Transparency data

Government Commercial employees privacy notice (HTML)

Published 2 April 2026

This notice sets out how we will use your personal data, and your rights. It is made under Articles 13 and/or 14 of the UK General Data Protection Regulation (UK GDPR). 

YOUR DATA 

The purpose(s) for which we are processing your personal data will be collected and kept in order for the Government Commercial Organisation (GCO) operations team to effectively manage your employment within the Cabinet Office and assist with any payroll/HR queries. 

Your data will also be used to develop an appropriate Learning & Development (L&D) programme for commercial specialists. 

We will use data to contact you about relevant L&D and networking events as well as to contact you concerning any aspect of your employment with the GCO. 

We will keep records of your personal development and talent conversations to further provide assistance regarding talent and career planning.

We may also use your data to keep under review our performance and rewards framework by undertaking equal pay analysis, identifying internal equity issues, benchmarking GCO’s reward practices against external roles, and developing evidence-based reform options to ultimately benefit the entire GCO workforce. 

We may also use your data to provide high level statistics and analysis. 

We will process the following personal data: 

• name
• address
• age
• gender
• email
• telephone number
• employment status
• employment history
• assessment centre data and results
• salary grade
• employee number
• job title
• work address
• department/directorate
• location data
• security status
• line manager name
• performance and reward data
• Ethnicity 
• Health 

Lawful basis of processing 

The lawful basis for processing your personal data is where it is necessary:

for the performance of a contract to which you are a party. As an employee of the GCO we are required to use certain aspects of your personal data in order to enable you to perform tasks specified in your contract, for the performance of a task carried out in the public interest or in the exercise of official authority. Improving commercial capability is a key task of the Government Commercial Function (GCF). In order for the Commercial Capability Programme to effectively perform this exercise, your personal data is required to ensure appropriate accreditation and development can be offered.

Sensitive personal data is personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, and the processing of genetic data, biometric data for the purpose of uniquely identifying a natural person, data concerning health or data concerning a natural person’s sex life or sexual orientation. 

The legal basis for processing your sensitive personal data is where: 

It is necessary for the purposes of performing or exercising our obligations or rights as the controller, or your obligations or rights, under employment law, social security law or the law relating to social protection by providing reasonable and workplace adjustments, 

processing is of data concerning ethnicity, religious or philosophical belief, health including disability or sexual orientation, and it is necessary for the purposes of identifying or keeping under review the existence or absence of equality of opportunity or treatment between groups of people with a view to enabling such equality to be promoted or maintained;

It is necessary for archiving purposes, scientific or historical research purposes or statistical purposes, to support long-term research and statistical analysis to ensure our workforce remains fair, competitive, and effectively trained in the public interest.

Recipients

Your personal data will be shared by us with our assured data processors who provide our HR and payroll solution. 

Your personal data may also be shared with the department you are currently deployed to for the purposes listed above.

During your assessment centre, assessors will have access to portions of the information outlined above.

Personal data may also be shared with our learning and development providers and the venues these sessions take place in, as well as our Assessment and Development Centre Database providers.

If you choose to take part in a career conversation, your data may also be shared with external career coaches.

All data may be shared with external data analysis organisations to support aggregated statistical analysis that may be required for research purposes.

As your personal data will be stored on our IT infrastructure it will also be shared with our data processors who provide email, and document management and storage services to us. 

Retention 

Your personal data will be kept by us until a year after the end of your employment with the Government Commercial Organisation.

Any data not collected directly by the GCO Operations team was provided to us by your department.

If you are a new recruit to the Civil Service, any data not collected directly from the GCO Operations team was collected by Civil Service Resourcing.

Automated Decision Making

For participants taking part in any GCF-associated accreditation, scores (derived from a series of online or face to face assessments) will be combined (using a pre-determined algorithm) to generate an overall grade. The grade is then used to determine accreditation status or otherwise.

YOUR RIGHTS 

You have the right to request information about how your personal data are processed, and to request a copy of that personal data. 

You have the right to request that any inaccuracies in your personal data are rectified without delay. 

You have the right to request that any incomplete personal data are completed, including by means of a supplementary statement. 

You have the right to request that your personal data are erased if there is no longer a justification for them to be processed. 

You have the right in certain circumstances (for example, where accuracy is contested) to request that the processing of your personal data is restricted. 

You have the right to object to the processing of your personal data where it is processed for direct marketing purposes. 

You have the right to object to the processing of your personal data.

INTERNATIONAL TRANSFERS 

As your personal data is stored on our Corporate IT infrastructure, and shared with our data processors, it may be transferred and stored securely outside the UK. Where that is the case it will be subject to equivalent legal protection through an adequacy decision, reliance on Standard Contractual Clauses, or reliance on a UK International Data Transfer Agreement.

As your data will be shared with our supplier who provides Human Resource data management and processing services to us, it may be stored securely outside the UK. Where that is the case it will be subject to equivalent legal protection through an adequacy decision by the UK Government.

COMPLAINTS 

If you consider that your personal data has been misused or mishandled, you may make a complaint to the Information Commissioner, who is an independent regulator.  The Information Commissioner can be contacted at:  Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF, or 0303 123 1113, or icocasework@ico.org.uk.  Any complaint to the Information Commissioner is without prejudice to your right to seek redress through the courts. 

CONTACT DETAILS 

The data controller for your personal data is the Cabinet Office. The contact details for the data controller are: Cabinet Office, 70 Whitehall, London, SW1A 2AS, or 0207 276 1234, or you can use this webform. 

The contact details for the data controller’s Data Protection Officer are: dpo@cabinetoffice.gov.uk. 

The Data Protection Officer provides independent advice and monitoring of Cabinet Office’s use of personal information.

Not for inclusion on the completed privacy notice, but for reference, many Cabinet Office Privacy Notices are published here: Personal Information Charter