Data Protection Information Rights Requests Privacy Notice
Published 22 December 2025
© Crown copyright 2025
This publication is licensed under the terms of the Open Government Licence v3.0 except where otherwise stated. To view this licence, visit nationalarchives.gov.uk/doc/open-government-licence/version/3 or write to the Information Policy Team, The National Archives, Kew, London TW9 4DU, or email: psi@nationalarchives.gov.uk.
Where we have identified any third party copyright information you will need to obtain permission from the copyright holders concerned.
This publication is available at https://www.gov.uk/government/publications/data-protection-information-rights-requests-privacy-notice/data-protection-information-rights-requests-privacy-notice
1. Data Controller
A data controller makes decisions about processing activities. They exercise overall control of the personal data being processed and are ultimately in charge of and responsible for the processing.
The data controller for this processing activity is HMT.
2. Data Processors
A data processor is an organisation or company that handles personal information on our behalf, following our instructions. Data processors do not use your information for their own purposes; they only process it as directed by us.
The following organisation is directed to process your personal information on our behalf:
| Processor Name | Function |
|---|---|
| Microsoft | Provision of enterprise IT services including email, document storage, collaboration tools, and infrastructure support |
3. Who we process personal data about
The table below outlines the categories of individuals whose personal data we will process in this activity, alongside the types of personal data we will use.
| Category of Individual | Types of Personal Data |
|---|---|
| Information Rights Applicants / Correspondent | Name and date of birth , Residential address, Email address, Scanned copies of identification documents, Contextual information about what personal data you expect HMT processes about you, Personal data relating to third parties, if included by you in your request |
If you are acting on behalf of someone exercising their rights of access, we will ask for information to demonstrate you have the relevant authority to do so.
We may also process special category data or data about criminal convictions, if you volunteer such information or it is in the scope of your request. Special categories of personal data may include:
-
Data about racial or ethnic origin
-
Data concerning health
-
Religious or philosophical beliefs
-
Trade union membership
4. Source of Your Personal Data
Personal data of the individuals listed above will be collected in the following ways:
Directly - from Information Rights Request Applicants (you)
Indirectly - from third parties exercising information rights on your behalf
5. Purpose and Lawful Basis
We will process your personal data for the following purposes and using the specified lawful bases:
| Purpose | Lawful Basis | Further Information |
|---|---|---|
| To manage the processing of information rights requests under the UK GDPR / DPA | Article 6(1)(c) of the UK GDPR – Legal obligation , Article 9(2)(g) of the UK GDPR – Substantial public interest , Schedule 1, Part 2, Paragraph 6(2)(a) of the DPA – conferred by an enactment or rule of law | Personal data processing is necessary to enable HMT to discharge individual’s data protection rights |
6. Who we share your personal data with
We will share your personal data with the following types of recipients:
-
HMT staff - who have a business need to see it for the purposes of providing confirmation of whether we are processing your personal data, and provision of this data if held
-
Other government departments and organisations - your request and located personal data may be shared with external organisations where consultation is required to obtain necessary context to inform HMT’s decision-making
Please be aware that if we receive correspondence or communication which we consider threatening in nature or suggests a possible risk to you or a third party, we may share this correspondence (along with your personal data) with relevant law enforcement / safeguarding authorities.
7. International Transfers
Your personal data will not typically be transferred to an international recipient during this activity. However, in rare circumstances, your personal data might be transferred to a recipient based outside of the United Kingdom where consultation is necessary to inform HMT decision-making. In such cases, we will ensure an appropriate legal mechanism applies and the relevant conditions are met.
8. How long we hold your personal data
We will retain your personal data only for as long as necessary to fulfil the purposes for which it was collected.
The specific retention period applicable to information processed as part of an information rights request will typically be 3 years from case closure.
9. Automated Decision-Making and Profiling
This activity does not involve automated decision making or profiling. This means that decisions which may affect you are not made solely by automated means without human involvement, and your data is not subject to analysis intended to evaluate or predict aspects such as your behaviour, preferences, or interests.