© Crown copyright 2018
This publication is licensed under the terms of the Open Government Licence v3.0 except where otherwise stated. To view this licence, visit nationalarchives.gov.uk/doc/open-government-licence/version/3 or write to the Information Policy Team, The National Archives, Kew, London TW9 4DU, or email: email@example.com.
Where we have identified any third party copyright information you will need to obtain permission from the copyright holders concerned.
This publication is available at https://www.gov.uk/government/publications/data-protection-act-dpa-information-hm-revenue-and-customs-hold-about-you/data-protection-act-dpa-information-hm-revenue-and-customs-hold-about-you
The Data Protection Act 1998 (DPA) requires organisations which process personal data to meet certain legal obligations. HM Revenue and Customs (HMRC) is a data controller within the meaning of the Act and processes large volumes of personal data. HMRC is also the data controller for the Valuation Office Agency.
Information HMRC collects
We collect information about you so we can:
- collect tax, National Insurance contributions and VAT
- pay tax credits and Child Benefit
- administer the National Minimum Wage
- enforce import and export legislation
- provide valuation and property advice to support tax and benefits
How HMRC uses your information
We may use information we hold about you:
- for one or more of our lawful functions
- to check the information we hold about you is accurate and up to date
- to compare it against other information to help combat fraud and crime
- to verify entitlements or benefits that you may have
- to provide and improve services to you so you can manage your tax and benefits
- to authenticate your identity when you access our services
We may use information from other people or organisations when carrying out these activities.
Information HMRC may give to others
If the law allows, we may give information about you to:
- other government departments and similar bodies
- the police and law enforcement agencies
- courts and tribunals
- foreign tax and customs authorities
- your agent or legal representative
We may also disclose your non-financial VAT registration information to promote economic growth through improved credit scoring.
How to request information HMRC holds about you
You have the right to get a copy of the information that is held about you.
To make a request to HMRC under the Data Protection Act you should complete a subject access request.
When HMRC won’t release information
The law allows us to refuse your request for information in certain circumstances. For example, if you’ve previously made a similar request and there has been little or no change to the data since we complied with the original request.
The law also allows us to withhold information where, for example, release would be likely to:
- prejudice the prevention or detection of crime
- prejudice the apprehension (arrest) or prosecution of offenders
- prejudice the assessment or collection of any tax or duty
- reveal the identity of another person, or information about them
We will do our best to apply these conditions carefully, without damaging the effectiveness of our work, so that we can meet your requests as often as possible.
Putting things right
If you’ve requested details of the information we hold about you and you’re not happy with our response, or you think we haven’t complied with the DPA principles in some other way, you can complain to us.
You should write to the office that provided the information to you, explaining why you’re not satisfied. We will look into your complaint and will reply to you within 10 working days.
If you’re still not happy with our response, you can ask the Information Commissioner to assess whether we have contravened the Data Protection Act 1998.
You can contact the Information Commissioner by Telephone: 0303 123 1113 (local rate), email: firstname.lastname@example.org or write to:
The Information Commissioner
You can find more information about your rights under the DPA by visiting the Information Commissioner’s website, where you will also find HMRC’s ‘notification’ under the DPA (registration number: Z9034158).