/ Contact: +33 (0) 1 53 73 22 22 |
|
Certification Bodies |
National Council of Bar Associations ("Conseil National des Barreaux"). Paris Bar Association ("Barreau de Paris"). |
|
Applicable Data Protection Legislation |
Law No. 2018-493 of 20 June 2018 incorporating the General Data Protection Regulation into French law in Law No. 78-17 of 6 January 1978 on information technology, files and freedoms. Any applicable guidance or codes of practice issued by Working Party 29, the European Data Protection Board, or any applicable data protection regulator from time to time. The above list is non-exhaustive. The laws cited are applicable as amended, updated or re-enacted from time to time. |
DAC Beachcroft Ireland LLP
|
Jurisdiction |
Ireland |
|
Data Protection Officer |
|
|
Data Protection Regulatory Authority |
Data Protection Commission (DPC). Website: https://dataprotection.ie/ga Contact: +353 1800437 737 or info@dataprotection.ie |
|
Certification Bodies |
Legal Services Regulatory Authority (LSRA). |
|
Applicable Data Protection Legislation |
The Data Protection Acts 1988 to 2018 (each as amended, updated or re-enacted from time to time) The European Communities (Electronic Communications Networks and Services) (Privacy and Electronic Communications) Regulations 2011 (S.I.No.336/2011) Any applicable guidance or codes of practice issued by Working Party 29, the European Data Protection Board, or any applicable data protection regulator from time to time. The above list is non-exhaustive. The laws cited are applicable as amended, updated or re-enacted from time to time. |
DAC Beachcroft Italia Società tra Avvocati a responsabilità limitata (S.t.A.r.l)
|
Jurisdiction |
Italy |
|
Data Protection Officer |
|
|
Data Protection Regulatory Authority |
Guarantor for the Protection of Personal Data ("Garante per la Protezione dei Dati Personali – GPDP"). Website: https://www.garanteprivacy.it/ Contact: +39 06 696771 |
|
Certification Bodies |
National Bar Council ("Consiglio Nazionale Forense"). Milan Bar Association("Ordine degli Avvocati di Milano"). |
|
Applicable Data Protection Legislation |
Legislative Decree No. 101 of 10 August 2018 implementing the GDPR. Any applicable guidance or codes of practice issued by Working Party 29, the European Data Protection Board, or any applicable data protection regulator from time to time. The above list is non-exhaustive. The laws cited are applicable as amended, updated or re-enacted from time to time. |
DAC Beachcroft Sociedad Limitada Profesional Unipersonal (SLPU)
|
Jurisdiction |
Spain |
|
Data Protection Officer |
|
|
Data Protection Regulatory Authority |
Spanish Data Protection Agency ("Agencia Española de Protección de Datos – AEPD"). Website: https://www.aepd.es/ Contact: + 34 900 293 183 |
|
Certification Bodies |
Illustrious Bar Association of Madrid ("Ilustre Colegio de la Abogacía de Madrid – ICAM"). General Council of Spanish Lawyers ("Consejo General de la Abogacía Española"). |
|
Applicable Data Protection Legislation |
Organic Law 3/2018 on Personal Data Protection Any applicable guidance or codes of practice issued by Working Party 29, the European Data Protection Board, or any applicable data protection regulator from time to time. The above list is non-exhaustive. The laws cited are applicable as amended, updated or re-enacted from time to time. |
LATIN AMERICA
DAC Beachcroft Chile Limitada
|
Jurisdiction |
Chile |
|
Data Protection Officer |
|
|
Data Protection Regulatory Authority |
The Council for Transparency ("Consejo para la Transparencia") is the body responsible for ensuring compliance with Law 20,285/2008. Nevertheless, the Council does not have powers to impose fines. Council's website: https://www.consejotransparencia.cl/ Council's contact: +569 39289757 The National Consumer Service ("Servicio Nacional del Consumidor -SERNAC") has the competency to monitor compliance with the provisions of the data protection law in consumer matters. SERNAC's website: SERNAC's contact: +569 800 700 100 |
|
Certification Bodies |
Chilean Bar Association ("Colegio de Abogados de Chile"). |
|
Applicable Data Protection Legislation |
Law 19,628/1999 on the Protection of Private Life (DPL). Law 20,575/2012 establishing the 'purpose principle' for the processing of personal data of an economic, financial, banking or commercial nature. Law 19,223/1993 regulating computer crimes. Law 20,584/2012 regulating privacy within the healthcare sector. The above list is non-exhaustive. The laws cited are applicable as amended, updated or re-enacted from time to time. |
DAC Beachcroft Colombia Abogados Sociedad por Acciones Simplificadas (SAS)
|
Jurisdiction |
Colombia |
|
Data Protection Officer |
|
|
Data Protection Regulatory Authority |
Superintendency of Industry and Commerce ("Superintendencia de Industria y Comercio – SIC"). Website: https://www.sic.gov.co/content/data-protection-0 Contact: +571 5870000 ext.1275 or 1277 |
|
Certification Bodies |
Judiciary - Judicial Branch - Superior Council of the Judiciary ("Poder Judicial - Rama Judicial - Consejo Superior de la Judicatura"). |
|
Applicable Data Protection Legislation |
Article 15 of the Colombian Political Constitution. Law 1581 of 2012, which issues the General Provisions for the Protection of Personal Data. The above list is non-exhaustive. The laws cited are applicable as amended, updated or re-enacted from time to time. |
DAC Beachcroft Sociedad Civil (SC)
|
Jurisdiction |
Mexico |
|
Data Protection Officer |
|
|
Data Protection Regulatory Authority |
The National Institute for Transparency, Access to Information and Personal Data Protection ("Instituto Nacional de Transparencia, Acceso a la Información y Protección de Datos Personales -INAI"). Website: https://home.inai.org.mx/ Contact: +52 55 5004 2400 |
|
Certification Bodies |
The Illustrious and National Bar Association of Mexico ("El Ilustre y Nacional Colegio de Abogados de México"). |
|
Applicable Data Protection Legislation |
Federal Law on the Protection of Personal Data Held by Private Parties. The above list is non-exhaustive. The laws cited are applicable as amended, updated or re-enacted from time to time. |
DAC Beachcroft Perú Sociedad Anónima Cerrada (SAC)
|
Jurisdiction |
Peru |
|
Data Protection Officer |
|
|
Data Protection Regulatory Authority |
National Authority for the Protection of Personal DATA ("Autoridad Nacional de Protección de Datos Personales – ANPD"). Website: https://www.gob.pe/anpd Contact: +51 (1) 204 8020 Anexo 2410 ó protegetusdatos@minjus.gob.pe |
|
Certification Bodies |
Law Societies of Peru ("Colegios de Abogados del Perú"). |
|
Applicable Data Protection Legislation |
Personal Data Protection Act – LPDP (Act No. 29733). The above list is non-exhaustive. The laws cited are applicable as amended, updated or re-enacted from time to time. |
NORTH AMERICA
DAC Beachcroft LLP
|
Jurisdiction |
United States of America |
|
Data Protection Officer |
|
|
Data Protection Regulatory Authority |
The United States does not have a federal authority responsible for personal data protection. However, the Federal Trade Commission (FTC) fulfils this role in practice. Website: https://www.ftc.gov/ Contact: +1 (202) 326-2222 |
|
Certification Bodies |
American Bar Association (ABA). State Bar of California. The Florida Bar. New York State Bar Association. |
|
Applicable Data Protection Legislation |
California Consumer Privacy Act (CCPA), enacted in 2018, amended by the California Privacy Rights Act (CPRA). Florida Digital Bill of Rights (FLDBOR), into effect on July 1, 2024. New York State Stop Hacking and Improve Data Security Act (SHIELD), enacted on 25 July 2019. The above list is non-exhaustive. The laws cited are applicable as amended, updated or re-enacted from time to time. |
MIDDLE EAST
DAC Beachcroft LLP
|
Jurisdiction |
Dubai International Financial Centre |
|
Data Protection Officer |
|
|
Data Protection Regulatory Authority |
Commissioner of Data Protection |
|
Certification Bodies |
Dubai Financial Services Authority Government of Dubai Legal Affairs Department |
|
Applicable Data Protection Legislation |
DIFC Law No 5 of 2020 on Data Protection |
Who we are
Why choose DAC Beachcroft?
We’re a broad-based commercial firm serving a wide range of sectors with a strong heritage in insurance,
health and real estate. We combine excellent legal skills and cutting-edge delivery expertise to design
solutions that fit the needs of our clients – often involving clever uses of technology.
