Notice

Clean Heat Market Mechanism (CHMM): privacy notice

Published 1 April 2025

© Crown copyright 2025

This publication is licensed under the terms of the Open Government Licence v3.0 except where otherwise stated. To view this licence, visit nationalarchives.gov.uk/doc/open-government-licence/version/3 or write to the Information Policy Team, The National Archives, Kew, London TW9 4DU, or email: psi@nationalarchives.gov.uk.

Where we have identified any third party copyright information you will need to obtain permission from the copyright holders concerned.

This publication is available at https://www.gov.uk/government/publications/clean-heat-market-mechanism-chmm-privacy-notice/clean-heat-market-mechanism-chmm-privacy-notice

This notice sets out how we will use your personal data for monitoring, evaluation, and research to support ‘public tasks’ related to the Clean Heat Market Mechanism (CHMM). It also sets out your rights. It is made under Articles 13 and/or 14 of the UK General Data Protection Regulation (UK GDPR).

Your data

We will process the following personal data:

  • the contact details, including names, email addresses and telephone number for nominated representatives of companies with registered M-CHMM accounts
  • Microgeneration Certification Scheme (MCS) certificate numbers for low carbon heating installations which generate CHMM credits
    • this information may be used to link to the MCS Installations Database to provide information about a specific low carbon heating installation, including but not limited to the address where it took place (incl. postcode) and the type/capacity of heat pump installed
    • this information may also be used to link to the Energy Performance Certificate (EPC) data to provide information about the properties that low carbon heating installations are taking place in, including but not limited to property size and type
    • this information may also be used to link to data, including other personal identifying information, for other DESNZ energy schemes to provide information about policy interactions, including but not limited to the Boiler Upgrade Scheme, the Energy Company Obligation and the Warm Homes: Local Grant

Where personal data has not been obtained from the data subject

Your personal data will be provided through the Environment Agency (EA). The EA supply data to the Department for Energy Security & Net Zero (DESNZ) so that it may meet its requirements under The Clean Heat Market Mechanism Regulations 2025. A Memorandum of Understanding is in place to support this.

For further information about how the EA process your data for the delivery of the CHMM and associated purposes, see the EA’s privacy notice.

Purpose

The purposes for which we are processing your personal data are:

1. For evaluation of the CHMM for activities including but not limited to:

  • sampling – the activity of using your personal data to contact you, to invite you to participate in research activities, including but not limited to surveys and interviews
  • data analysis – the activity of carrying out statistical activities on your personal data, either in isolation or combined with other datasets
  • tailoring - the activity of including your personal data on research apparatus to make it more specific to you, such as addressing you by name when contacting you

2. For monitoring of the CHMM and other government objectives relating to the deployment of heat pumps, your data will be processed for activities including but not limited to:

  • understand the characteristics of heat pumps deployed under the CHMM
  • assess the extent to which the CHMM has met its objectives, including but not limited to total scheme deployment and carbon abatement

3. For other analysis, research and future policy development, your data will be processed for activities including but not limited to:

  • research for the development of policies on clean heat and any related activities
  • data analysis – the activity of carrying out statistical activities on your personal data, either in isolation or combined with other datasets
  • research and analysis to support related policies
  • linking – your data may be linked to other datasets in which your data is stored for evaluation, monitoring, and analytical purposes
  • the production of Official Statistics

The legal basis for processing your personal data is public task (Article 6(1)(e) UK GDPR). Processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller, such as:

  • the exercise of a function of the Crown, a Minister of the Crown, or a government department

In this instance, one of the tasks which DESNZ needs to complete is an evaluation of the CHMM. A proper evaluation of the CHMM is required to assess the impact of the CHMM regulations.

In addition, DESNZ needs to monitor the CHMM and how it is functioning, from an operational, financial and policy development perspective. This is done by producing dashboards and other reports which outline key scheme outcome and delivery metrics. DESNZ also carries out research to inform the development of the CHMM and other policies.

The evidence generated from monitoring and evaluation will support the reporting requirements mandated by the CHMM regulations.

The Better Regulation Framework published by the Department for Business & Trade highlights that regulatory interventions require ongoing monitoring and evaluation to assess whether implemented regulations are achieving their aims.

Recipients

For evaluation purposes, your personal data will be shared by us with any contractor or sub-contractor with whom DESNZ deem necessary for undertaking evaluation activities as part of the evaluation activities covering the CHMM. These contractors and sub-contractors will not have the right to share your data more widely without DESNZ’s permission. They will not use your data for purposes beyond those described here.

For monitoring and research purposes, personal data will be shared by us with:

  • any contractor or sub-contractor we deem necessary for undertaking research activities

In accordance with UK GDPR Principle (C): Data Minimisation, DESNZ will limit the sharing of your personal data to what is necessary and relevant. We will limit the data sharing to those who require it to undertake their contractual obligations in completing work as part of the evaluation or monitoring of the CHMM. We only share personal data when that is essential for the research activity. Where personal data is not essential for the monitoring, evaluation, or research we may instead share extracts of data.

As part of our IT infrastructure, your personal data will be stored on systems provided by our data processors - Microsoft and Amazon Web Services. This does not mean we actively share your personal data with these entities; rather, they are technical service providers who host infrastructure supporting our IT systems.

International transfers

Personal Data is stored in the UK.

Retention

Your personal data will be kept by us for no longer than 5 years from when the CHMM regulations end (the current expected end date is 31 March 2030 but may be subject to an extension).

Your rights

You have the right to:

  • request information about how your personal data is processed
  • request a copy of your personal data
  • request that any inaccuracies in your personal data are rectified without delay
  • request that any incomplete personal data are completed, including by means of a supplementary statement
  • request that your personal data are erased if there is no longer a justification for them to be processed
  • in certain circumstances (for example, where accuracy is contested) request that the processing of your personal data is restricted
  • object to the processing of your personal data where it is processed for direct marketing purposes
  • object to the processing of your personal data

To exercise your rights please contact the Data Protection Officer (DPO) using the contact details below.

Contact details

The data controller for your personal data is the Department for Energy Security and Net Zero (DESNZ).

Contact the DESNZ DPO:

DESNZ Data Protection Officer
Department for Energy Security and Net Zero
3-8 Whitehall Place
London
SW1A 2EG

If you are unhappy with the way we have handled your personal data, please write to the department’s Data Protection Officer in the first instance using these contact details.

Complaints

If you consider that your personal data has been misused or mishandled, you may make a complaint to the Information Commissioner, who is an independent regulator.

Contact the Information Commissioner's Office (ICO):

Email icocasework@ico.org.uk

Contact form https://ico.org.uk/mak...

Telephone 0303 123 1113

Any complaint to the Information Commissioner is without prejudice to your right to seek redress through the courts.

Updates to this notice

If this privacy notice changes, we will update this section explaining what has changed. The ‘last updated’ date at the bottom of this page will also change.

Regularly reviewing this page ensures you are always aware of what information we collect, how we use it, and under what circumstances we will share it with other parties.

If these changes affect how your personal data is processed, we will take reasonable steps to let you know.

Last updated: 1 April 2025

Back to top