© Crown copyright 2016
This publication is licensed under the terms of the Open Government Licence v3.0 except where otherwise stated. To view this licence, visit nationalarchives.gov.uk/doc/open-government-licence/version/3 or write to the Information Policy Team, The National Archives, Kew, London TW9 4DU, or email: firstname.lastname@example.org.
Where we have identified any third party copyright information you will need to obtain permission from the copyright holders concerned.
This publication is available at https://www.gov.uk/government/publications/data-protection-act-dpa-information-hm-revenue-and-customs-hold-about-you/data-protection-act-dpa-information-hm-revenue-and-customs-hold-about-you
The Data Protection Act (1998) requires organisations which process personal data to meet certain legal obligations. HM Revenue and Customs (HMRC) is a data controller within the meaning of the Act and we process large volumes of personal data. HMRC is also the data controller for the Valuation Office Agency.
Information we collect
We collect information about you so we can:
- collect tax, National Insurance contributions and VAT
- pay tax credits and Child Benefit
- administer the National Minimum Wage
- enforce import and export legislation
- provide valuation and property advice to support tax and benefits
How we use information we hold
We may use information we hold about you:
- for one or more of our lawful functions
- to check the information we hold about you is accurate and up-to-date
- to compare it against other information to help combat fraud and crime
- to verify entitlements or benefits that you may have
- to provide and improve services to you so you can manage your tax and benefits
- to authenticate your identity when you access our services
We may use information from other people or organisations when carrying out these activities.
Information we may give to others
If the law allows, we may give information about you to:
- other government departments and similar bodies
- the police and law enforcement agencies
- courts and tribunals
- foreign tax and customs authorities
- your agent or legal representative
Requesting information we hold about you
Requests to see records and other related information that HMRC holds about you are known as ‘subject access requests’ (SAR).
Requests in writing
As HMRC is a large organisation, to help process your request quickly, address the request to the ‘Data Protection Officer’ and send it to the HMRC office that you have been dealing with.
To help us provide the information you want and deal with your request more quickly, you should include enough details to enable us to verify your identity and locate the relevant information. For example, you should tell us:
- your date of birth
- previous or other name(s) you have used
- your previous addresses in the past 5 years
- personal reference number(s) that we may have given you, for example your National Insurance number, your tax reference number or your VAT registration number
- what type of information you want to know
If you don’t have a National Insurance number, you must send a copy of:
- the back page of your passport or a copy of your driving licence
- a recent utility bill
The DPA requires that we comply with a request for information promptly and in any event within 40 days of receipt. HMRC will always try to provide a response within this timescale.
We will not charge you for dealing with a DPA request.
As well as making requests in writing, you can make a SAR online
Use the National Insurance online form to request details about pay and national insurance.
Use the generic online form to request information about tax credits, Income Tax, Child Benefit, VAT, Customs and other records.
You can only use the online facility to submit a request for your own information. If you are acting on behalf of another individual, you must submit your request by post or fax. You must include a mandate, which has been signed by the person to whom the information relates within 6 months of the submission date of your request.
Asking someone else to make a DPA request on your behalf
You can ask someone else to request information on your behalf, for example a friend, relative or solicitor. We must have your authority to do this. This is usually a letter signed by you stating that you authorise the person concerned to write to us for information about you, and/or receive our reply.
When we won’t release information
The law allows us to refuse your request for information in certain circumstances. For example, if you have previously made a similar request and there has been little or no change to the data since we complied with the original request.
The law also allows us to withhold information where, for example, release would be likely to:
- prejudice the prevention or detection of crime
- prejudice the apprehension (arrest) or prosecution of offenders
- prejudice the assessment or collection of any tax or duty
- reveal the identity of another person, or information about them
We will do our best to apply these conditions carefully, without damaging the effectiveness of our work, so that we can meet your requests as often as possible.
Putting things right
If you have requested details of the information we hold about you and you are not happy with our response, or you think we have not complied with the DPA principles in some other way, you can complain to us.
You should write to the office that provided the information to you, explaining why you are not satisfied. We will look into your complaint and will reply to you within 10 working days.
If you are still not happy with our response, then you can ask the Information Commissioner to assess whether we have contravened the Data Protection Act 1998.
The Information Commissioner
Here is how you can contact the Information Commissioner:
Telephone: 0303 123 1113 (local rate) or 01625 545 745 (national rate)
Fax: 01625 524 510
The Information Commissioner
You can find more information about your rights under the DPA by visiting the Information Commissioner (Opens new window), where you will also find HMRC’s ‘notification’ under the DPA (Registration Number: Z9034158).