Guidance

Dealing in an exempted ivory item privacy notice

Updated 22 July 2025

Applies to England, Scotland and Wales

Your data is being collected by

The data controller is the Department for Environment, Food and Rural Affairs (Defra) for personal data that you give to APHA.

APHA is an Executive Agency of Defra. You can contact APHA’s Data Protection Manager by email at: data.protection@defra.gov.uk.

APHA also works with the Scottish Government and Welsh Government, who are joint controllers with APHA for any relevant personal data.

Any questions about how Defra or APHA is using your personal data, and your associated rights should be sent to the above contact.

The Data Protection Officer responsible for monitoring that Defra and APHA is meeting the requirements of the legislation can be contacted by email at: DefraGroupDataProtectionOfficer@defra.gov.uk.

What personal data is collected

We collect the following items of personal data:

• your name
• business name
• contact details

If different:

• the owner’s name
• contact details

How your data has been obtained

We have obtained your data from your application to deal in an exempted item of ivory, from you directly or from someone authorised to act on your behalf.

Why we are using your data

Defra and APHA have official responsibility for regulating the implementation and application of the Ivory Act 2018.

When you register or make an application for an exemption certificate to deal in an ivory item legally, we will use your personal data to:

• confirm the registration of an item under the standard exemptions, or that an application for a pre-1918 outstandingly high artistic, cultural or historical value item has been received
• assess your registration or application
• confirm the outcome of an application for an exemption certificate to the applicant and issue the exemption certificate where applicable

We may also:

• contact you or someone acting on your behalf to request further information on the application
• contact you to tell you an application has been made on your behalf

• contact you if we suspect that any intent to deal in an ivory item does not comply with the Ivory Act 2018

• check that you or someone acting on your behalf when dealing in an ivory item complies with the Convention on International Trade in Endangered Species of Wild Fauna and Flora (CITES).

• collate information for reporting

The lawful basis for processing your data

The lawful basis for processing your personal data is:

• you have a legal obligation to register your ivory item with APHA if you want to deal in that item legally
• that it is necessary for the performance of a task carried out in the public interest, which is laid down by law, The Ivory Act 2018 as amended by Ivory Act 2018 (Meaning of “Ivory” and Miscellaneous Amendments) Regulations 2025. The task is the delivery of the control of dealing in items containing Ivory
• consent when related to sharing your personal data to help further the expertise of the Prescribed Institutions

Consent to process your data

The processing of your personal data is only based on consent when sharing with the Prescribed Institutions to further their expertise. You can withdraw consent at any time by emailing ivoryact@apha.gov.uk.

Consequences of not providing the necessary data

Without the necessary personal data, we will not be able to process your registration or an application for an exemption certificate. This means that you will not be able to legally deal in the ivory.

Use of automated decision-making or profiling

The personal data you provide is not used for:

• automated decision making (making a decision by automated means without any human involvement)

• profiling (automated processing of personal data to evaluate certain things about an individual)

Who we share your data with

If your application relates to pre-1918 items that are of outstandingly high artistic, cultural or historical value, then we will share your data with the Prescribed Institution, see schedule 1 of The Ivory Prohibitions (Exemptions) (Process and Procedure) Regulations 2022. They assess the application to give their expert opinion on whether the item meets the exemption criteria.

Your personal data is shared with expert assessors so they can feel assured that there is no conflict of interest. For example, if a potential assessor were related to an applicant, which would lead to a conflict of interest, that assessor would not assess that applicant’s ivory item. Instead, we will share your application and personal details with an assessor that does not have conflicting interests.

With your consent, we will share with other Prescribed Institutions other than the Prescribed Institution assessing your application, to help further their expertise:

• details of your ivory item (but not your name, contact details, or any other information identifying you) from your application for an exemption certificate

• the Secretary of State’s decision on whether to award that an item an exemption certificate

Storing and using data outside the UK

We will only transfer your personal data to another country that is deemed adequate for data protection purposes.

How long we hold personal data for

Retention periods are set by considering statutory, regulatory, legal, and security reasons, alongside historic value.

Under the Ivory Act 2018, there is a statutory requirement for us to hold data on ivory items where an applicant has made a registration or applied for an exemption certificate. This registration or application would have been under the provisions governing exemptions in the Act.

Personal data will be held for seven years from the date we issued the registration number or exemption certificate. It will be reviewed to determine whether a further retention period is required to ensure compliance with and appropriate enforcement of the Ivory Act. Data will be manually deleted once it has been determined it is appropriate to do so.

Your rights

Based on the lawful processing your personal data, your individual rights are as following.

Public task

Individuals have the following rights when data is processed under the public task lawful basis:

• the right to be informed
• the right of access
• the right to rectification
• the right to restrict processing
• the right to object
• rights in relation to automated decision making and profiling

Legal obligation

Individuals have the following rights when data is processed under the legal obligation lawful basis:

• the right to be informed
• the right of access
• the right to rectification

• the right to restrict processing

• rights in relation to automated decision making and profiling

Consent

Individuals have the following rights when data is processed based on consent:

• the right to be informed
• the right of access
• the right to rectification
• the right to erasure
• the right to restrict processing
• the right to data portability
• rights in relation to automated decision making and profiling

Find out more information about your individual rights under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018 (DPA 2018)on the Information Commissioner’s Office (ICO) website.

Complaints

You have the right to make a complaint to the Information Commissioner’s Office at any time.

Personal Information Charter

Our Personal information charter explains more about your rights over your personal data.