Freedom of Information Act and Environmental Information Regulations Requests Privacy Notice
Updated 25 March 2026
© Crown copyright 2026
This publication is licensed under the terms of the Open Government Licence v3.0 except where otherwise stated. To view this licence, visit nationalarchives.gov.uk/doc/open-government-licence/version/3 or write to the Information Policy Team, The National Archives, Kew, London TW9 4DU, or email: psi@nationalarchives.gov.uk.
Where we have identified any third party copyright information you will need to obtain permission from the copyright holders concerned.
This publication is available at https://www.gov.uk/government/publications/freedom-of-information-act-and-environmental-information-regulations-requests-privacy-notice/freedom-of-information-act-and-environmental-information-regulations-requests-privacy-notice
1. Data Controller
A data controller makes decisions about processing activities. They exercise overall control of the personal data being processed and are ultimately in charge of and responsible for the processing.
The data controller for this processing activity is HM Treasury.
2. Data Processors
A data processor is an organisation or company that handles personal information on our behalf, following our instructions. Data processors do not use your information for their own purposes; they only process it as directed by us.
The following organisations are directed to process your personal information on our behalf:
| Processor Name | Function |
|---|---|
| Fivium (eCase) | Provides the correspondence management system |
| CEOX | Delivers Robotic Processing Automation (RPA) and API integration services for automated case creation in eCase |
| Microsoft | Provision of enterprise IT services including email, document storage, collaboration tools, and infrastructure support |
3. Who we process personal data about
The table below outlines the categories of individuals whose personal data we will process in this activity, alongside the types of personal data we will use.
| Category of Individual | Types of Personal Data |
|---|---|
| Members of the public , Representatives of businesses or organisations, Journalists / media agencies, Ministers | Name , Postal address , Email address , Telephone number , Job title and employer (where an individual is making a request on behalf of an organisation) , Personal opinion , Other miscellaneous personal data |
HMT do not require, and do not request, special category or criminal convictions data to process Freedom of Information Requests. However, if you choose to include such information within your request it will be retained within the case file. This is because HMT keeps original versions of documents provided at the point of request to ensure they are available for in the event of a future dispute or case review. Special categories of personal data may include:
-
Data about racial or ethnic origin
-
Political opinions
-
Religious or philosophical beliefs
-
Trade union membership
4. Source of Your Personal Data
Personal data of the individuals listed above will be collected in the following ways:
Directly - from FOIA / EIR Applicants (you)
Indirectly - where an FOI/EIR request has been received and transferred by another department within HMT
5. Purpose and Lawful Basis
We will process your personal data for the following purposes and using the specified lawful bases:
| Purpose | Lawful Basis | Further Information |
|---|---|---|
| To receive, and respond to, requests made under FOIA and EIR legislation | Section 1(1) & 8(1)(a) of the Freedom of Information Act 2000, Article 6(1)(c) of the UK GDPR – Legal obligation, underpinned by the Freedom of Information Act 2000, Article 9(2)(g) of the UK GDPR – Substantial public interest , Schedule 1, Part 2, Paragraph 6(2)(a) of the Data Protection Act – conferred by an enactment or rule of law | Personal data processing is necessary in order for HM Treasury to fulfil our legal obligations in responding publicly to applicants under FOIA and EIR |
6. Who we share your personal data with
We will share your personal data with the following types of recipients:
- Other government departments – FOIA / EIR requests, including applicant’s personal data, may be shared with other government departments where necessary to respond to the request
Please be aware that if we receive correspondence or communication which we consider threatening in nature or suggests a possible risk to you or a third party, we may share this correspondence (along with your personal data) with relevant law enforcement / safeguarding authorities.
7. International Transfers
Your personal data will not typically be transferred to an international recipient during this activity. However, in rare circumstances, your personal data might be transferred to a recipient based outside of the United Kingdom where consultation is necessary to inform HMT decision-making. In such cases, we will ensure an appropriate legal mechanism applies and the relevant conditions are met.
8. How long we hold your personal data
We will retain your personal data only for as long as necessary to fulfil the purposes for which it was collected.
The specific retention period applicable to your personal data will be as follows:
| Type of Processing | Retention period |
|---|---|
| FOI case management system data | No longer than 6 years |
| Microsoft: Outlook exchange data (emails) | No longer than 3 years |
9. Automated Decision-Making and Profiling
This activity does not involve automated decision making or profiling. This means that decisions which may affect you are not made solely by automated means without human involvement, and your data is not subject to analysis intended to evaluate or predict aspects such as your behaviour, preferences, or interests.