British companies are still largely not complying with the European Union’s General Data Protection Regulation when it comes to the handling of criminal records of convicted people during the job application process, according to the co-author of a guidance on the matter.

The short answer to remaining compliant with the GDPR: Don’t ask for criminal records at the job application stage.