DESNZ public appointments: privacy notice
Published 12 February 2026
© Crown copyright 2026
This publication is licensed under the terms of the Open Government Licence v3.0 except where otherwise stated. To view this licence, visit nationalarchives.gov.uk/doc/open-government-licence/version/3 or write to the Information Policy Team, The National Archives, Kew, London TW9 4DU, or email: psi@nationalarchives.gov.uk.
Where we have identified any third party copyright information you will need to obtain permission from the copyright holders concerned.
This publication is available at https://www.gov.uk/government/publications/desnz-public-appointments-privacy-notice/desnz-public-appointments-privacy-notice
This notice sets out how DESNZ processes personal data for the purposes of making public appointments to DESNZ, it’s sponsored public bodies and advisory committees, including the applications, selection, appointment, reappointment and vetting process. It also covers related monitoring (including diversity), statistics and campaign effectiveness. It is made under Articles 13 and/or 14 of the UK General Data Protection Regulation (UK GDPR).
DESNZ is the data controller of the information you provide in your application for a public appointment role. This means that we are responsible for deciding how we hold and use personal information about you.
DESNZ and the Cabinet Office are joint data controllers for public appointments advertised and stored on the Cabinet Office public appointments site. The DESNZ privacy notice is in addition to the Cabinet Office Privacy Notice that is attached to all vacancies advertised on the Public Appointments Digital Site.
1. Your data
We typically collect personal data about applicants and Non-Executive Directors through the application and recruitment process, either directly from candidates or sometimes from an executive search agency or via background checks.
We may process the following personal data:
Application data: name, contact details, location, employment history, qualifications, CV/biography, covering letter, sift and interview assessments; conflicts of interest; political activity; details of existing public appointments.
Due diligence information from public sources (e.g., company registers, insolvency/disqualification checks, public social‑media profiles) and right‑to‑work documentation where required.
Security vetting data as required for clearance (e.g., nationality, address, family history and criminal convictions)
We may also process the following where provided:
Diversity monitoring: age, sex/gender, ethnicity, sexual orientation, religion/faith, disability, socio-economic and political activity. Submission is voluntary; you may decline.
Diversity monitoring data will be collected by an optional diversity questionnaire upon completion of an application.
We will collect additional personal information through due diligence checks where this information is already in the public domain related to your conduct or professional capacity. This will include our undertaking searches of previous public statements and social media, blogs or any other publicly available information. This information may be made available to the Advisory Assessment Panel and to Ministers.
If you do not provide your personal data, you will not be considered for a public appointment role.
2. Purpose
We will process your data for the purpose of making public appointments in accordance with the Governance Code on Public Appointments. We will process your data to:
- Administer applications, longlisting/sifting, interviews and panel assessments; undertake due diligence; and advise Ministers on appointable candidates.
- Conduct security, propriety and conflicts checks; manage appointment/reappointment; and carry out pre‑appointment checks including right to work, verification of identity and criminal record checks.
- Monitor diversity and campaign effectiveness; produce anonymised statistics; and improve future recruitment.
3. Legal basis of processing
The legal basis for processing your personal data under Article 6 of the UK GDPR is:
- Public task – Article 6(1)(e) of the UK GDPR: processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the data controller. In this case, the processing of your personal data is necessary to consider applications and to run a robust, far and open recruitment process in line with the Governance Code on Public Appointments.
Special category data under the UK GDPR includes data revealing racial/ethnic origin, political opinions, religious/philosophical beliefs, trade union membership, health, sex life, sexual orientation, genetic data and biometric data (for unique identification).
For special category data, the condition for processing your data is:
- Article 9(2)(g) (substantial public interest) including equality of opportunity and diversity monitoring.
For criminal convictions data, we process under Schedule 1 DPA 2018 where necessary for vetting and public appointments compliance.
4. Recipients
We will process your data for the purpose of making public appointments in accordance with the Governance Code on Public Appointments.
Where we need to share your personal data with others, we ensure that this data sharing complies with data protection legislation. For the purpose of this work, we may need to share your personal data with:
- the sponsor team and representatives from the organisation to which you have applied
- Ministers
- Special advisers
- the Office of the Commissioner for Public Appointments (OCPA)
- Cabinet Office
- the Prime Minister’s Office, 10 Downing Street
- third-party executive search partners (where applicable and where contracted to handle a specific recruitment campaign)
Anonymised diversity data for Public Appointment applicants and appointees may also be shared with Cabinet Office and OCPA.
This data sharing is lawful because it is necessary for making public appointments in accordance with the Governance Code on Public Appointments. We will also share your data if we are required to do so by law or regulation – for example by court order, or to prevent fraud or other crime.
As part of our IT infrastructure, your personal data will be stored in the UK on systems provided by our data processors - Microsoft and Amazon Web Services. This does not mean we actively share your personal data with these entities; rather, they are technical service providers who host infrastructure supporting our IT systems.
5. Retention
We will retain the data of candidates recruited to our boards for 2 years after your term ends for audit purposes. For everyone else, we will retain your data, for audit purposes, for 2 years after the announcement of the post being filled DESNZ process your personal data in the UK.
As your personal data is stored on Cabinet Office IT infrastructure, and shared with their data processors, it may be transferred and stored securely outside the UK. Where that is the case, it will be subject to equivalent legal protection through an adequacy decision or reliance on Standard Contractual Clauses or a UK International Data Transfer Agreement. Cabinet Office applies appropriate safeguards consistent with UK GDPR.
6. Your rights
You have the right to request information about how your personal data are processed, and to request a copy of that personal data.
You have the right to request that any inaccuracies in your personal data are rectified without delay.
You have the right to request that any incomplete personal data are completed, including by means of a supplementary statement.
You have the right to request that your personal data are erased if there is no longer a justification for them to be processed.
You have the right in certain circumstances (for example, where accuracy is contested) to request that the processing of your personal data is restricted.
You have the right to object to the processing of your personal data where it is processed for direct marketing purposes.
You have the right to object to the processing or use of your personal data.
To exercise your rights please contact the Data Protection Officer using the contact details below.
7. Contact details
The data controller for your personal data is the Department for Energy Security and Net Zero (DESNZ). You can contact the DESNZ Data Protection Officer at:
Contact the DESNZ DPO:
DESNZ Data Protection Officer
Department for Energy Security and Net Zero
3-8 Whitehall Place
London
SW1A 2EG
If you are unhappy with the way we have handled your personal data, please write to the department’s Data Protection Officer in the first instance using the contact details above.
8. Complaints
If you consider that your personal data has been misused or mishandled, you may make a complaint to the Information Commissioner, who is an UK independent regulator.
Contact the Information Commissioner's Office (ICO):
Any complaint to the Information Commissioner is without prejudice to your right to seek redress through the courts.
9. Updates to this notice
If this privacy notice changes in any way, we will place an updated version on this page. Regularly reviewing this page ensures you are always aware of what information we collect, how we use it, and under what circumstances we will share it with other parties. The ‘last updated’ date at the bottom of this page will also change.
If these changes affect how your personal data is processed, we will take reasonable steps to let you know.
Last updated: January 2026