Open call for evidence

Data flows you can trust: privacy notice

Published 15 July 2026

This notice sets out how we will process your personal data, and your rights. It is provided to meet the obligations as set out in Articles 13 and 14 of UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018 (DPA).

This privacy notice explains how the Department for Science, Innovation and Technology (DSIT) will process personal data submitted in response to the Data Flows You Can Trust Call for Evidence. The Call for Evidence seeks views and evidence on how the UK’s data regime supports trusted international data flows.

The Department for Science, Innovation and Technology is the Data Controller for the use of personal data covered by this privacy notice.

1. Your data

We will process personal data that you provide when responding to the Call for Evidence. This may include your name, organisation name, role or job title, contact details, views and evidence included in your response, and any other personal data you choose to include in your response.

We do not ask you to provide special category data. Please do not include special category data in your response unless it is necessary to support the evidence you are providing.

2. Purpose

To receive, manage, analyse and summarise responses to the Data Flows You Can Trust Call for Evidence. We will use responses to inform policy development on trusted international data flows and the operation of the UK’s international data transfer framework. We may contact you to follow up on your response, if you have agreed that we may do so.

An anonymised version of your response may be published in a list of responses, in a summary of responses received, and in any subsequent review reports.

3. Legal basis of processing

The legal basis for processing your personal data under Article 6 of the UK GDPR is public task. Processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in DSIT as the data controller. This task is to gather evidence to inform government policy development on international data flows and the UK’s data protection framework.

4. Recipients

Your personal data may be accessed by DSIT officials and analysts involved in administering the Call for Evidence, analysing responses and producing reports or summaries of the findings. We do not plan to share personal data with other government departments. We may, however, share summaries of findings in anonymised or aggregated form.

We may use artificial intelligence tools to assist officials in handling and analysing responses.

SmartSurvey is a contracted provider, and their survey platform is used to collect your personal data and survey responses.  As part of this survey, SmartSurvey, will collect essential cookies such as your IP address and your browser to stop multiple responses and to make sure that the survey displays correctly. Read the full cookies policy from SmartSurvey.

As part of our IT infrastructure, your personal data will be stored in the UK on systems provided by our data processors - Microsoft and Amazon Web Services. This does not mean we actively share your personal data with these entities; rather, they are technical service providers who host infrastructure supporting our IT systems. 

5. Retention

Your personal data will be kept by us for 2 years in line with DSIT retention policy.

6. Automated decision making

Your personal data will not be subject to automated decision making.

7. International transfers

Your personal data may be processed and transferred outside the UK or EEA. Where your personal data is processed outside the UK, the UK Adequacy Regulations will generally be relied upon for required safeguards, and always in accordance with Chapter 5 of the UK GDPR.

8. Your rights

You have the right to:

• request information about how your personal data are processed, and to request a copy of that personal data.
• request that any inaccuracies in your personal data are rectified without delay.
• request that any incomplete personal data are completed, including by means of a supplementary statement.
• request that your personal data are erased if there is no longer a justification for them to be processed.
• in certain circumstances (for example, where accuracy is contested) to request that the processing of your personal data is restricted.
• object to the processing of your personal data where it is processed on the basis of public task.

To exercise your rights please contact the Data Protection Officer using the contact details below.

9. Contact details

The data controller for your personal data is the Department for Science, Innovation and Technology (DSIT). You can contact the DSIT Data Protection Officer at:

DSIT Data Protection Officer
Department for Science, Innovation & Technology
22-26 Whitehall
London
SW1A 2EG

Email: dataprotection@dsit.gov.uk

10. Complaints

If you are unhappy with the way we have handled your personal data, please write to the department’s Data Protection Officer in the first instance using the contact details above.

You may also make a complaint to the Information Commissioner, who is a UK independent regulator. The Information Commissioner can be contacted at:

Information Commissioner’s Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF

Telephone: 0303 123 1113

https://ico.org.uk/make-a-complaint/

Any complaint to the Information Commissioner is without prejudice to your right to seek redress through the courts.

11. Updates to this notice

If this privacy notice changes in any way, we will place an updated version on this page. Regularly reviewing this page ensures you are always aware of what information we collect, how we use it, and under what circumstances we will share it with other parties. The ‘last updated’ date at the bottom of this page will also change.

If these changes affect how your personal data is processed, we will take reasonable steps to let you know.

Last updated: 15 July 2026