Sophos Global Job Candidate Privacy Notice

1. General 

1.1 This notice is designed to provide information on how we deal with the privacy of job applicants who apply to Sophos for a job and the personal data we hold about them during the recruitment process.

1.2 If you live in California, please also read our California Supplement, which sets out additional information and rights under California law.

1.3 This document was last updated on 5 November 2026.

2. About this document

2.1 This is the privacy notice of the Sophos group of companies (“Sophos” “we”, “us”, “our”). The Sophos entity responsible for the processing of your personal data (the “controller”) is the company which would employ you for the relevant position if you were to be successful. Please check the list of Sophos Affiliates for more information. If you have questions about the relevant controller, please contact us using the contact details provided under the “Contact us” section below. Sophos will process and collect personal data about you and we recognise the need to treat that data in an appropriate and lawful manner, in accordance with applicable privacy laws.

2.2 The purpose of this notice is to provide you with information regarding the types of personal data we process about you,  why we process them, who we share them with, how long we keep them, and your rights in relation to them.

2.3 “Processing” includes collecting, using, holding, storing, disclosing, recording and destroying your personal data .

2.4 “Personal data” or “personal information” means information relating to you that identifies you or could be used to identify you alone or in combination with other information.  

2.5 “Sensitive data” means all personal information identified as such under applicable data protection laws and includes genetic data, biometric data, data concerning a person’s sex life or orientation, racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership and health.

2.6 This notice is subject to change and any change will be notified on this page.

2.7 Where permitted by law, by providing your personal information you consent to our use of your information in accordance with this notice.

3. How we collect your personal data

3.1 We collect and use your personal data as part of our recruitment activities, including to assess applications and improve our recruitment process. The personal data we collect depends on your interactions with us, what you choose to submit as part of the application and selection process, and how far in the selection process you progress. 

3.2 We will only collect sensitive data if you have voluntarily submitted such data to us or if permitted by applicable data protection law. 

3.3 We will normally collect your personal data directly from you. We may also obtain personal data about you from third-party sources, such as recruitment agencies, job boards, publicly available sources, recruitment assessment centres, referees and occupational health professionals. Where we receive such information from these third parties, we will only use it in accordance with this notice. In some cases, they will be acting as a controller of your information and therefore we advise you to read their privacy notice.

3.4 Detail of the categories of personal data and what we use it for is provided in section 4. 

4. Personal data we collect, how we use it and our legal basis

4.1 We use your personal data for the purposes set out below. For each purpose, we also set out the legal basis we rely on, where applicable law requires one.

(a) To comply with our legal obligations. This includes the following information:

• information needed to confirm your right to work in the country where the role is based, as required by immigration laws, such as your nationality, residency and work permit status, and passport and visa documents;
• identity documents, such as your passport or national identity card, to verify your identity;
• information we are required to disclose or retain to comply with court orders or other legal process; and
• driving licence information, if the role you apply for involves driving company vehicles.

(b) To pursue our legitimate interests as a business. This includes the following information:

• your contact details, such as your name, address, telephone number and email address, so we can communicate with you about the recruitment process;
• your CV, education and employment history, and professional qualifications and certifications, so we can assess your suitability for the role(s) you apply for or are considered for;
• references from referees to verify your experience and suitability for the role;
• notes made during or after your interviews, either by us directly or using automated tools, so we can make fair and informed hiring decisions;
• the results of any pre-employment checks (see section 6), to verify the information you provide and assess your suitability for the role;
• information processed using AI-assisted tools to support the assessment of your application (see section 8);
• emails, voicemails and other communications you exchange with us during the recruitment process, so we can manage the process and keep an accurate record;
• CCTV footage if you visit our premises, to protect ourproperty and premises and for health and safety reasons;
• information about your application and its progress through the recruitment process, so we can analyse and improve our recruitment process;
• information needed to establish, exercise or defend legal claims, including in relation to the recruitment process;
• information obtained from checks to detect, investigate and prevent recruitment fraud, in order to protect the integrity of our recruitment process; and
• system and security logs relating to your use of our recruitment systems, to protect your information and our systems against loss, theft or unauthorised access.

(c) To take steps to enter into a contract with you. This includes the following information:

• your salary and benefits expectations, so we can prepare a job offer; and
• other information needed to prepare and enter into an employment contract with you, such as your availability, notice period and start date.

(d) Where you have given your consent. We will ask for your consent when we collect the relevant personal data, for example to use your details for future opportunities, for equal opportunities monitoring and for biometric ID verification. You can withdraw your consent at any time.

5. How we use your sensitive data

5.1 Where permitted by applicable law, we process your sensitive data only for the following purposes:

• adjustments to the recruitment process: health or disability information you choose to share, so we can make reasonable adjustments and comply with our obligations under employment, social security, social protection, equality and health and safety laws;
• pre-employment medical assessment: where required for the role, and only after a conditional offer of employment, a qualified occupational health professional may assess your fitness for the role in compliance with applicable occupational medicine requirements;
• equal opportunities monitoring: where local law permits, we may invite you to provide information such as your ethnic origin, religion or belief, disability or sexual orientation. Providing this information is voluntary and based on your explicit consent. It will not affect your application;
• identity verification: biometric data, with your explicit consent, as described in section 7; and
• legal claims: where necessary to establish, exercise or defend legal claims, including claims relating to the recruitment process.

5.2 We may process information about criminal convictions, as described in section 6.

6. Background checks

To support our legitimate interests in maintaining a secure and trusted workplace and assessing your suitability for a position before you start work, we may carry out background checks before you start work. Any checks will be necessary and proportionate to the role for which you have applied. Where permitted by applicable law, the personal data we process may include information about criminal convictions. We will inform you before initiating any background check.

7. Biometric ID verification

7.1 Once you are selected for an interview or accept our job offer, we need to verify your identity. With your explicit consent we or our service provider will use biometric technology to compare a live selfie with your passport photo. Your biometric data will be deleted after verification within the timeframe communicated to you at the time of the ID verification.  

7.2 Your explicit consent will be sought at the time of the ID verification.  You may withdraw consent at any time before completing verification.

7.3 If you do not wish to proceed with the biometric identification, your identity will be verified manually by Sophos HR. 

8. Use of artificial intelligence in recruitment

8.1 Sophos uses artificial intelligence ("AI") and automated tools provided by our service providers to support certain stages of the recruitment process. These tools may be used for:

(a) supporting the assessment of candidate suitability for a role based on qualifications and role requirements; and

(b) scheduling interviews and managing recruitment workflows.

8.2 All decisions regarding your application, including whether to progress you to the next stage, offer you a position or reject your application, are made by trained Sophos recruiters and hiring managers. AI tools are used to support and inform human decision-making and do not replace it. No decision that produces legal or similarly significant effects will be made about you by solely automated means without meaningful human review.

8.3 We take steps to ensure that AI tools used in our recruitment process operate fairly and without unlawful discrimination.

8.4 We process your personal data using AI tools on the basis of our legitimate interests in assessing applications efficiently and consistently, and in identifying suitable candidates for our roles.

8.5 You can ask for your application to be assessed without the use of AI tools by following the instructions on the application page. If you opt out, a member of our recruitment team will review your application manually, and this will not affect how your application is considered.

8.6 If you have questions or concerns about our use of AI in the recruitment process, please contact us using the details provided in the "Contact us" section below.

9. Others who may receive or have access to your personal data

9.1 We may share your personal data internally, including with other Sophos Affiliates, for the purposes set out in this notice. Access is limited to those who need it, such as members of our HR and recruitment teams and the hiring managers and interviewers involved in recruiting for the role you have applied for.

9.2 We may share your personal data with our service providers where necessary to facilitate assessments for your desired role.

9.3 For successful applicants, we may share your personal data with third parties, agents, subcontractors and other organisations, as listed below, for the purposes of providing services to us or directly to you on our behalf to facilitate onboarding.

(a) occupational health providers;

(b) financial product providers;

(c) pension providers;

(d) insurance providers;

(e) employee benefits providers; and

(f) providers of legal services.

9.4 We may share your personal data with the relevant local government and law enforcement agencies in order to comply with our legal obligations.

9.5 When we use third party suppliers or providers, we only disclose to them any personal information that is necessary for them to provide their service and we have a contract in place that requires them to keep your information secure and not to use it other than in accordance with our specific instructions.

10. Where we store your personal data 

10.1 Your personal data is stored electronically on our secure servers.

10.2 For individuals residing in the European Economic Area (EEA), the UK or Switzerland: we may transfer your personal data to, or store it in, countries located outside of the EEA, the UK or Switzerland (as applicable). Your personal data may be transferred to the countries in which Sophos Affiliates are located (as listed at the end of this notice), or where other third-party service providers operate from, including the United States, Canada, India, the Philippines, Australia and other jurisdictions. We ensure that appropriate safeguards are in place for each such transfer as required by applicable privacy laws. The safeguards we rely on include: 

(a) transfers to countries that have been recognised as providing an adequate level of data protection by the European Commission, the UK Government or the Swiss Federal Council (as applicable);

(b) the European Commission's standard contractual clauses (for transfers from the EEA); for transfers from the UK, either the UK International Data Transfer Agreement (IDTA) or the EU standard contractual clauses supplemented by the UK International Data Transfer Addendum issued by the Information Commissioner; and, for transfers from Switzerland, the EU standard contractual clauses with the adaptations required under Swiss data protection law; and

(c) any other appropriate safeguards permitted under applicable privacy laws.

11. How long we keep your personal data

11.1 We keep your personal data for as long as is necessary for the purposes set out in this notice, including to comply with our legal obligations, and in accordance with applicable laws.

11.2 When you apply for a job vacancy which we have advertised, we will compile and keep an electronic file containing information about you which relates to your application for a job with us. Your information will be kept secure and will be used for the purposes of your job application.

11.3 If you are offered and you accept a job with us, your personal data will be transferred to an electronic personnel file. When your employment with us ends, we will retain your personal data in accordance with our employee data retention notice.

11.4 If you do not join us, Sophos will retain your application records for the retention period applicable in the country where the role is based. If you consent to Sophos retaining your information so that we can consider you for future opportunities, we will offer you the opportunity to retain your records for an additional 12 months. At the end of the applicable period, we will remove details that directly identify you and retain a limited record of your application (such as the role, location and stages of the recruitment process) for reporting and analytics purposes for one year, after which time it will be deleted. 

11.5 In some circumstances we may retain your personal data for longer periods of time, for instance, where we are required to do so to establish, exercise or defend legal claims.

11.6 If you have questions about the retention period applicable to your personal data, please contact us using the details provided in the "Contact us" section below.

12. Your duties

We encourage you to ensure that the information that we hold about you is accurate and up to date by keeping us informed of any changes to your personal data. You can do this by updating your details within our Applicant Tracking System.

13. Your rights

13.1 Under applicable privacy laws, you may have the following data protection rights:

• the right to access, delete or request portability of your personal data;
• the right to ask us to correct or update your personal data, or ask us to restrict the processing of your personal data;
• the right to object to the processing of your personal data where we rely on our legitimate interests as the legal basis for processing;
• where we have collected and process your personal data with your consent, then you can withdraw your consent at any time.

13.2 In connection with our use of AI in the recruitment process, you may:

• ask for your application to be assessed without the use of AI tools, by following the instructions on the application page (see section 8.5).

13.3 To exercise any of these rights, please submit a request via our data protection rights request portal. 

13.4 Please note some of the rights detailed above are not absolute and may not be applicable in certain scenarios. We respond to all requests we receive from individuals wishing to exercise their data protection rights in accordance with applicable privacy laws.

14. Complaints

If you have a complaint about our processing of your personal data, please contact us first using the contact details provided under the “Contact us” section below. If you are unhappy with our response, you have the right to complain to the data protection authority in your country.

15. Contact us

If you have any questions about this privacy notice, need this notice in an alternative format or language, or have any complaints about the manner in which we treat your personal data, please contact our Data Protection and Privacy team at [email protected].

California Supplement to the Sophos Global Job Candidate Privacy Notice

1. Scope

This supplement adds to the Sophos Global Job Candidate Privacy Notice (the “Notice”). It does not replace it. It applies only if you live in California, and it sets out additional disclosures required by the California Consumer Privacy Act (the “CCPA”). The Notice applies to you in full, except where this supplement says otherwise. Together, the Notice and this supplement are our Notice at Collection and privacy policy for California job applicants.

2. Categories of personal information

The table below covers the 12 months before the “Last updated” date and the information we collect going forward. Purposes, sources and recipients are described in Sections 3 to 10 of the Notice.

3. Retention

We keep your personal information as described in section 11 of the Notice.

4. Disclosures of California Information

We may disclose each category of personal information listed in Section 2 to the recipients described in Section 9 of the Notice, for the purposes described there, except biometric information, which we disclose only to our identity verification service provider

5. Sale, sharing and sensitive personal information

We do not sell or share applicant personal information, and we have not done so in the preceding 12 months. We use sensitive personal information only for purposes permitted under Cal. Code Regs. tit. 11, § 7027(m), so the right to limit its use does not apply.

6. Additional California rights

In addition to the rights in Section 13 of the Notice:

1. Your right of access includes the right to know the categories of personal information we hold about you, its sources, the purposes we use it for, and the categories of third parties we disclosed it to.
2. We will not retaliate against you for exercising your privacy rights.
3. We verify requests by matching the details you give us against our applicant records. An authorized agent may submit a request for you with your signed, written permission. We may ask you to confirm your identity with us directly.