Privacy Notice

This privacy notice below outlines how CPANI handles personal information we collect or receive.

Data controller

Data Protection Officer

Information we may collect from you and/or receive about you

The need to collect personal data will arise in regard to all of our statutory functions as a regulator. The type of personal data we may collect from you varies according to the nature of the engagement or activity we may be involved in. This privacy notice tells you what to expect when the Commissioner for Public Appointments for Northern Ireland (CPANI) collects or receives personal information. It applies to information we collect or receive about:

1. People who submit a query to the Commissioner or her office.
2. People who submit a complaint for investigation by the Commissioner.
3. People who submit an application to the Commissioner for the role of Independent Assessor.
4. People who attend a CPANI workshop.
5. People whose details are provided to the Commissioner in the course of the CPANI audit investigation process, or the CPANI compliance programme.
6. People who are appointed as CPANI Independent Assessors.

Some examples of the type of personal data we may collect and/or receive during the normal course of our duties are:

• name and date of birth
• contact details - email, home address
• visual images, including personal appearance
• employment details

We may also collect and/or receive sensitive personal data which may include:

• physical or mental health details
• political opinions
• offences (including alleged offences)
• criminal and legal proceedings, outcomes and sentences

1. People who submit a query to the Commissioner or her office.

Where a query is submitted to CPANI we will only use the data supplied to us to deal with the query and any subsequent issues, and to check on the level of service we provide. CPANI will not share any personal data provided. Data provided will be retained for 5 years in line with the CPANI retention and disposal schedule. It will be retained in a secure environment and access to it will be restricted according to the ‘need to know’ principle.

2. People who submit a complaint for investigation by the Commissioner.

When we receive a complaint from a person we make up a file containing the details of the complaint. This normally contains the identity of the complainant and any other individuals involved in the complaint.
We will only use the personal information we collect to process the complaint and to check on the level of service we provide. We do compile and publish statistics showing information like the number of complaints we receive, but not in a form which identifies anyone.

We usually have to disclose the complainant’s identity to whoever the complaint is about. This is inevitable where, for example, the accuracy of a person’s record is in dispute. If a complainant doesn’t want information identifying him or her to be disclosed, we will try to respect that. However, it may not be possible to handle a complaint on an anonymous basis.

Following the completion of a complaint investigation the Commissioner will publish her findings in a report. This report will be published on the CPANI website in an anonymous format following in agreement with the complainant.

Data provided will be retained for 7 years in line with the CPANI retention and disposal schedule. It will be retained in a secure environment and access to it will be restricted according to the ‘need to know’ principle.

NB. All information supplied by any third party for consideration during a complaint investigation which is not retained in the complaint file, will be returned to the owner or destroyed in a confidential manner as soon as possible following publication of the final report.

3. People who submit an application to the Commissioner for the role of Independent Assessor.

All of the information you provide during the application process will only be used for the purpose of progressing your application.

We will not share any of the information you provide during the recruitment process with any third parties for marketing purposes or store any of your information outside of the European Economic Area. The information you provide will be held securely by us whether the information is in electronic or physical format.

We will use the contact details you provide to us to contact you to progress your application. We will use the other information you provide to assess your suitability for the role you have applied for. 
We do not collect more information than we need to fulfil our stated purposes and will not retain it for longer than is necessary.

The information we ask for is used to assess your suitability for appointment. You don’t have to provide what we ask for but it might affect your application if you don’t. 

We will ask you for your personal details including name and contact details. We will also ask you questions about your previous experience and for answers to questions relevant to the role you have applied for. The recruitment team will have access to all of this information.

You will also be asked to provide equal opportunities information. This is not mandatory information – if you don’t provide it, it will not affect your application. This information will not be made available to any staff outside of our recruitment team. Any information you do provide, will be used only to produce and monitor equal opportunities statistics.

A selection panel will shortlist applications for interview. They will not be provided with your name or contact details or with your equal opportunities information if you have provided it.

If you are unsuccessful at any stage of the process, data provided will be retained for 5 years in line with the CPANI retention and disposal schedule. It will be retained in a secure environment and access to it will be restricted according to the ‘need to know’ principle.

If you are successful, the information you provide during the application process will be retained by us as part of your personnel file for the duration of your tenure plus 7 years following the end of your tenure. 
Information generated throughout the assessment process, for example interview notes, is retained by us for 6 months following the closure of the campaign.

Equal opportunities information is retained in an anonymous format, separate from your application, for 7 years following the closure of the campaign whether you are successful or not.

You are able to ask about decisions made about your application by speaking to your contact within the CPANI recruitment team.

4. People who attend a CPANI workshop, or express an interest in attending.

When a person contacts CPANI with regards attending one of the CPANI workshops, their name and the contact details they provide will be used to provide that person with information about any upcoming workshops and their attendance. We will only use this information to remain in contact with that person regarding the workshop. People will be asked if they are content for their details to be used in this way. Once a person has attended a workshop their name and contact details will be retained and used to inform them about any additional CPANI initiatives that we consider that person might be interested in. Workshop attendees will be asked if they are content for their details to be used in this way.  This personal data will be retained securely for 5 years.

5. People whose details are provided to the Commissioner in the course of the CPANI audit investigation process, or the CPANI compliance programme.

Under the Commissioner for Public Appointments (Northern Ireland) Order 1995 (as amended) the functions of the Commissioner include the following:

• The Commissioner shall carry out an audit to review the policies and practice of department in making public appointments to establish whether the code of practice is being observed.
• The Commissioner may from time to time conduct an inquiry into the policies and practices pursued by a Department in relation to any public appointment or description of any public appointment. 

In the course of these functions CPANI may receive personal data provided to Government Departments during the application process for a public appointment. This data is provided to CPANI to allow the Commissioner to fulfil the legal obligations set out above. This data will include any information provided by a person in the application form for the public appointment, and any ensuing correspondence the applicant may have had with the Department.

CPANI will not share this information with any third party. The data will be destroyed in a confidential manner or return to the relevant Department as soon as possible following completion of the audit investigation process. It will be retained in a secure environment and access to it will be restricted according to the ‘need to know’ principle.

Applicants for any public appointment should be informed by the relevant Department that any data they provide may be shared with the Commissioner as part of the CPANI regulatory function.

6. People who are appointed as CPANI Independent Assessors.

CPANI will create and maintain a personnel file for any person appointed as an Independent Assessor. This file will contain their original application documentation for the post, as well as the following.

• Details of any political activity
• Details on any current interests

Data provided will be retained for 7 years (following the end of the tenure as an Independent Assessor) in line with the CPANI retention and disposal schedule. It will be retained in a secure environment and access to it will be restricted according to the ‘need to know’ principle.

To enable the payment of Independent Assessors they will be set up as a ‘payroll only employees’, the following personal data will be shared with HR Connect at the beginning of their term. This data will be used solely for this purpose. Further information on HR connect is available on request.

• Bank details
• National Insurance number
• Name and contact details

Complaints or queries

CPANI tries to meet the highest standards when collecting and using personal information. For this reason, we take any complaints we receive about this very seriously. We encourage people to bring it to our attention if they think that our collection or use of information is unfair, misleading or inappropriate. We would also welcome any suggestions for improving our procedures.

This privacy notice was drafted with brevity and clarity in mind and we are happy to provide any additional information or explanation needed. Any requests for this should be sent to the address below.

Access to personal information

CPANI wishes to be as open as it can be in terms of giving people access to their personal information. Individuals can find out if we hold any personal information by making a ‘subject access request’ under the Data Protection Act 1998. If we do hold information about you we will:

• give you a description of it;
• tell you why we are holding it;
• tell you who it could be disclosed to; and
• let you have a copy of the information in an intelligible form.

Changes to this privacy notice

We keep our privacy notice under regular review. This privacy notice was last updated on 02 January 2023.

What rights do I have?

• You have the right to obtain confirmation that your data is being processed, and access to your personal data.
• You are entitled to have personal data rectified if it is inaccurate or incomplete.
• You have a right to have personal data erased and to prevent processing, in specific circumstances.
• You have the right to ‘block’ or suppress processing of personal data, in specific circumstances.
• You have the right to data portability, in specific circumstances.
• You have the right to object to the processing, in specific circumstances.

Further information is available from the Information Commissioner’s Office.

How do I complain if I am not happy?

If you are unhappy with how any aspect of this privacy notice, or how your personal information is being processed, please contact

If you are still not happy, you have the right to lodge a complaint with the Information Commissioner’s Office (ICO):