Open call for evidence

Toys safety regulations: call for evidence - privacy notice

Published 6 July 2026

This privacy notice explains how the Department for Business and Trade (DBT), as a ‘data controller’, processes personal data as part of the Call for Evidence. 

This notice is supplemented by our main privacy notice which provides further information on how DBT processes personal data, and sets out your rights in respect of that personal data. 

1. Personal data DBT collects 

DBT collects information about: 

• Contacts of businesses  
• Experts in a particular industry 
• Event attendees  

DBT collects the following categories of personal data:

• your name 
• your email or postal address 
• depending on the topic of the consultation, other personal data such as your postcode or employment status 
• any personal data you volunteer by way of evidence or example in your response to the consultation 

If you respond online we may also collect: 

• your Internet Protocol (IP) address, and details of which version of web browser you used 
• information on how you used the site, provided by cookies and page tagging techniques 

2. Why DBT asks for this information and what happens if it is not provided 

DBT collects this information in order to: 

• identify any responses from bots or other fraudulent sources 
• to contact you regarding your response or related matters 
• to produce anonymous statistical data, for example about the types of individuals and groups participating 

3. The legal basis for processing your personal data 

The table below sets out the primary legal bases we rely on for processing the personal data we collect about you. 

3.1 Legal basis for processing 

Personal Data (Article 6(1) UK GDPR)	Special Category Data / Criminal Conviction Data
The lawful basis we are relying on to process your personal data is article 6(1)(e) of the UK General Data Protection Regulation (UK GDPR), which allows us to process personal data when this is necessary for the performance of our public tasks in the exercise of our official authority	N/A - If there is for any reason an incidental collection, it will not be processed

4. How DBT processes personal data it receives 

Once received your data will be: 

• Stored within DBT’s internal database which is managed by the Product Safety Policy team – there it will be independently assessed and reviewed against the relevant criteria 
• Once your personal data is no longer needed as part of the assessment any identifiers will be removed and a de-identified dataset will remain for audit purposes  

We will only process your personal data for purposes which are compatible with those specified in this privacy notice. This may include archiving in the public interest, or scientific, historical or statistical research, in accordance with Article 89 UK GDPR. Where your data is further used for research purposes, appropriate safeguards (including anonymisation, pseudonymisation and data minimisation techniques) will be used to ensure that your personal data is only processed where it is necessary for us to do so, and that it is processed lawfully and securely.  

Compatible research purposes may include analysis to further DBT policy development, or to analyse public consultation responses or similar requests for information from the public.  

We are trialling Artificial Intelligence (AI) solutions to support the delivery of our functions. In accordance with data protection law and ICO guidance, we will not use AI alone to make decisions about you, or to inform decisions about you, unless this has been made expressly clear to you in advance. Any use of AI will be subject to appropriate human oversight. 

4.1 Third Party Processors 

DBT uses Qualtrics survey software to process online responses, this involves personal data being sent outside the European Economic Area (EEA). Any processing outside of the EEA will be subject to the safeguards specified within the UK General Data Protection Regulation (UK GDPR), and the Data Protection Act 2018. 

5. Information sharing 

We may share personal data you provide: 

• With other government departments, public authorities, law enforcement agencies and regulators 
• With other third parties where we consider it necessary in order to further our functions as a government department 
• In response to information requests, for example, under Freedom of Information (FOI) law or the Environmental Information Regulations (EIR) 
• To a court, tribunal or party where the disclosure is necessary in order to exercise, establish or defend a legal claim 
• Where we are ordered to do so or where we are otherwise required to do so by law 
• With third party data processors as governed by contract 

Data transferred overseas will be done so lawfully on the basis of existing country-country adequacy assessments or with appropriate safeguards in place 

You can find out more detailed information about how we share data and further processing in the main privacy notice. 

6. How long will DBT hold your data for 

DBT will only retain your personal data for as long as necessary to fulfil the purposes we collected it for, including for the purposes of satisfying any legal, accounting, or reporting requirements.  

If we decide that we need to process your personal data for a reason which is incompatible with the purposes for which we collected it for, we will contact you to explain why we are doing this and why it is lawful to do so. 

To determine the appropriate retention period for personal data, we consider the amount, nature, and sensitivity of the personal data, the potential risk of harm from unauthorised use or disclosure of your personal data, the purposes for which we process your personal data and whether we can achieve those purposes through other means, and the applicable legal requirements. 

7. Your rights 

You have a number of rights available to you under UK data protection legislation, including: 

• the right to request copies of the personal data we hold about you 
• the right to request that we rectify information about you which you think is inaccurate or incomplete 
• the right to request that we restrict your data from further processing (in certain circumstances) 
• the right to object to the processing of your data (in certain circumstances) 
• the right to data portability (in certain circumstances) 
• the right to request that we erasure your data (in certain circumstances) 
• the right not to be subject to a decision based on solely automated data processing  

You can contact DBT’s Data Protection Officer for further information about how your data has been processed by the department or to make a complaint about how your data has been used. Please contact: data.protection@businessandtrade.gov.uk   

You can also submit a complaint to the Information Commissioner’s Office (ICO) at: 

Information Commissioner’s Office 
Wycliffe House Water Lane 
Wilmslow 
Cheshire 
SK9 5AF 

W: https://ico.org.uk/  

Tel: 0303 123 1113 

You can find out more about your rights as a data subject, and details of how to contact our Data Protection Officer and the ICO in our main privacy notice.