Guidance

Privacy-Notice: ERP Transition Programme: From NEO to SOP (HTML)

Updated 8 October 2026

This privacy notice sets out how the Cabinet Office will use your personal data, and your rights, during the data migration, cleansing, and testing activities for the new Enterprise Resource Planning (ERP) solution under the My Cabinet Office (MyCO) Programme as part of the Matrix shared services cluster transition to Neo (Workday) platform.

This notice is made under Articles 13 and 14 of the UK General Data Protection Regulation (UK GDPR).

1. YOUR DATA

1.1 Purpose of Processing

The purposes for which the Cabinet Office is processing your personal data under the MyCO Programme are:

• Legacy Migration & Consolidation: To support the My Cabinet Office (MyCO) Programme (part of the wider Matrix Programme) in migrating Cabinet Office HR, payroll, finance, and procurement data from legacy platforms—including SSCL (Oracle SOP), Workday instances (Fast Stream FSET and Government Commercial Organisation GCO), Fieldglass, OrgVue and off-system spreadsheets—to a new consolidated Enterprise Resource Planning platform (Workday Neo).
• Data Cleansing & Quality Assurance: To perform data quality assurance, health checks, and manual cleansing across data tables to identify and resolve invalid characters, missing mandatory fields, and duplicate records prior to migration.
• Integration & System Testing: To execute test transfer and load cycles, End-to-End (E2E) integration testing (including Single Sign-On, Email Writeback, and loading test Worker IDs into Freshdesk and Google Identity), and pensions provider integration testing (with Capita/CSPS, Legal & General, Gallagher, and NEST) to ensure overall system accuracy and payroll readiness before go-live.
• Payroll Testing: A unique and important phase of testing for the introduction of Neo will be the Payroll Comparison Testing where pay run results from SOP will be compared with pay outputs from Neo to validate accuracy of employee pay. This will be in addition to Payroll testing carried out in End to End and CSPS testing phases. For maximum accuracy and the ability to identify, investigate and remedy defects all of this testing will be conducted on clones of live data. 

1.2 Categories of Personal Data

We will process the following categories of personal data relating to Cabinet Office employees, ex-employees, contingent workers, and applicants:

• Standard Personal Data: Full name, title, date of birth, gender, marital status, dependants, next of kin, emergency contact details, home address, work address, telephone numbers, personal email address, work email address, National Insurance (NI) number, employee/worker ID (including test Worker IDs), job title, grade, profession, line manager, work location, terms and conditions, working hours, start and leaving dates, bank account details, tax status, payroll and salary records, allowances, overtime, bonuses, pension details, benefit records, absence and attendance records, and contingent worker records.
• Special Category (Sensitive) Personal Data: Racial or ethnic origin, religious or philosophical beliefs, trade union membership, health data (including disability status and dietary requirements), and data concerning sex life or sexual orientation (processed for equality monitoring and accessibility purposes) as entered into SOP will be transferred to Neo.
• Criminal Convictions Data: Personal data relating to criminal convictions and offences is not processed as part of this project activity.

1.3 Legal Basis of Processing

The legal grounds relied upon under the UK General Data Protection Regulation (UK GDPR) and Data Protection Act 2018 (DPA 2018) are structured as follows:

Data Category	UK GDPR Provision	Specific Justification & Context
Personal Data	Article 6(1)(f) Legitimate Interests	Necessary for the legitimate interests pursued by the Cabinet Office to improve HR data quality, perform quality assurance, ensure secure data transfer, and verify system integrations prior to migrating to the new HR data service provider.
Standard Personal Data	Article 6(1)(e) Public Task	Necessary for the performance of a task carried out in the public interest or official authority vested in the data controller—specifically for conducting cross-government pensions integration testing and enabling civil service management.
Special Category Data	Article 9(2)(g) UK GDPR & Para 6, Sch. 1 DPA 2018	Necessary for reasons of substantial public interest for the exercise of a function of the Crown, a Minister, or a government department—specifically ensuring staff data accuracy across central government.

1.4 Data Recipients and Processors

Your personal data will be shared with and processed by the following entities:

• Primary Processor: Department for Science, Innovation and Technology (DSIT), operating under a Memorandum of Understanding as Primary Processor for the Workday Neo implementation.
• Sub Processor : Cognizant (sub-processor to DSIT) handling data transformation, validation tooling, and Workday load file preparation on encrypted DSIT laptops.
• Sub Processor: UKSBS (sub-processor to DSIT) provisioning and hosting the AWS environment for validation tooling and execution of testing.
• Sub Processor : Workday, SSCL (legacy shared services provider), MoveIT, AWS, Egress, Freshdesk, Google Workspace / Google Identity, and Microsoft (Excel Add-ins).
• Pensions Integration Partners: Capita (CSPS), Legal & General, Gallagher, and NEST for cross-government pensions interface testing.

1.5 Data Retention Periods

Personal data processed during the migration and testing phases will be retained only as long as necessary:

• Matrix Programme Duration: Personal data processed in migration and testing environments will be kept for the duration of the Matrix Programme (up to 3 years; expected go-live late 2026 or 2027), after which all test data will be wiped or deleted. On NEO go-live the current Cabinet Office privacy notice which details how HR and finance personal information is managed will be refreshed.
• Temporary Load Files: Data files downloaded by Cognizant onto DSIT laptops are deleted immediately after each completed load cycle.

1.6 Automated Decision Making

Your personal data will not be subject to automated decision-making or profiling that produces legal or similarly significant effects.

1.7 Sources of Personal Data

Where personal data has not been obtained directly from you, it has been retrieved from existing Cabinet Office legacy platforms, including:

•  SSCL (Oracle SOP database)
•  Workday instances (Fast Stream FSET and Government Commercial Organisation GCO)
•  Fieldglass (contingent worker records)
•  Off-system Business Unit spreadsheets, Orgvue, and third-party pension administrators

2. YOUR RIGHTS

Under data protection law, you have the following rights regarding your personal information:

• Right of Access: You have the right to request information about how your personal data is processed, and to request a copy of that personal data (Subject Access Request).
• Right to Rectification: You have the right to request that any inaccuracies in your personal data are rectified without delay.
• Right to Completion: You have the right to request that incomplete personal data is completed, including by means of a supplementary statement.
• Right to Erasure: You have the right to request that your personal data is erased if there is no longer a legal justification for processing.
• Right to Restriction: You have the right to request that processing is restricted in certain circumstances (e.g. where accuracy is contested).
• Right to Object: You have the right to object to the processing of your personal data where processing is based on public task or legitimate interests.
• Right to Data Portability: You have the right to request a copy of data you provided in a structured, commonly used, and machine-readable format where processing is based on contract or consent.

3. INTERNATIONAL TRANSFERS

Your personal data is managed within secure UK and European environments:

• UK Primary Hosting: Your personal data is primarily stored on corporate IT infrastructure located in the UK (including Workday UK AWS data centre WD107 and UKSBS AWS environment).
• EEA Cloud Services: Certain DSIT/Microsoft cloud services restricted to the EEA operate under UK Government Adequacy Decisions.

4. COMPLAINTS & REGULATORY OVERSIGHT

Information Commissioner’s Office (ICO)

If you consider that your personal data has been misused or mishandled, you may make a complaint to the Information Commissioner, who is an independent regulator:

Information Commissioner’s Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF

Telephone: 0303 123 1113

Email: icocasework@ico.org.uk / casework@ico.org.uk

Any complaint to the Information Commissioner is without prejudice to your right to seek redress through the courts.

5. DATA CONTROLLER & DPO CONTACT DETAILS

Contact Details

The data controller for your personal data is the Cabinet Office.

If you have any questions about this privacy notice, please contact the Data Protection Officer (DPO) at:
dpo@cabinetoffice.gov.uk

The Data Protection Officer provides independent advice and monitoring of the Cabinet Office’s use of personal information.