Skip to main content
Guidance

Business Support Service: privacy notice

Updated 18 May 2026

Applies to England

© Crown copyright 2026

This publication is licensed under the terms of the Open Government Licence v3.0 except where otherwise stated. To view this licence, visit nationalarchives.gov.uk/doc/open-government-licence/version/3 or write to the Information Policy Team, The National Archives, Kew, London TW9 4DU, or email: psi@nationalarchives.gov.uk.

Where we have identified any third party copyright information you will need to obtain permission from the copyright holders concerned.

This publication is available at https://www.gov.uk/government/publications/business-support-service-privacy-notice/business-support-service-privacy-notice

This privacy notice explains how the Department for Business and Trade (DBT) use your personal data when you contact the Business Support Service (BSS). The BSS is a free, government-funded service that provides business support, advice and signposting to individuals and businesses in England.

This notice sets out:

  • what personal data we collect
  • how and why we use it
  • who we share it with
  • how long we keep it
  • your rights under the UK General Data Protection Regulation (UK GDPR)

Who is responsible for your data

The data controller is DBT.

The data processor is the BSS supplier, which delivers the service on behalf of DBT.

What personal data we collect

When you contact the BSS, we may collect and process the following personal data:

  • customer name and business name
  • contact details
  • postcode
  • gender
  • age

We may also collect special category data such as ethnicity and disability.

You do not have to provide special category data. Where it is collected, this is used to help DBT understand whether Public Sector Equality Duty requirements are being met.

Purpose and lawful basis for processing

The BSS processes personal data to provide business support, signposting and referrals, and for reporting, evaluation and monitoring purposes.

This may include matching to other data sources to understand more about businesses like yours and general patterns or trends. The data will not be published or referred to in a way which identifies any individual or business.

Transition period (until 30 June 2026)

During a transition period up to 30 June 2026, personal data may be processed under different lawful bases depending on the Growth Hub supporting your area.

Where a Growth Hub has not yet transitioned, your personal data will continue to be processed under your freely given explicit consent.

Public task

Where a Growth Hub has transitioned, your personal data will be processed under Article 6(1)(e) UK GDPR, as processing is necessary for the performance of a task carried out in the public interest by DBT.

From 1 July 2026, personal data relating to Growth Hub referrals will be processed under the public task basis across all Growth Hubs who have a data sharing agreement with DBT.

If your query relates to export services, we may pass your personal data to the Export Support Service within DBT so your query can be managed appropriately.

We may also receive personal data from the Export Support Service, where the query relates to domestic business service support under an existing public task lawful basis.

If you have any questions in relation to how the data will be processed or disclosed, please contact enquiries@businesssupportservice.co.uk. You can also contact DBT’s Data Protection Officer.

Recipients

The personal data you provide will be shared with:

  • DBT for reporting, evaluation and monitoring purposes
  • the relevant upper tier local authority, mayoral combined authority or county combined authority for providing access to local business support

International transfers

The data you provide will not be transferred outside of the UK or European Economic Area (EEA).

Retention

The personal information you provide will be retained for up to 6 years.

Your rights under UK GDPR

Your rights depend on the lawful basis used to process your data:

  • where processing is based on explicit consent, you have the right to withdraw your consent at any time
  • where processing is based on public task, you have the right to object to the processing of your personal data

You also have the right to:

  • access your personal data
  • have inaccurate data corrected
  • have your data erased in certain circumstances
  • restrict processing in certain circumstances

You have the right to:

  • request information about how your personal data is processed, and to request a copy of that personal data
  • request that any inaccuracies in your personal data are rectified without delay
  • request that any incomplete personal data is completed, including by means of a supplementary statement
  • request that your personal data is erased if there is no longer a justification for it to be processed
  • in certain circumstances (for example, where accuracy is contested) request that the processing of your personal data is restricted
  • object to the processing of your personal data
  • withdraw your consent at any time by contacting enquiries@businesssupportservice.co.uk

Your rights when data is processed under public task

If your data is processed under the lawful basis of Public Task. You have the right to:

  • object to the processing of your personal data 
  • erasure: this right is limited and applies only in specific circumstances, such as unlawful processing or where the data is no longer necessary for the stated purpose 
  • data portability: this right does not apply when data is processed under the public task basis 

Other rights, such as the right to rectification and the right to restrict processing, remain unchanged and are detailed in the main privacy notice.

A full list of your rights under the UK General Data Protection Regulation (UK GDPR) is available on the Information Commissioner’s Office (ICO) website

Automated decision making

The information you provide is not used for automated decision making (making a decision solely by automated means without any human involvement) or profiling (automated processing of personal data to evaluate certain things about an individual).

Contact us or make a complaint

You can contact the DBT Data Protection Officer at:

Data Protection Officer

Department for Business and Trade
Old Admiralty Building
Admiralty Place
London
SW1A 2DY

If you consider that your personal data has been misused or mishandled, you may make a complaint to the Information Commissioner, who is an independent regulator. The Information Commissioner can be contacted at:

Information Commissioner’s Office

Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF

Email casework@ico.org.uk

Telephone: 0303 123 1113

Textphone: 01625 545860

Lines are open from Monday to Friday 9am to 4:30pm.

Any complaint to the Information Commissioner is without prejudice to your right to seek redress through the courts.

Back to top