Solutions
Discover our enterprise solutions that best suit your needs
Resources
Take a look at our latest articles, resources and industry updates.
About Us
Take a look at some of our open roles.
×
Michael Page, which includes the brands Page Executive and Page Outsourcing (together “Michael Page”, “we”, “us”, “our”), provides recruitment and staffing services to enterprise clients through this website. We are committed to protecting the privacy of candidates, clients, business contacts and users of our services globally. This policy explains how we collect, use, share and protect personal data in accordance with the UK General Data Protection Regulation, the EU General Data Protection Regulation and other applicable data protection laws in the jurisdictions in which we operate. It applies to candidates and prospective candidates, clients and their representatives, suppliers, business partners and users of our websites, platforms and tools.
The relevant Michael Page or Page Outsourcing entity acting as the data controller will depend on the nature of the services provided and the location of the engagement. As part of a global group, different entities may be involved in delivering services, and details of the applicable controller are made available through engagement documentation, contractual terms, and website disclosures. If you are unsure which entity is responsible for your personal data, or you wish to exercise your rights, you can contact us at dpo@michaelpage.com and we will identify the relevant controller and direct your request appropriately.
Where we act as a controller
Michael Page may act as either a data controller or a data processor, depending on the service model. As a data controller, Michael Page determines the purposes and means of processing personal data. This includes core recruitment activities such as sourcing candidates, assessing suitability for roles, maintaining talent pools, engaging with clients, conducting business development, and operating websites and recruitment platforms. This aligns with the organisation’s core recruitment and CRM-based activities.
Where we act as a processor
Where Michael Page delivers Recruitment Process Outsourcing (RPO), Managed Service Provider (MSP) services, or embedded/on-site recruitment solutions, it typically acts as a data processor on behalf of its clients. In these cases, the client determines the purposes and means of processing, and Michael Page processes personal data strictly in accordance with the client’s instructions and applicable contractual arrangements, including data processing agreements. In practice, this includes operating within client systems such as applicant tracking systems or vendor management systems, progressing candidates through hiring processes, and carrying out recruitment administration on behalf of the client. In these cases, the client is the controller and the client’s own privacy notice is the primary notice that applies to you; this notice explains only the limited role Michael Page plays as processor.
Where we act in both roles
In certain delivery models, particularly within our outsourcing services and managed-service programs, Michael Page may act in both roles simultaneously. For example, Michael Page may act as a controller when sourcing candidates from its own databases or external platforms, while acting as a processor when managing candidates within a client’s recruitment system. This reflects the dual operational structure inherent in many outsourcing and shared service centre models used across global recruitment delivery.
Michael Page collects and processes personal data relevant to the services it provides. For candidates, this typically includes identity and contact details, CV information, employment history, qualifications, interview notes, assessment results, compensation expectations, and compliance-related information such as right to work checks. Personal data may also be obtained from publicly available sources such as professional networking sites in the context of candidate sourcing. For clients and business contacts, personal data includes names, job titles, contact details, records of communications, and information relating to hiring requirements and feedback on recruitment services. For users of websites and digital platforms, technical information such as IP addresses, device information, and usage data may be collected, including through cookies and similar technologies.
Personal data is used to provide recruitment and staffing services, match candidates with suitable opportunities, manage relationships with clients and business contacts, respond to enquiries, improve services and platforms, and carry out marketing and business development activities where permitted by law. These uses reflect the operational requirements of a global recruitment business and support ongoing engagement with both candidates and clients. When acting as a processor, personal data is used solely to deliver services on behalf of clients in accordance with their instructions.
Michael Page relies on several legal bases for processing personal data. These include performance of a contract where processing is necessary to deliver recruitment services, compliance with legal obligations, legitimate interests such as providing and improving services and maintaining business relationships, and consent where required, particularly in relation to marketing communications or specific talent pooling activities. Individuals have the right to withdraw consent where processing is based on consent.
Some processing may involve special category data or information about criminal convictions and offences — for example, where we carry out right to work checks or background and criminal record screening. Where we process this data, we rely on an additional condition under Article 9 or Article 10 of the UK and EU GDPR (and, in the UK, a corresponding condition under Schedule 1 to the Data Protection Act 2018), such as the substantial public interest, employment, or legal obligation conditions, and we maintain an appropriate policy document where required.
Personal data may be shared within Michael Page, including with group entities and shared service centres supporting recruitment activities, IT services, and operational functions across different regions. This reflects the global delivery model of Michael Page, where services may be supported by teams located in multiple jurisdictions. Personal data may also be shared with clients in connection with recruitment opportunities, with third party service providers such as IT suppliers and background screening providers, and with regulatory or governmental authorities where required by law.
Where suppliers or third-party agencies are involved in providing candidate information, they are required to ensure that appropriate lawful bases for processing are in place and that candidates are directed to Michael Page’s privacy notice and any relevant client privacy notice prior to the sharing of personal data.
As a global organisation, Michael Page may transfer personal data internationally, including outside the UK and European Economic Area. In such cases, appropriate safeguards are implemented to ensure that personal data remains protected, including the use of Standard Contractual Clauses, UK data transfer mechanisms and intra-group agreements governing transfers between Michael Page entities.
Personal data is retained for as long as necessary to fulfil the purposes for which it was collected, considering legal, regulatory and contractual requirements. Retention periods may vary depending on the nature of the data, the services provided, and the applicable jurisdiction. Michael Page operates retention policies to ensure that data is not kept longer than necessary and acknowledges that data availability may be subject to such policies in practice.
Individuals have rights in relation to their personal data under applicable data protection laws. These include the right to access their data, request rectification or erasure, restrict or object to processing, request data portability, and withdraw consent where relevant. Requests can be made through the contact details provided by Michael Page, including via its privacy or data protection teams.
Michael Page implements appropriate technical and organisational measures to safeguard personal data, including access controls, secure systems, and governance processes such as data protection impact assessments where required. These processes are designed to identify and mitigate risks associated with the processing of personal data, particularly in higher-risk activities or complex global delivery models.
Cookies and similar technologies are used on Michael Page websites and platforms to provide functionality, analyse usage, and support service improvement and personalisation. Further information is provided in the applicable cookie policy.
Individuals have the right to lodge a complaint with a relevant supervisory authority if they believe their data protection rights have been infringed, including the UK Information Commissioner’s Office or the applicable authority in their jurisdiction.
For further information about how personal data is processed, or to exercise data protection rights, individuals can contact the relevant Michael Page entity or its data protection or privacy team using the contact details made available in its communications or on its website.
Click here to learn more about the applicable Privacy Policy in each country.
Version 1.0. Last updated: 24/08/2026. We may update this notice from time to time; the current version is always available on this website.
