Guidance

Debarment Review Service privacy notice

Published 12 February 2025

This notice sets out how we will use your personal data, and your rights. It is made under Articles 13 and/or 14 of the UK General Data Protection Regulation (UK GDPR).

Your data

Purpose

The Debarment Review Service (DRS) will carry out effective and comprehensive debarment investigations (as defined in the Procurement Act 2023). Part of the investigation involves determining if an exclusion ground applies and whether the circumstances giving rise to the application of the exclusion ground are continuing or likely to occur again.

To carry out the investigation and determination, the DRS must collect information associated with the referred Supplier (full name, contact details, criminal/civil data etc.) and any associated person(s), to corroborate that an exclusion ground applies and use this data to ensure that appropriate recommendations are made to the Minister of the Crown in relation to the findings of an investigation.

This includes discussing the data with the subject of the investigation and other stakeholders relevant to the investigation. As per section 61(3) of the Procurement Act, the conclusions of, and the Minister of the Crown’s decision in relation to a debarment investigation, will be published in a report.

Publication of the report will be subject to safeguarding national security or preventing the publication of sensitive commercial information where there is an overriding public interest in it being withheld from publication or other disclosure.

Data will also be held and/or disclosed to deal with statutory legal challenges and judicial review challenges to debarment decisions. Data could also be disclosed when required to do so by law, and for the purposes of litigation or prosecution.

The data

We will process the following personal data:

• name
• email address
• address
• telephone number
• job title
• organisation

• dates and location associated with the exclusion ground

• data relating to criminal convictions, offences or national security as listed in Schedule 6 and Schedule 7 of the Procurement Act 2023

Legal basis of processing

The legal basis for processing your personal data is:

Processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the data controller. In this case the Debarment Review Service (DRS) as part of the Cabinet Office, is required to carry out effective and comprehensive debarment investigations (as defined in the Procurement Act 2023).

As part of the investigation process the Cabinet Office (DRS) will be processing criminal conviction and offences data. To do this the Cabinet Office will rely on the Data Protection Act 2018 Schedule 1 Part 2, 6(2)

Recipients

Data may be shared with other government agencies and associated bodies to assist the DRS exercise its functions under the Procurement Act 2023, in relation to considering a supplier for addition to the debarment list.

Those agencies and associated bodies include, but is not limited to:

• The Serious Fraud Office,
• National Crime Agency,
• Competition & Markets Authority,
• Association of Chief Police Officer,
• Criminal Records Office,
• Health & Safety Executive,
• Modern Slavery and Organised Immigration Crime Unit,
• Environment Agency
• Gangmasters Labour Abuse Authority.

As your personal data will be stored on our IT infrastructure it may be shared with our data processors who provide email, document management and storage services.

Where personal data have not been obtained from you

Personal data may be provided by other government agencies and associated bodies to assist the Cabinet Office (DRS) exercise its functions under the Procurement Act 2023, in relation to considering a supplier for addition to the debarment list.

Those agencies and associated bodies include:

• The Serious Fraud Office,
• National Crime Agency,
• Competition & Markets Authority,
• Association of Chief Police Officer,
• Criminal Records Office,
• Health & Safety Executive,
• Modern Slavery and Organised Immigration Crime Unit,
• Environment Agency
• Gangmasters Labour Abuse Authority.

If information is obtained from an organisation not listed here, we will be able to identify and confirm the name of the organisation.

Retention

Five years from the date of the investigation being concluded, if no challenge or appeal is made.

If a challenge or appeal is made all personal data will be retained for a period of five years from the date the challenge or appeal has been finalised.

Your rights

You have the right to request information about how your personal data are processed, and to request a copy of that personal data.

You have the right to request that any inaccuracies in your personal data are rectified without delay.

You have the right to request that any incomplete personal data are completed, including by means of a supplementary statement.

You have the right to request that your personal data are erased if there is no longer a justification for them to be processed.

You have the right in certain circumstances (for example, where accuracy is contested) to request that the processing of your personal data is restricted.

You have the right to object to the processing of your personal data where it is processed for direct marketing purposes.

You have the right to object to the processing of your personal data.

You have the right to request a copy of any personal data you have provided, and for this to be provided in a structured, commonly used and

machine-readable format.

International transfers

As your personal data is stored on our Corporate IT infrastructure, and shared with our data processors, it may be transferred and stored securely outside

the UK. Where that is the case it will be subject to equivalent legal protection through an adequacy decision, reliance on Standard Contractual Clauses, or reliance on a UK International Data Transfer Agreement.

Complaints

If you consider that your personal data has been misused or mishandled, you may make a complaint to the Information Commissioner, who is an independent regulator. The Information Commissioner can be contacted at:

Information Commissioner’s Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF

or 0303 123 1113, or icocasework@ico.org.uk.

Any complaint to the Information Commissioner is without prejudice to your right to seek redress through the courts.

Contact details

The data controller for your personal data is the Cabinet Office. The contact details for the data controller are:

Cabinet Office
70 Whitehall
London
SW1A 2AS

or 0207 276 1234, or you can use this webform.

The contact details for the data controller’s Data Protection Officer are: dpo@cabinetoffice.gov.uk.

The Data Protection Officer provides independent advice and monitoring of Cabinet Office’s use of personal information.