Skip to main content
Guidance

Defra's peer review privacy notice

Published 11 June 2026

Applies to England

© Crown copyright 2026

This publication is licensed under the terms of the Open Government Licence v3.0 except where otherwise stated. To view this licence, visit nationalarchives.gov.uk/doc/open-government-licence/version/3 or write to the Information Policy Team, The National Archives, Kew, London TW9 4DU, or email: psi@nationalarchives.gov.uk.

Where we have identified any third party copyright information you will need to obtain permission from the copyright holders concerned.

This publication is available at https://www.gov.uk/government/publications/defras-peer-review-privacy-notice/defras-peer-review-privacy-notice

This privacy notice covers external peer reviewers when you are asked to peer review Defra research and development projects at either project proposal or at pre-publication stage, or both.

If you have any queries about the content of this privacy notice, use the contact details provided when you take part in the peer review process.

Who collects your personal data

The Secretary of State (SoS) for the Department for Environment, Food and Rural Affairs (Defra) is the controller for the personal data we collect

If you need further information about how we use your personal data and your associated rights, you can contact the data protection manager at data.protection@defra.gov.uk.

The Defra data protection officer is responsible for checking that we comply with legislation. You can contact them at DefraGroupDataProtectionOfficer@defra.gov.uk.

What personal data we collect and how it is used

We collect your:

  • identification details (name, title, professional affiliation)
  • contact details
  • review content (comments, recommendations, and related correspondence)
  • expertise and subject area information

In addition, if we issue you a contract for the peer review, we collect your payment details.

Your personal data will be processed for the purposes of:

  • managing and administering the peer review process
  • ensuring the quality, integrity, and transparency of evaluations
  • communicating with you regarding peer review assignments

If you want the information that you provide to be treated as confidential, please explain why you regard the information you have provided as confidential. If we receive a request for disclosure of the information we will take full account of your explanation, but we cannot give assurance that confidentiality can be maintained in all circumstances. An automatic confidentiality disclaimer generated by your information technology system will not be regarded as binding on us.

Lawful basis for processing your personal data

The lawful basis for processing your personal data is either:

  • your consent
  • contractual if we issue you with a contract for the peer review

Where the processing of your personal data is based on consent, you can normally withdraw your consent at any time by contacting us. You can do this using the contact details provided when you take part in the peer review process.

Who we share your personal data with

We do not normally share your personal data with third parties. If we need to, we will tell you when we invite you to take part in the external peer review.

We respect your personal privacy when responding to access to information requests. We only share information when necessary to meet the statutory requirements of the Environmental Information Regulations 2004 and the Freedom of Information Act 2000.

How long we hold personal data

We will keep your personal data for up to 8 years after the end of your peer review session.

What happens if you do not provide the personal data

If you do not provide the personal data, you will not be able to peer review Defra research and development projects.

Use of artificial intelligence (AI)

The personal data may be processed using AI for consolidation and summarisation of peer review comments.

Use of automated decision-making or profiling

The personal data you provide is not used for:

  • automated decision making (making a decision by automated means without any human involvement)
  • profiling (automated processing of personal data to evaluate certain things about an individual)

Transfer of your personal data outside of the UK

We will only transfer your personal data to another country that is deemed adequate for data protection purposes.

Your rights

Based on the lawful processing above, your individual rights are:

  • the right to be informed
  • the right of access
  • the right to rectification
  • the right to erasure
  • the right to restrict processing
  • the right to data portability
  • rights in relation to automated decision making and profiling

More information about your individual rights under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018 (DPA 2018).

Complaints

You have the right to make a complaint to the Information Commissioner’s Office at any time.

Personal information charter

Our personal information charter explains more about your rights over your personal data.

Back to top