Guidance

MHCLG user research privacy notice

Published 13 August 2026

The Ministry of Housing Communities and Local Government (MHCLG) carries out research to test and improve services and systems.

This privacy notice gives you general information on how we handle research data at MHCLG. For more details about a specific piece of research, you can refer to the information sheet provided when you’re invited to take part in that project. This should also include contact details for the researcher and their team in case you have any further questions.

The data controller is the Ministry of Housing, Communities and Local Government. A data controller determines how and why personal data is processed. Read MHCLG’s Personal information charter for more information.

We may also do user research on behalf of other government departments, local authorities or partner organisations. In these situations we will either be a joint controller with the other government department or data processor acting on behalf of the other government department. Where this is the case you’ll be notified in the information sheet for specific projects.

Why we need your data

We need information about you when inviting you to take part in research to ensure that:

• you meet the criteria for the piece of research
• we are including a wide range of people
• we can use your data to schedule research sessions with you

We need to collect data during the research session to ensure that we have an accurate record of what happened and what was said. This is important, because we then analyse this information and use it to draw conclusions about what we should do next.

Our legal basis for using your data

MHCLG carries out user research to understand people’s needs and improve government services, policies and systems.

In most cases, we process your personal data because this is necessary for the performance of a task carried out in the public interest.

Taking part in user research is voluntary. Before taking part, you will be given information about the research and asked to confirm that you agree to participate. We ask participants to do this as part of our commitment to ethical research practices. This helps ensure that you understand what taking part involves, how your information will be used, and that you are happy to take part.

Some research projects may involve the collection of special category personal data, such as information about your ethnicity, health or disability. Where we process this type of information, we will only do so where an appropriate condition under data protection law applies, including where processing is necessary for reasons of substantial public interest.

Where a particular research opportunity relies on a different lawful basis, or requires additional information about how your data will be used, this will be explained in the information sheet or participant agreement form provided for that opportunity.

What data we collect from you

When inviting you to take part

The personal data we collect from you when inviting you to take part could include information about your:

• name
• age
• gender
• ethnicity
• disabilities, such as details of any condition that can affect your ability to use a computer
• job title
• email address
• phone number

We may collect additional information, based on the specific topic being researched. For example, if we’re conducting research on a specific government service, we might want to know whether you’ve used this service in the past.

We sometimes work with other organisations to carry out research. This can include companies that help us recruit people to take part in research. Some of these organisations may also collect information for their own business purposes. Where they do this, they act as an independent data controller and their own privacy policy will explain how they use that information. Any information collected for these purposes is separate from your participation in MHCLG research.

During the research session

In most cases, we’ll collect personal data during the research. We will always ask participants to agree to the type of personal data we collect. This could be in the form of:

• audio recordings
• video recordings
• screen recordings
• written notes
• photos

What we do with your data

Collecting and analysing

We may use the following third party tools and services to collect, transcribe or analyse your data:

• survey tools
• online collaboration tools, including video conference and virtual whiteboard tools
• transcription services, including automatic transcription and analysis tools
• consent management tools

Some of the tools we use may have inbuilt AI functionality, for example to help with research analysis. If AI functionality within a tool is used, it is thoroughly risk assessed and a person will always check outputs for accuracy.

We sometimes use external organisations to book a venue for the research outside of our offices, and external tools to conduct remote research sessions. This means that a limited number of staff in other organisations may have access to your data - for example, when we use the recording equipment at an external venue.

If we do any of the above, we will monitor and limit the access that people outside MHCLG have to your data. The privacy policies of these external organisations will also apply.

Reporting the results

When using your responses in reports, presentations or publications, or when sharing with other government departments, we will make sure you cannot be identified from your data. Each person taking part in a piece of research will be assigned a number, and any names or other personal and identifiable data will be removed.

Only researchers working at MHCLG will have access to the full original recordings or transcriptions. The only exception to this is during the transcription and analytics phase (described above) when transcription and analytics services may be used. 

We may share short audio or video clips with other colleagues within MHCLG and other government departments if we have your express permission to do so. Sometimes we use tools which may have inbuilt AI functionality. If we use AI tools, it has been thoroughly risk assessed and a person always checks the output for accuracy.

If we do any of the above, we will monitor and limit the access that people outside MHCLG have to your data. The privacy policies of these external organisations will also apply.

Legal obligations

We will share your data if we’re required to do so by law - for example, by court order, or to prevent fraud or other crime. We will also share your data in the event of a serious safeguarding concern - for example, if we are concerned about the welfare of a child or vulnerable adult.

We will not:

• sell or rent any of your data to third parties
• share your data with third parties for marketing purposes

Where your data is processed and stored

Your personal data will be stored on our IT systems, which are provided by third party email, document management and storage service providers.

Your personal data may sometimes be processed outside the United Kingdom. Where this happens, we will ensure it is protected in line with UK data protection law. This may be through countries recognised as providing adequate protection, or through approved contractual safeguards.

How long we keep your data

The data collected when we invite you to take part will be held for a maximum of 6 months. After this point, we will delete this but will keep a record of your agreement,, your name, and the data gathered during the research session.

We will hold the data from research sessions, your name, and a record of your agreement for a maximum of 2 years. After this point, we will delete all personal data relating to you, but we might retain reports that contain your anonymised quotes.

How we protect your data and keep it secure

We are committed to doing all that we can to keep your data secure. We have set up systems and processes to prevent unauthorised access to or disclosure of the data we collect about you. For example, we protect your data using varying levels of encryption. All third parties that process personal data for MHCLG are also required to keep that data secure.

Your rights

Taking part in research is voluntary. If you decide that you no longer want to take part, you can withdraw from the research at any time.

If you withdraw before your personal data has been anonymised, you can ask us to delete the information we have collected about you. We will do this wherever possible.

If your information has already been anonymised, included in analysis, or used in reports, presentations or publications, we may not be able to identify or remove your individual contribution. Once information has been anonymised so that you can no longer be identified, it is no longer considered personal data.

You also have the right to request:

• information about how your personal data is processed
• a copy of that personal data
• that this copy be provided in a structured, commonly used and machine-readable format
• that anything inaccurate in your personal data is corrected without delay
• that your personal data is erased if there is no longer a justification for holding it
• that the processing of your personal data is restricted in certain circumstances (for example, where accuracy is contested)

If you have any of these requests, please contact us using the details in the information sheet provided to you, or the contact details listed below.

Questions and complaints

If you have questions about research that you’ve been invited to participate in, including how your personal data will be used, please contact the researcher or research team named on the participant agreement form provided to you.

Contact the MHCLG Data Protection Team if you:

• think that your personal data has been misused or mishandled
• want to make a subject access request (SARS)
• want to raise a complaint about how your personal data has been processed

Email: dpo@communities.gov.uk

The data controller for your personal data is MHCLG. The contact details for our Data Protection Officer are:

Email: dpo@communities.gov.uk 

The Data Protection Officer provides independent advice and monitoring of MHCLG’s use of personal information.

You can also complain to the Information Commissioner, who is an independent regulator.

Information Commissioner’s Office
Wycliffe House
Water Lane 
Wilmslow
Cheshire 
SK9 5AF

Information Commissioner’s Office   

Email: icocasework@ico.org.uk

Telephone 0303 123 1113 or 01625 545 745

Textphone 01625 545 860

Changes to this privacy notice

We may change this privacy notice. When we make changes, the ‘last updated’ date at the top of the page will also change.

Any changes to this notice will apply to you and your data immediately. If these changes affect how your personal data is processed, MHCLG will take reasonable steps to make sure you know.