Open call for evidence

Data regulation in the age of AI and data-intensive technologies: privacy notice

Published 15 July 2026

This notice is provided to meet the obligations as set out in Articles 13 and 14 of UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018 (DPA). This notice sets out how we will use your personal data and your rights.

DSIT is conducting a call for evidence, which invites any person or organisation to provide their views on data intermediaries to help inform future policy in the area.

The Department for Science, Innovation and Technology (DSIT) is the Data Controller for the use of personal data covered by this privacy notice.

1. Your data

We will process the following personal data:

• Names, contact details, organisation of respondents, and role / job title

2. Purpose

We are processing your personal data for the purposes of the call for evidence:

• so that we can contact you to discuss your response in greater detail
• to inform policy development to support key sectors in DSIT and other relevant public bodies
• for statistical data, for example the types of individuals and groups participating

You can leave out personal information from your response entirely if you would prefer to do so.

3. Legal basis of processing

The legal basis for processing your personal data under Article 6 of the UK GDPR is;

1(e)Public task: processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the data controller, i.e. a call for evidence which provides ministers and government officials with information about businesses in order to inform future policy development.

4. Recipients

We publish a list of responses to the call for evidence, in a summary of responses received, and in any subsequent review reports. If we do this, these responses will be anonymised. We will take all reasonable measures to ensure that neither you nor the organisation you represent are identifiable, and any responses used to illustrate findings will be anonymised.

We sometimes use a website called ‘SmartSurvey’ to design and host online consultations. The SmartSurvey Privacy Policy and Notice explains how they collect, safeguard and process your data.

As part of our IT infrastructure, your personal data will be stored in the UK on systems provided by our data processors - Microsoft and Amazon Web Services. This does not mean we actively share your personal data with these entities; rather, they are technical service providers who host infrastructure supporting our IT systems.

Your personal data may be shared with DSIT officials and analysts involved in managing, analysing and summarising responses to the Call for Evidence. We may also share relevant information with other government departments or public authorities where this is necessary to inform policy development, support collective government working, or comply with a legal obligation. We do not plan to share any personal data with other UK government departments or public authorities; instead, we may provide a summary of key findings in anonymised form. We would only share personal data with other UK government departments or public authorities where in circumstances where it would be necessary to support policy development related to this call for evidence.

DSIT officials may use artificial intelligence to assist with the handling and analysis of responses

5. Retention

We will retain personal data for up to 2 years to allow for analysis, follow-up engagement with respondents where necessary, and completion of policy development activities arising from this call for evidence. Personal data will be deleted sooner where it is no longer required.

6. International transfers

Your personal data will be processed in the UK.

7. Your rights

You have the right to:

• request information about how your personal data is processed, and to request a copy of that personal data
• request that any inaccuracies in your personal data are rectified without delay
• request that any incomplete personal data is completed, including by means of a supplementary statement
• request that your personal data are erased if there is no longer a justification for it to be processed
• in certain circumstances (for example, where accuracy is contested) to request that the processing of your personal data is restricted
• object to the processing of your personal data where it is processed for direct marketing purposes

To exercise your rights please contact the Data Protection Officer using the contact details below.

8. Contact us or make a complaint

Contact the DSIT Data Protection Officer (DPO) if you:

• have any questions about anything in this document
• think that your personal data has been misused or mishandled

DSIT Data Protection Officer

Department for Science, Innovation and Technology

22-26 Whitehall

London

SW1A 2EG

Email dataprotection@dsit.gov.uk

You can also make a complaint to the Information Commissioner’s Office (ICO) (supervisory authority), who is the UK independent regulator.

Contact the ICO:

Email icocasework@ico.org.uk

Contact form ico.org.uk/make-a-complaint/

Telephone 0303 123 1113

Any complaint to the Information Commissioner is without prejudice to your right to seek redress through the courts.

9. Updates to this notice

If this privacy notice changes in any way, we will place an updated version on this page. Regularly reviewing this page ensures you are always aware of what information we collect, how we use it, and under what circumstances we will share it with other parties. The ‘last updated’ date at the bottom of this page will also change.

If these changes affect how your personal data is processed, we will take reasonable steps to let you know.

Last updated: 15 July 2026