Guidance

Immigration Enforcement employee integrity: privacy information notice

Updated 30 March 2026

Introduction

Immigration Enforcement is an operational command of the Home Office responsible for preventing abuse of the immigration system, increasing compliance with immigration law, pursuing immigration offenders and protecting the vulnerable.

This specific privacy information notice has been created to make it easier for you to understand what personal data the Home Office and Immigration Enforcement processes about you and how and why we use it.

You should read this PIN in conjunction with the Home Office recruitment privacy information notice and the Employee life cycle privacy information notice.

This privacy notice applies to all employees in relation to the processing of your data under the Immigration Enforcement Mandatory Declarations process during the lifecycle of your employment with Immigration Enforcement

This privacy notice will also apply to the personal data of individuals (referred to as ‘third parties’) that you provide as part of the mandatory declarations process.

This notice reflects your rights under the UK General Data Protection Regulation and the Data Protection Act 2018 and informs you how we will look after and use your personal information.

Privacy Notice

Your personal information, supplied for the purposes of mandatory declarations, will be held and processed by the Home Office which is the ‘Controller’ of this information. This also includes when it is collected or processed by third parties on our behalf. The Home Office is based at 2 Marsham Street, London, SW1P 4DF.

The Home Office has appointed a data protection officer (DPO) to help ensure we fulfil our legal obligations when processing personal information. The Data Protection Officer can be contacted at: DPO@homeoffice.gov.uk

Lawful basis for processing your personal data

We are only allowed to gather, use and share personal information where we have an appropriate legal basis to do so under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018 (DPA 2018). The Home Office collects and processes personal information to fulfil its legal and official functions. We will only use personal information when the law allows us to and where it is necessary and proportionate to do so.

The legal basis for the processing of your data for the purposes of our mandatory declarations policy is covered under Part 2 (General Processing – the UK GDPR) of the DPA 2018. The specific legal basis is under Article 6 (1) (f):

• The processing is necessary for the purposes of the legitimate interests pursued by Immigration Enforcement or by a third party.

Immigration Enforcement has a legitimate interest to assess employee suitability for access to sensitive information, assets and equipment. It is in the best interest of the employee to provide a full disclosure so that any risks that they present as a Home Office employee can be carefully assessed and managed. This process aims to safeguard employees and the organisation from the threat of corruption through a culture of professionalism and integrity.

We may also collect, process, and share more sensitive personal data which is known as Special Category Data. This is covered under Article 9 (2) (g):

• The processing is necessary for reasons of substantial public interest.

When we process special category data using the lawful basis of “substantial public interest” under Article 9 (2) (g), we meet the following conditions set out in Part 2 of Schedule 1 of the DPA 2018:

10. Preventing or detecting unlawful acts

11. Protecting the public

14. Preventing fraud

The processing of personal data relating to criminal convictions and offences takes place in line with Article 10 of the UK GDPR.

Automated decision-making, including profiling

The information you provide will not be used for automated decision-making (making a decision by automated means without any human involvement) or profiling by automated means to carry out evaluations.

Storing your information

Your personal information will be held for as long as necessary for the purpose for which it is being processed and in line with departmental retention policy. This can be found at:

Retention and Disposal Standards (GOV.UK) 

Sources and categories of information

Information processed for mandatory declarations purposes is obtained direct from employees. This also includes any third party personal data which is processed as part of a declaration.

Categories of information include:

• personal information (including name, address, social media handle)
• sponsorship of immigration applications
• current UK immigration applications submitted by yourself
• current UK immigration applications submitted by family members and close friends that you are not sponsoring
• secondary employment (including unpaid and volunteering)
• new criminality (including arrests, convictions and cautions)
• significant changes in personal finances
• personal business interests in Home Office contracts

Special category and criminal conviction and offence data

The following special categories of data may be gathered and processed:

• information relating to race or ethnicity (including nationality)
• information relating to religious or philosophical beliefs
• information relating to political opinions
• information relation to trade union membership
• criminal conviction and offence information.

Data sharing

Personal data provided under the mandatory declaration process will only be shared outside the Home Office when there is a compelling lawful and proportionate, reason to do so. For instance, if it is necessary to comply with a legal obligation.

All external data sharing will be compliant with the UK GDPR and the DPA 2018 and occur on a case by case basis, validated in each instance for legality and proportionality.

Third party personal data

The Immigration Enforcement mandatory declarations process requires you to provide the Home Office with information in accordance with HR policies which include: the Conflict of Interest and Other Outside Activities Policy, the Personal Conduct Policy, and the Maintaining Personnel Security Policy and Procedures.

As part of your declaration, you may need to provide the personal data of third parties. Where the processing of that data is not covered by other privacy notices such as the Personal information charter - Home Office - GOV.UK or the Borders, immigration and citizenship: privacy information notice - GOV.UK, it is covered under this notice and is collected and processed on the same legal basis as your personal data and in line with the UK GDPR and DPA 2018.

During the creation of the mandatory declaration process, steps have been taken to ensure that you only provide information that is necessary, proportionate and aligned with current HR policies to manage potential risks to Immigration Enforcement arising from activities in your private life. You will be asked specific questions that will enable line managers to assess and manage the level of risk posed. The line manager’s consideration of the information declared is also personal data that will be captured in the process.

Requesting access to your personal data  

You can find more information about your data rights on the Information Commissioner’s Office website.

Employees

If you wish to make a Subject Access Request, please contact:

info.access@homeoffice.gov.uk

Third parties

If an employee has provided your personal information to the Home Office as part of their mandatory declaration, you may request a copy of this information by contacting:

info.access@homeoffice.gov.uk or write to us at:

Information Rights Team
Home Office Lower Ground Floor
Seacole Building
2 Marsham Street
London
SW1P 4DF

Other rights

You may have the right to:                  

• Erasure (ICO) - in certain circumstances you are entitled to request that your personal data is erased where one of the statutory grounds applies.

• Restrict processing (ICO) - request that the processing of your personal data is restricted in certain circumstances – for example, where accuracy is contested.

• Rectification (ICO) - request that any inaccuracies in your personal data are rectified without delay. Request that any incomplete personal data is completed, including by means of a supplementary statement.

If you wish to exercise any of these rights, please email info.access@homeoffice.gov.uk or write to us at:

Information Rights Team
Home Office
Lower Ground Floor, Seacole Building
2 Marsham Street
London
SW1P 4DF

Questions or concerns about personal data

If you have any questions about the collection, use or disclosure of your personal information or wish to make a complaint you can contact the Home Office’s Data Protection Officer by email: dpo@homeoffice.gov.uk

or write to:

Office of the DPO
Home Office
Peel Building
2 Marsham Street
London
SW1P 4DF

You have the right to complain to the Information Commissioner’s Office (ICO) about the way the Home Office is handling your personal information. You can contact the ICO at:

Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF

Telephone: 0303 123 1113