Corporate report

Spotlight privacy information notice

Updated 10 April 2024

© Crown copyright 2024

This publication is licensed under the terms of the Open Government Licence v3.0 except where otherwise stated. To view this licence, visit nationalarchives.gov.uk/doc/open-government-licence/version/3 or write to the Information Policy Team, The National Archives, Kew, London TW9 4DU, or email: psi@nationalarchives.gov.uk.

Where we have identified any third party copyright information you will need to obtain permission from the copyright holders concerned.

This publication is available at https://www.gov.uk/government/publications/dft-online-form-and-survey-privacy-notice/spotlight-privacy-information-notice

The Department for Transport (DfT) uses the Spotlight system, provided by the Cabinet Office (CO), for due diligence of grants information from:

  • companies (including sole traders)
  • charities

The Spotlight system matches our electronic data sets and cross-references it with data held by Companies House, the Charities Commission and, if necessary, Experian, to prevent, detect and respond to:

  • fraud
  • bribery
  • corruption

Data sets

Our processing of data with Spotlight includes the personal data of:

  • business address
  • business postcode
  • County Court Judgements against the non-limited company
  • disqualified directorships
  • convictions against directors and failed directorships
  • bankruptcies
  • credit limit
  • business failure and business default probability
  • amount and value of accounts in collection
  • payment to terms and payment pattern
  • unpaid and late accounts
  • the nature of grants applied for

Your personal data is protected by Data Protection regulations and is required according to UK GDPR Article 6(1)(e) Public task: the processing is necessary to perform a task in the public interest or official functions.

The processing by us of personal data relating to criminal convictions and offences or related security measures is not carried out under official authority, but is authorised as necessary for reasons of substantial public interest for the exercise of a function of the Crown, a Minister of the Crown or a government department.

Data sharing and security

Data will be shared by us, for the purposes of preventing and detecting fraud, with other government bodies, including government departments, arm’s length bodies and local authorities.

Data will be stored on both DfT and CO IT infrastructure and it will also be shared with data processors who provide email, document management and storage, customer relationship management and web hosting services.

The Cabinet Office privacy notice sets out how the CO will use the personal data and our own policy states your rights and complaints procedure.

Data retention

Your personal data will be kept by us for no longer than 3 years. In the event that any results form part of a criminal investigation, the principles of Criminal Procedure and Investigations Act 1996 or other legal requirement will supersede any local retention policy.

Back to top