Skip to main content
Guidance

National Fraud Initiative privacy notice

Updated 2 September 2026

© Crown copyright 2026

This publication is licensed under the terms of the Open Government Licence v3.0 except where otherwise stated. To view this licence, visit nationalarchives.gov.uk/doc/open-government-licence/version/3 or write to the Information Policy Team, The National Archives, Kew, London TW9 4DU, or email: psi@nationalarchives.gov.uk.

Where we have identified any third party copyright information you will need to obtain permission from the copyright holders concerned.

This publication is available at https://www.gov.uk/government/publications/defra-privacy-notice-national-fraud-initiative/privacy-notice

Following a machinery of government change on 21 July 2026, the Public Sector Fraud Authority (PSFA), including the National Fraud Initiative (NFI), transferred from the Cabinet Office to the Department for Work and Pensions (DWP). DWP is now the Data Controller for all NFI data matching exercises. 

This privacy notice explains how the NFI will use and manage your personal data. If you have any queries about the content of this privacy notice, please email fraudanderror@defra.gov.uk

Who collects your personal data

The Secretary of State (SoS) for the Department for Environment, Food and Rural Affairs (Defra) is the controller for the personal data we collect.

If you need further information about how we use your personal data and your associated rights, you can contact the data protection manager at data.protection@defra.gov.uk.

The Defra data protection officer is responsible for checking that we comply with legislation. You can contact them at DefraGroupDataProtectionOfficer@defra.gov.uk.

What personal data we collect and how it is used

We process information that you provide when seeking payment of an invoice from us. This is referred to as trade creditor standing and payment history data.

Data specifications setting out exactly what data we process in the above areas can be found on the National Fraud Initiative: public sector data specifications page.

Information summarising the various match types by participating organisation type, and the purpose of the matching, is set out in the document​ ​NFI match types per participating body​. 

These are the services the NFI provides.

Lawful basis for processing your personal data

The legal basis for processing your personal data is that it is necessary for the performance of a task carried out in the public interest or the exercise of official authority vested in the data controller (Article 6(1)(e) UK GDPR). In this case that is improving the effectiveness and accuracy of the prevention and detection of fraud.

The NFI is conducted using the data matching powers bestowed on the Minister for the Department for Work and Pensions by Part 6 of the Local Audit and Accountability Act 2014 (LAAA).

Under the LAAA legislation:

Bodies may participate in its data matching exercises on a voluntary basis where the Department for Work and Pensions considers it appropriate. Where they do so, the Act states that there is no breach of confidentiality and generally removes other restrictions in providing the data to the Department for Work and Pensions. The requirements of the data protection legislation, however, continue to apply, so data cannot be voluntarily provided if to do so would be a breach of data protection legislation.

The legal basis for processing your criminal convictions data is paragraphs 6 and 10 of ​schedule 1​ to the Data Protection Act 2018

The processing of your personal data is not based on consent. You cannot withdraw it.

Who we share your personal data with

We will share the personal data collected under this privacy notice with:

How long we hold personal data

Your personal data will be kept by the DWP for the periods set out in the Data Deletion Schedule, which is available on the Code of Data Matching Practice GOV.UK page.

Your rights

Based on the lawful processing above, your individual rights are:

  • to request information about how your personal data are processed, and to request a copy of that personal data

  • to request that any inaccuracies in your personal data are rectified without delay

  • to request that any incomplete personal data are completed, including by means of a supplementary statement

  • to request that your personal data are erased if there is no longer a justification for them to be processed

  • in certain circumstances (for example, where accuracy is contested) to request that the processing of your personal data is restricted

Where the processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the data controller, such as the exercise of a function of the Crown, a Minister of the Crown, or a government department; the exercise of a function conferred on a person by an enactment; the exercise of a function of either House of Parliament; or the administration of justice: You have the right to object to the processing of your personal data. This right does not apply where your data is disclosed to us under a legal obligation under paragraph 2 of schedule 9 of the Local Audit and Accountability Act 2014.

More information about your individual rights under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018 (DPA 2018).

Complaints

You have the right to make a complaint to the Information Commissioner’s Office at any time.

Personal information charter

Our personal information charter explains more about your rights over your personal data.

Back to top