Guidance

Cabinet Office Government Cyber Apprenticeships privacy notice

Published 11 July 2025

This notice sets out how we will use your personal data, and your rights. It is made under Articles 13 and/or 14 of the UK General Data Protection Regulation (UK GDPR). 

1. Your data 

1.1 1.1 Purpose

The purpose(s) for which we are processing your personal data is:

• to facilitate and support cross-functional apprenticeships within the Government Security Profession, ensuring accurate recording of apprentice employment across the function.

• to monitor and report anonymised statistical information on different groups of apprenticeships by analysing outcomes, effectiveness and diverse backgrounds to cultivate a skilled and diverse service. This information is reported to officials across the civil service and for use in the public domain.  

1.2 1.2 The data

We will process the following personal and sensitive personal data:

• Full name 
• Corporate email 
• Date of birth
• Personal email address
• Personal Telephone number
• Identification documents 
• Address history 
• Line managers contact details
• Current employment status
• Level of your apprenticeship
• Status of your apprenticeship
• Your civil service grade
• Apprenticeship standard
• If you were an existing civil servant
• Contract type
• Region where you work
• Training record
• Age (ONS age bands)
• Gender
• Ethnicity
• Disability status
• Sexual orientation
• Health data
• Socio- economic background

1.3 1.3 Legal basis of processing

The lawful basis for processing your personal data is where: 

• Processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the data controller. In this case the Cabinet Office is responsible for the monitoring and reporting of apprenticeships across the Civil Service and supports departments in the delivery of their targets. 

• It is necessary for the performance of a contract to which the data subject is a party. In this case that is an employment contract.

• It is necessary in order to take steps at the data subject’s request prior to entering into a contract application for employment or pre-employment checks.

Sensitive personal data is personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, and the processing of genetic data, biometric data for the purpose of uniquely identifying a natural person, data concerning health or data concerning a natural person’s sex life or sexual orientation. 

The condition for processing your sensitive personal data is where: 

• You have freely and explicitly given your consent

• Processing is necessary for reasons of substantial public interest for the exercise of a function of the Crown, a Minister of the Crown, or a government department; the exercise of a function conferred on a person by an enactment; or the exercise of a function of either House of Parliament. 

• Processing is of data concerning ethnicity, religious or philosophical belief, health including disability or sexual orientation, and it is necessary for the purposes of identifying or keeping under review the existence or absence of equality of opportunity or treatment between groups of people with a view to enabling such equality to be promoted or maintained.

• It is necessary for archiving purposes, scientific or historical research purposes or statistical purposes, and it is in the public interest.  

1.4 1.4 Recipients

As joint controllers, we will share some of your personal information with your host department to facilitate the apprenticeship and support your training. 

We share your data with our third party assured learning providers who supply the formal learning services to us.

With your explicit consent, we may securely share health data to support any reasonable adjustments with specific individuals in your host department. 

We will also share anonymised, aggregate or summary data with other public bodies and we may publish this, but it will not allow any individuals to be identified.

As your personal data will be stored on our IT infrastructure it will also be shared with our data processors who provide email, and document management and storage services. 

Where personal data has not been obtained from you, your personal data were obtained by us from the Government Recruitment Service.

1.5 1.5 Retention 

Personal email addresses and telephone numbers shared with us for onboarding purposes and are deleted after 1 month.  

Health reports shared directly by you which contain disability information or the requirement for reasonable adjustments are stored for 3 years; however, If you do not provide explicit consent, your health data is deleted immediately.  

Identification and address history is stored on our assured third party platform as part of the vetting process and then deleted. 

All other personal data is retained for 4 years.

We only retain your personal data for as long as it is needed for the purposes set out in this document or for as long as the law requires us to.

2. Your rights 

You have the right to request:

• Information about how your personal data are processed, and to request a copy of that personal data.
• Any inaccuracies in your personal data are rectified without delay.
• Any incomplete personal data are completed, including by means of a supplementary statement.
• That your personal data are erased if there is no longer a justification for them to be processed.

You have the right to:

• Request in certain circumstances (for example, where accuracy is contested) that the processing of your personal data is restricted.
• Object to the processing of your personal data where it is processed for direct marketing purposes.
• Object to the processing of your personal data.

You have the right to:

• Request in certain circumstances (for example, where accuracy is contested) that the processing of your personal data is restricted.
• Object to the processing of your personal data where it is processed for direct marketing purposes.
• Object to the processing of your personal data.
• You have the right to withdraw consent to the processing of your personal data at any time.
• You have the right to request a copy of any personal data you have provided, and for this to be provided in a structured, commonly used and machine-readable format.

3. International transfers

As your personal data is stored on our Corporate IT infrastructure, and shared with our data processors, it may be transferred and stored securely outside the UK. Where that is the case it will be subject to equivalent legal protection through an adequacy decision, reliance on Standard Contractual Clauses, or reliance on a UK International Data Transfer Agreement.

As your data will be shared with our Learning Providers who supply the formal learning services to us, it may be stored securely outside the UK. Where that is the case it will be subject to equivalent legal protection through an adequacy decision by the UK Government , Standard Contractual Clauses and/or a UK International Data Transfer Agreement. 

4. Complaints

If you consider that your personal data has been misused or mishandled, you may make a complaint to the Information Commissioner, who is an independent regulator.  The Information Commissioner can be contacted at:  Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF, or 0303 123 1113, or icocasework@ico.org.uk.  Any complaint to the Information Commissioner is without prejudice to your right to seek redress through the courts. 

5. Contact details 

The data controller for your personal data is the Cabinet Office. The contact details for the data controller are: Cabinet Office, 70 Whitehall, London, SW1A 2AS, or 0207 276 1234, or you can use this webform. 

The contact details for the data controller’s Data Protection Officer are: dpo@cabinetoffice.gov.uk. 

The Data Protection Officer provides independent advice and monitoring of Cabinet Office’s use of personal information.

Not for inclusion on the completed privacy notice, but for reference, many Cabinet Office Privacy Notices are published  here