Guidance

DBT goods regulation mailbox privacy notice

Published 31 January 2026

This privacy notice explains how the Department for Business and Trade (DBT) as a ‘data controller’ processes personal data for the purposes of responding to your email query specifically sent to the Goods Regulation mailbox.

This notice is supplemented by our main privacy notice which provides further information on how DBT processes personal data and sets out your rights in respect of that personal data.

Personal data DBT collects

DBT collects information about businesses and individuals requiring an email response to product regulation queries which fall under the responsibility of DBT.

DBT only collects the following categories of personal data:

• name
• email contact details (personal or business)
• organisation
• business sector

Why this information is needed

DBT collects this information to fulfil its public functions and to enhance the quality of its services. By gathering relevant details, we can respond more accurately and efficiently to your email query sent to the Goods Regulation mailbox. This information also helps us identify trends, improve communication, and ensure that our guidance and support meet your needs effectively.

Legal basis for processing your personal data

Once we receive your data, it will be handled as follows:

• your details will be recorded in our internal correspondence tracker and assigned a unique reference number
• our response to your query will be securely stored within DBT’s internal systems, in line with departmental retention and data protection requirements
• your original email, which contains your personal data will be stored while queries are open and then deleted when no longer required, or after 7 years

We will only process your personal data for purposes which are compatible with those specified in this privacy notice. This may include archiving in the public interest, or scientific, historical or statistical research, in accordance with Article 89 UK General Data Protection Regulation (GDPR). Where your data is further used for research purposes, appropriate safeguards (including anonymisation, pseudonymisation and data minimisation techniques) will be used to ensure that your personal data is only processed where it is necessary for us to do so, and that it is processed lawfully and securely. 

Compatible research purposes may include analysis to further DBT policy development, or to analyse public consultation responses or similar requests for information from the public.

Third party processors

As your personal data is stored on our IT infrastructure and shared with our data processors Microsoft and Amazon Web Services, it may be transferred and stored securely outside the UK and European Economic Area (EEA). This may be for the purposes of using cloud services. Where your personal data is stored outside the UK and EEA it will be subject to equivalent legal protection through the use of Standard Contractual Clauses (SCC).

Information sharing

We may share personal data you provide:

• with other government departments for the purposes of answering your business query where necessary
• in response to information requests for example, under Freedom of Information (FOI) law or the Environmental Information Regulations (EIR)
• to a court, tribunal or party where the disclosure is necessary to exercise, establish or defend a legal claim
• where we are ordered to do so or where we are otherwise required to do so by law
• with third party data processors as governed by contract
• your data will not be sold or used for marketing purposes

You can find out more detailed information about how we share data and further processing in the main privacy notice.

How long your data is held

DBT will only retain your personal data for as long as necessary to fulfil the purposes we collected it for, including for the purposes of satisfying any legal, accounting, or reporting requirements.

Your original email will be stored while queries are open and then deleted when no longer required, or after 7 years.

If we decide that we need to process your personal data for a reason which is incompatible with the purposes for which we collected it for, we will contact you to explain why we are doing this and why it is lawful to do so.

To determine the appropriate retention period for personal data, we consider the amount, nature, and sensitivity of the personal data and the potential risk of harm from unauthorised use or disclosure. The purposes for which we process your personal data and whether we can achieve those purposes through other means, and the applicable legal requirements

Your rights

You have a number of rights available to you under UK data protection legislation such as the right to:

• request copies of the personal data we hold about you
• request that we rectify information about you which you think is inaccurate or incomplete
• request that we restrict your data from further processing (in certain circumstances)
• object to the processing of your data (in certain circumstances)
• data portability (in certain circumstances)
• request that we erasure your data (in certain circumstances)
• not to be subject to a decision based on solely automated data processing.

Contact us

You can contact DBT’s Data Protection Officer for further information about how your data has been processed by the department at data.protection@businessandtrade.gov.uk.

Make a complaint

To make a complaint about how your data has been used contact: data.protection@businessandtrade.gov.uk.

Information Commissioner’s Office

Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF

Email casework@ico.org.uk

Telephone: 0303 123 1113

Textphone: 01625 545860

Lines are open from Monday to Friday 9am to 4:30pm.

Website: https://ico.org.uk/.

You can find out more about your rights as a data subject, and details of how to contact our Data Protection Officer and the ICO in our main privacy notice.