The audit terms and the data processing agreement
An addendum to the BIOR Membership Terms (Version 2.1, 18 September 2026), accepted by the member when an audit is started. Last updated 22 October 2026.
A. The audits
1. Scope This addendum applies when an Agency Member applies for the BIOR Recruitment Audit (the status BIOR Audited) or the BIOR Education Supply audit (the status Education Supply Certified), together the audits. The audits are available only to members holding current Agency Membership and BIOR certification.
2. The standard Each audit is conducted against the published standard current on the day of application (the Audit Criteria for the product, with its version number). BIOR audits only against that standard; matters outside it are outside the audit's scope.
3. What the member provides The documents, declarations and placement or worker files the standard names, uploaded through the dashboard, redacted to the standard's rule, complete and truthful. The sample is selected by the published rule from the member's complete list of placements, and BIOR may substitute a placement where the list appears incomplete. The member confirms it has the right to share the evidence and has told the people concerned through its privacy notice.
4. The outcome BIOR issues one of three outcomes within ten working days of a complete submission, in the words the standard uses, with each finding and the standard it rests on. A status is held for two years from the outcome date, subject to the annual declaration and to continued membership and certification.
5. Fees The audit fee and the renewal fee are those shown on the payment step on the day of application, plus VAT (£895 plus VAT for each two-year cycle at the date of this addendum). The fee is payable on application and is not refundable once BIOR has begun reading the submission; a member that withdraws before submission receives a refund less an administration charge of £95. There is no fee for the annual declaration.
6. The annual declaration At twelve months the member makes the declaration the standard describes within thirty days. A declaration not made within thirty days shows the status as due on the public record, and after a further thirty days as lapsed.
7. Renewal, lapse and withdrawal The status lapses on its expiry date unless renewed by a further audit, and lapses the same day if the member's Agency Membership or certification lapses. BIOR may suspend a status where a declaration proves untrue when made or where it finds a serious breach of the law the standard rests on, and may withdraw it under the disciplinary procedure of the Code; for the Education Supply audit, remedial action and sanctions are agreed with the Government Commercial Agency as the Memorandum of Understanding provides.
8. The public record BIOR publishes the status, its dates, the standard version and the locations covered on the member's verification page, in the directory and on the register pages, and withdraws them when the status ends. The member may use the audit mark only while the status is current and only in the forms BIOR supplies.
9. Data protection For the audit the member is the controller and BIOR the processor of personal data in the files; the data processing agreement in part B applies and is accepted with this addendum. BIOR deletes uploaded evidence ninety days after the outcome and keeps the checklist, findings and outcome for the life of the status plus one year.
10. Reporting For the Education Supply audit, BIOR reports to GCA and DfE as the Memorandum requires, including serious breaches within five working days, and the member accepts that reporting as a condition of the audit.
11. Complaints and appeals The published complaints procedure applies. An appeal against an outcome is made to the Director-General within ten working days and decided within fifteen by a reviewer who did not conduct the audit.
12. Liability The audit is a documentary review of a sample. It is not legal advice, not a guarantee of compliance, and not a substitute for the member's own obligations to any client, worker, framework or regulator. BIOR's liability in connection with an audit is limited to the fee paid for it, save where the law does not permit a limit.
B. Data protection
The data processing agreement
The member (controller) instructs BIOR (processor) to process the personal data in the documents it uploads for the sole purpose of conducting the audit and issuing the outcome. The data are those of candidates, workers and staff as redacted to the standard. BIOR processes only on the member's instructions in this agreement; keeps the data confidential; limits access to its named reviewers and to the sub-processors listed at ior.org/sub-processors (hosting, email and the help panel's answering service), each bound by written terms, processing only on BIOR's instructions and retaining nothing beyond the period those terms state; the member instructs its staff not to enter personal data into the portal's help panel; applies appropriate technical and organisational security (encrypted storage and transfer, access logs, named-user accounts); assists the member with data subject requests that relate to the audit; deletes the uploaded evidence ninety days after the outcome and the checklist, findings and outcome one year after the status ends; and tells the member without undue delay of any personal data breach. BIOR does not transfer the data outside the UK except to a sub-processor under UK adequacy or appropriate safeguards, listed in BIOR's privacy policy. The member warrants that it has a lawful basis for the processing and has informed the data subjects.
The redaction and retention rule
Names to initials except the DBS certificate holder's on the education audit; no dates of birth, home addresses, bank details or photographs; National Insurance numbers to the last three characters. Evidence deleted ninety days after the outcome; the checklist and outcome kept for the status plus one year.
The paragraph for your own candidate privacy notice
"Our processes and a sample of our placement files are audited by our professional body, The British Institute of Recruiters, every two years. For the audit, copies of documents from a small number of files, with names reduced to initials and dates of birth, addresses and bank details removed, are read by BIOR's reviewers to check that we did what the law requires. BIOR deletes the copies within ninety days of its decision. You can ask us which, if any, of your documents were included."
The sub-processors
The companies that process data for BIOR in the audit, what each does and where the data is held are listed at ior.org/sub-processors. Members are told of a change thirty days before it takes effect.
The British Institute of Recruiters, company number 07575583. Questions about these terms: support@ior.org, 0161 232 0991.