Guidance

Fixed sum offer permission to appeal process: BIST privacy notice

Published 21 October 2026

This privacy notice sets out how your personal data will be processed by the Department for Business, Innovation, Science and Trade (BIST) when administering the fixed sum offer (FSO Appeals) permission to appeal process as a route to appeal to the Horizon Shortfall Scheme Appeals (HSSA) process. This notice will help you to understand:

• why and how your personal data will be used
• how it will be shared
• the rights you have in respect of your personal data

This notice is supplemented by our main privacy notice which provides further information on how BIST processes personal data and sets out your rights in respect of that personal data. For information about how your personal data is processed in the context of the FSO Appeals process more broadly, you may also wish to read:

• the HSSA privacy notice
• Dentons UK and Middle East LLP’s privacy notice
• the privacy notice of the independent assessor considering your case, if relevant – a copy of the independent assessor privacy notice will be provided to you if your claim is referred to the independent assessor

Overall description of the processing

In this notice, when we talk about ‘personal data’, we mean information relating to an individual who can be identified – directly or indirectly – by reference to that information. For example, their name, address, contact details, or certain employment information. When we talk about ‘processing’, we mean any action taken in relation to personal data, including collecting, using, storing, or deleting it.

BIST receives personal data about claimants submitting applications under the FSO Appeals process. We will process your personal data for the purposes of determining whether you are able to appeal your FSO award in HSSA. Where a claim is eligible, personal data will be shared with Dentons UK and Middle East LLP, acting as the FSO Appeals secretariat. Personal data will be processed by BIST as described in this privacy notice and in accordance with UK data protection law.

Why we process this personal data

BIST will process your personal data in order to:

• review your eligibility to make an application to FSO Appeals
• carry out an assessment of whether your application meets the threshold test for permission to appeal your FSO award in HSSA
• discharge their duties and obligations under data sharing agreements with BIST, implemented to safeguard your personal data
• otherwise fulfil their independent obligations under data protection legislation or any other applicable law

Guidance on the process is set out in the Fixed sum offer permission to appeal: process guide, published on 20 May 2026.

If we do not process your personal data in this way, your application to FSO Appeals may not be able to be considered or it will be determined on the basis of the information available, which could affect the outcome of the decision and may mean you cannot access HSSA.

What personal data will be processed about you

BIST may process a range of information about you. This information is likely to include the following information related to you:

• first names
• surname (including any previous names)
• home address (previous and current, if relevant)
• postcode
• telephone number
• email address
• job titles (previous and current, if relevant)
• details about contracts held (or that were held) with Post Office Limited
• financial information about shortfalls and other losses
• details about actions taken in relation to shortfalls and other losses
• details of FSO received
• material relating to the FSO decision making process
• information relating to the HSS claim including the settlement amount, dates of payments made, type of settlement (for example, fully assessed or FSO) and which stage of the HSS process was reached
• complaints that Post Office Limited received and holds from postmasters about Horizon
• any other personal data that you may submit relating to your claim
• evidence of alleged wrongdoing or allegations of wrongdoing by the postmasters which was used by Post Office Limited in criminal or disciplinary proceedings

BIST may also process special category personal data about you. For example:

• information about your health, including medical conditions, health, and sickness records if these are relevant to your case
• information about criminal convictions and offences, including alleged offences

In addition, we may also process limited personal data related to your family members, current or former colleagues, and Post Office Limited personnel, where relevant to your application.

How we process the personal data we receive

Once received, your data will be processed as follows:

1. Personal data will be stored within BIST’s internal database and managed by the BIST Post Office Compensation team. These databases are restricted to ensure proper and secure storage.
2. BIST will conduct identity and verification checks to ensure that you meet the basic eligibility criteria to apply for permission to appeal your FSO in HSSA.
3. BIST will confirm your eligibility then request information from you setting out why you wish to appeal the FSO award.
4. The secretariat will consider your submission to determine whether you meet the threshold test to appeal the FSO award in HSSA. Any complex or borderline cases will be referred to an independent assessor, who will make the final determination on whether the threshold test is met.
5. Once your personal data is no longer needed as part of the process or subsequent evaluation, any identifiers will be removed, and a de-identified dataset will remain for audit purpose.

As part of the FSO Appeals process, BIST may additionally process data for internal research-related or statistical purposes. For this purpose, BIST will only process data “where processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller” (under article 6 of the UK General Data Protection Regulation (GDPR)). Special category data and sensitive data on criminal convictions will only be processed for research purposes where necessary. Special measures are in place to protect your information and ensure that confidentiality is respected (as per article 9 of the UK GDPR).

BIST may also use products or services provided by third parties to carry out an evaluation of the FSO Appeals process, in which applicants will be invited to take part. Participation in such an evaluation will not be mandatory. When BIST uses third parties (known as data processors), BIST remains responsible for your personal information as the data controller. We have contractual terms, policies and procedures to ensure confidentiality is respected and that all information is kept in line with regulatory requirements.

Who will process your personal data

BIST will process your personal data as an independent data controller. This means BIST exercises overall control and responsibility over how your personal data is processed.

Data sharing

In certain circumstances, we may share your personal data with third parties. These third parties may include:

• your legal representatives or advisors, who will process the personal data in line with their own privacy notice
• Dentons, in their role as secretariat, who will process your personal data in line with their own privacy notice when acting as independent data controller
• an independent assessor
• service providers who process personal data on our instructions such as:
  • IT suppliers
  • cloud hosting providers
  • database providers
  • email providers
  • backup and disaster recovery specialists

If your application for permission to appeal is reviewed by an independent assessor, only the independent assessor reviewing your application for permission to appeal will receive your personal data. The independent assessor acts as an independent data controller. The independent assessor privacy notice has further information on how they will process your personal data.

Service providers will be required to meet appropriate standards on processing information and security when processing your personal data. The information provided to them, including your personal data, will only be processed in connection with the performance of their function. They will not be permitted to use your personal data for any purposes other than those outlined in this privacy notice.

The legal basis for processing your personal data

These tables set out the primary legal basis upon which we rely for processing the personal data we collect about you.

Data Category	Relevant legislation
For all personal data	Article 6(1)(e) of the UK GDPR and section 8(d) of the Data Protection Act (DPA) 2018 – processing is necessary for the performance of a task carried out in the public interest, which includes the processing of personal data that is necessary for the exercise of a function of a government department.
For all shared personal data	Article 6(1)(e) of the UK GDPR – processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller (such task being supported by section 103 of the Postal Services Act 2000 and section 1 of the Post Office (Horizon Systems) (Compensation) Act 2024).
For special category personal data	Article 9(2)(g) of the UK GDPR – processing is necessary for reasons of substantial public interest together with paragraph 6 of schedule 1 to the DPA 2018, statutory and government purposes, and Article 9(2)(f) UK GDPR, legal claims.
For criminal offence data	Schedule 1, paragraph 6 of the DPA 2018 (as extended by Schedule 1, Paragraph 36 of the DPA 2018) – processing is necessary for the purpose of the exercise of a function conferred on a person by an enactment or rule of law; or the exercise of a function of the Crown, a Minister of the Crown or a government department, together with paragraph 33 of schedule 1 to the DPA 2018, legal claims.

Processing where this is a legal requirement

Your personal data may be processed if it is necessary on reasonable request by a law enforcement or regulatory authority, body or agency or in the defence of a legal claim. We will not delete personal data if relevant to an investigation or a dispute and it will continue to be stored until those issues are fully resolved.

Where your data will be processed

BIST and its appointed contractors are based in the UK and will carry out their roles within the UK.

How long your data will be retained

We will keep your personal data for no longer than is necessary for the purposes for which it is made available. Your personal data will be deleted once your claim is finalised, unless we are legally required to retain it for longer or where retention is strictly necessary for internal audit purposes.

A 15-year retention period applies to records that are likely to become historically significant. This could include (but is not limited to) records relating to:

• board meetings
• major events
• inquiries
• departmental structure
• trade-related legislation
• high-level policy

Your rights as a data subject

You have a number of rights in relation to the handling of your personal data. These rights are not applicable in all circumstances and exemptions may apply. Your rights may include the following:

• access – you are entitled to request access to your personal data (commonly known as a data subject access request), which enables you to receive a copy of the personal data that BIST holds about you and to check that they are lawfully processing it
• correction – you are entitled to request that any incomplete or inaccurate personal held about you is corrected
• erasure – you are entitled to ask BIST to delete or remove personal data in certain circumstances, however, there are also certain exceptions where BIST may refuse a request for erasure (for example, where the personal data is required for compliance with law or in connection with claims)
• restriction – you are entitled to ask BIST to suspend the processing of certain of your personal data about you (for example, if you want to establish its accuracy)
• transfer – you may request the transfer of certain of your personal data to another party in some circumstances
• objection – where BIST is processing your personal data based on a task in the public interest, you may object to processing on this ground, however, BIST may be entitled to continue processing your personal data based on compelling legitimate grounds or for the establishment, exercise or defence of legal claims

Complaints

If you have concerns about how your personal data has been used, you may make a complaint directly to BIST by contacting data.protection@businessandtrade.gov.uk.

If you remain dissatisfied, you also have the right to complain to a supervisory authority. In the UK you can make a complaint to the Information Commissioner’s Office (ICO).

Information Commissioner’s Office

Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF

Email casework@ico.org.uk

Telephone: 0303 123 1113

Textphone: 01625 545860

Lines are open from Monday to Friday 9am to 4:30pm.

Contact details

You can contact BIST’s Data Protection Officer for further information about how your data has been processed by the department or to make a complaint about how your data has been used:

Data Protection Officer

Department for Business, Innovation, Science and Trade
Old Admiralty Building
Admiralty Place
London
SW1A 2DY

Email data.protection@businessandtrade.gov.uk

Changes to the privacy notice

This privacy notice may change from time to time. If so, any changes will apply to you and your personal data immediately.

If a change significantly affects your rights or, to the extent permitted, significantly changes how or why your personal data is used, you or your legal representatives and advisors will be notified by email.