Greggs – Background and Context

Greggs is one of the UK’s largest bakery chains and a major North East employer. This case centres on the deletion of a Careers account during a live recruitment process, contradictory handling of a Subject Access Request (SAR), and the wider implications for governance and accountability.

Independent Application, TRJ Tick-Box Only

The complainant applied independently to Greggs for a database administration vacancy, using his own CV and without assistance from The Recruitment Junction (TRJ). The only TRJ link was a referral tick-box: “Where did you hear about this?” – answered as “The Recruitment Junction, Molly Beadle.”

The vacancy closed on 14 July 2025, and the applicant was shortlisted for interview. On 7 July 2025, TRJ CEO Beverley Brooks abruptly withdrew support, claiming all data had been deleted. This was a week before the vacancy deadline.

Deletion of Greggs Careers Account

On 14 July 2025 – the very day the vacancy closed – the complainant’s Greggs Careers account was deleted without explanation. Despite multiple emails to Greggs requesting clarification, no reason was provided.

The unexplained deletion of an active applicant’s account at the point of shortlisting raises serious concerns of obstruction and potential unlawful interference with both GDPR rights and fair recruitment.

Contradictory SAR Handling

On 2 August 2025, a Subject Access Request was submitted under Article 15 UK GDPR. The sequence was as follows:

• Greggs confirmed in writing that the SAR would be complied with in full.
• Less than an hour later, Greggs claimed to hold “no records matching the details provided.”
• When challenged, Greggs suggested the account deletion “may be the reason why” no records could be found.
• Greggs further implied that because the complainant already held copies of his own emails, they had no duty to disclose them as part of the SAR.

“If your Greggs Careers account was deleted, then this may be the reason why… You have copies of emails exchanged with this email address unless you have deleted them? Do you require us to send copies?”
— Greggs Data Protection Analyst, 20 August 2025

These responses are incompatible with UK GDPR. Under Article 15, organisations must provide a complete copy of personal data they process, not just what remains after deletions, and not selectively based on what they assume the data subject already possesses.

Legal and Equality Implications

The combination of unexplained account deletion, contradictory SAR handling, and dismissive responses raises the possibility of:

• Unlawful erasure of data during a live application process.
• Obstruction of SAR rights and non-compliance with Articles 5, 12, and 15 UK GDPR.
• Potential breach of the Equality Act 2010 in the handling of a disabled applicant’s data and access.

At a Glance, Timeline

• Independent application submitted to Greggs; TRJ named only in referral tick-box.
• Shortlisted for interview; vacancy closed 14 July 2025.
• 7 July 2025: TRJ abruptly withdraws support and claims data deletion.
• 14 July 2025: Greggs Careers account deleted without explanation.
• Multiple emails to Greggs ignored, no reason provided.
• 2 Aug 2025: SAR submitted under Article 15 UK GDPR.
• Greggs confirms compliance, then claims no records exist.
• 20 Aug 2025: Contradictory explanations offered, including account deletion “may be the reason.”
• Legal escalation initiated, pre-action correspondence in preparation.

Editor: Kieron JH. This record is based on verifiable correspondence and statutory rights. Silence, contradictions, and unexplained deletions are not compliance – they are accountability failures.