Skip to main content

Personal information charter

This personal information charter explains how we look after your information.

You can also read a short version of this guidance (PDF, 126 KB, 4 pages).

Introduction

This personal information charter acts as a foundational guide to privacy within the Home Office and is intended to be a general overview of privacy rights for data subjects (the public).

This personal information charter has been created to be clear and concise. It does not include the complete detail about what information we hold, every organisation the Home Office shares information with, how the information is collected or how long all information is kept.

This charter explains:

  • our overall information management policy

  • your rights as an individual (data subject), including how to ask for a copy of your personal information that we hold

  • who to contact if you have a complaint or concern

  • what we ask of you, including helping us by keeping your personal information accurate and up to date

The Home Office is based at:

2 Marsham Street
London
SW1P 4DF

Our standards

The use of personal information is governed by data protection legislation, this includes the UK GDPR and Data Protection Act 2018, and other relevant legislation.

When we ask you for personal information, we make sure that:

  • you know why we need it and what we are going to do with it

  • we only collect the information that is necessary

  • we don’t keep it longer than necessary

  • we keep your personal information secure

  • we only share information with other organisations when it is lawful to do so

  • you know how to request to access to the personal information we hold about you, and to obtain a copy of that information

  • you know how to tell us that you object to us processing your information and how to tell us if the information we hold about you is incorrect or if you want us to delete it

  • you know how to contact us and our Data Protection Officer

  • you know how to complain to the Information Commissioner if you are not happy with the way we process your information

To help us keep your information reliable and up to date, we ask you to:

  • give us accurate and up to date information

  • tell us as soon as possible if there are any changes such as a new address

Personal information that we collect and process

The Home Office uses your personal information to provide services, carry out our public functions and comply with relevant laws and regulations. We collect, process and share personal information to carry out several functions within the Home Office and in collaboration with our partners. These include:

  • keeping the UK’s border safe and controlling immigration

  • issuing passports

  • investigating, preventing, detecting and prosecuting crime

  • keeping public order and stopping anti-social behaviour

  • maintaining and developing policing databases including biometrics

  • confirming rights to benefits and services

  • considering applications for activities needing a government issued license

  • keeping the UK safe from the threat of terrorism

We may also use information we hold about you for reasons including:

  • to perform statistical analysis

  • to perform research

  • to verify your identity

  • supporting, managing and training our staff

  • when recruiting new staff

  • to comply with legal obligations

Examples of how we may process your data include:

  • when you travel to and from the UK

  • entering the UK through the border, such as at an airport

  • entering a country in the Common Travel Area

  • making an application to the Home Office

  • when you attend an interview at the Home Office

  • when you supply biometric data

  • when we receive intelligence from law enforcement agencies or other sources to prevent crime and fraud

  • incident details such as crime reports

  • notification of a relevant criminal conviction

  • sound and visual imagery, such as CCTV and facial recognition

We may obtain data from our CCTV, which collects and uses your personal data in image and audio form. It is used by the Home Office for maintaining the security of property and premises and for preventing and detecting crime.

We may also request information from third parties. This includes for the purposes of verifying information you supplied in support of an application, obtaining information needed for a safeguarding purpose, obtaining new address details of people we are trying to trace, or undertaking other enforcement actions. This may involve, for example:

  • gathering information from a sponsor or other third party in relation to an application

  • obtaining information from other government departments – these may include HM Revenue & Customs (HMRC), Department for Work and Pensions (DWP), Department for Education (DfE), Driver and Vehicle Licensing Agency (DVLA), and Driver and Vehicle Standards Agency (DVSA)

  • obtaining information from credit reference agencies, fraud prevention agencies or banks, and local authorities

  • seeking to verify documents, information, or identity in relation to your application or for some other relevant purpose – this may include private and public authorities in other countries

  • sharing information with a local authority to help support you with their services (for example, social services)

  • sharing information with United Kingdom health bodies for reasons relating to public health and to help you when using their services

The Home Office can only use your information where we have an appropriate legal basis to do so under the UK General Data Protection Regulation (UK GDPR) or the Data Protection Act 2018.

The legal basis will depend on why the Home Office is processing your information as it may be held and otherwise processed for a number of purposes.

The Home Office may be acting as a controller or processor of the data.

When acting as a controller, in most cases, the legal basis for the processing of your data will be Article 6(1)(e) of the UK GDPR, that the processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller.

We may also process special categories of personal data, in most cases, on the basis of Article 9(2)(g) of the UK GDPR, where the processing is necessary for reasons of substantial public interest.

We may process the following categories of personal data:

  • biometric data (such as facial images, fingerprints, and/or DNA)

  • personal identifiers, contacts, and characteristics (for example, name and contact details, such as email addresses and phone numbers, passport information)

  • employment information (for example organisation or department, profession, role, and background)

  • criminal offence data

  • racial or ethnic origin data, political opinions, religious beliefs, trade union membership or data concerning health, sex life of orientation

  • previous UK visits/residency, marital status and nationality

We may also process personal data under Part 3 (law enforcement processing) of the Data Protection Act 2018, for law enforcement purposes, that is for the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, including the safeguarding against and the prevention of threats to public or national security.

The legal basis for processing law enforcement data is section 35(2)(b) of the Data Protection Act 2018 where it is necessary for the performance of a task carried out for a law enforcement purpose.

Some of the data that the Home Office is processing is defined as ‘sensitive data’ in law. The legal basis for processing this sort of data is section 35(5) of the Data Protection Act 2018, this is where processing is strictly necessary for a law enforcement purpose.

If we have asked you to provide your consent in order to process your personal data, you also have the right to withdraw your consent at any time. When we ask for your consent, we will tell you how we will process your data, how long we will keep it for and the steps we will take to delete it. We will also outline the steps we will take if you decide to withdraw consent and explain your data protection rights.

The Home Office has specific privacy notices which explain how we collect and process personal information to fulfil our legal and official functions. These privacy notices provide more detailed information on:

  • what information (including special category data) we will process

  • where the Home Office is acting as a data controller or processor

  • which lawful basis data will be processed under

These privacy notices include:  

How we protect your personal information

We have a duty to safeguard and ensure the security of your personal information. We do that by having systems and policies in place to limit access to your information and prevent unauthorised disclosure. Staff who access personal information must have appropriate security clearance and a business need for accessing the information, and their activity is subject to audit and review.

How long we keep your personal information  

We will keep (retain) your personal information for only as long as is needed to:

  • provide you with a service

  • conduct our public functions in accordance with our records management policy

We may also keep it for longer to meet other legislative requirements, or to answer requests for information from ongoing or upcoming statutory inquiries.

Depending on the reasons why the Home Office is processing your information, and the type of information being processed it may be held for differing periods of time.

For more information about this please read the specific privacy notices issued by the Home Office.

Sharing information with others

Any personal information you provide will be held securely and processed in accordance with data protection and other relevant law, such as the Human Rights Act 1998 and the Immigration Act 2014.

We may (in accordance with data protection legislation) disclose your information to other organisations so that we can carry out our functions, or to enable others to perform theirs. Other organisations include, but are not limited to:

  • other government departments and agencies

  • local authorities

  • police and other law enforcement agencies

  • courts and other judicial bodies

  • foreign governments and other authorities

  • foreign law enforcement and judicial bodies

  • fraud prevention bodies

Where we pass any information about you to a third party, we will require them to hold it securely.

Depending on the reasons why the Home Office is processing your information, it may be shared with a number of other organisations, including and in addition to those listed above. Sometimes the Home Office may also appoint third parties to process personal data on our behalf.

For more information about this and to see if that affects the way your personal information is being shared, read the relevant privacy notices issued by the Home Office.

How to ask for your personal information

If the Home Office holds any personal data about you, you have the right to ask for a copy of it through a subject access request (SAR).

Guidance is available on how to ask for:

Additional guidance is also available on information rights.

Your rights

Under data protection law, you have rights including:

  • right of access – you have the right to ask us for copies of your personal data

  • right to rectification – you have the right to ask us to rectify personal data you think is inaccurate and the right to ask us to complete information you think is incomplete

  • right to erasure – you have the right to ask us to erase your personal data in certain circumstances

  • right to restriction of processing – you have the right to ask us to restrict the processing of your personal data in certain circumstances

  • right to object to processing – you have the right to object to the processing of your personal data in certain circumstances

Not all of these rights will apply in all circumstances.

Where we share responsibility for the data we hold about you with a third party we may direct you to them to exercise your rights. 

More information on which rights apply to your data can be found in the relevant privacy notices.

Further information

The Home Office has a Data Protection Officer (DPO) who you can contact if you want to complain about how the Home Office has managed and used your personal data.

Contacting the DPO by email at dpo@homeoffice.gov.uk is the quickest way to bring your questions and concerns to the attention of the office of the DPO.

If you are unable to email, you can write to the address below but this may mean that the Office of the DPO takes longer to reply.

Office of the DPO

Home Office
Peel Building
2 Marsham Street
London
SW1P 4DF

More information about the data protection complaints process for the Home Office is available here Home Office data protection complaints process - GOV.UK

Subject Access Request Unit

Email: subjectaccessrequest@homeoffice.gov.uk.

or write to:

Subject Access Request Unit (SARU)
2 Ruskin Square
Dingwall Road
Croydon
CR0 2WF

Information Rights Team

Email: Info.access@homeoffice.gov.uk

Or write to:

Home Office
Lower Ground Floor, Seacole Building
2 Marsham Street
London
SW1P 4DF    

Public Enquiries Team

Email: public.enquiries@homeoffice.gov.uk

Or write to:

Direct Communications Unit
2 Marsham Street
London
SW1P 4DF
United Kingdom

Telephone: 020 7035 4848

How to complain or report a concern

If you are not satisfied with the service that you have received, please contact the department within the Home Office which has been handling your case.

You also have the right to complain to the Information Commissioner’s Office about the way we handle your personal data or respond to your requests for access to your personal data or the exercise of your other rights under the UK GDPR or the Data Protection Act 2018.

You can contact the Information Commissioner’s Office by telephone on 0303 123 1113.

Email: icocasework@ico.org.uk

Website: Information Commissioner’s Office

Contents