Guidance

Ministry of Justice Digital and Technology: privacy notice for user research participants

Published 22 July 2025

Ministry of Justice Digital and Technology carries out user research to design, test and improve services. This research is on behalf of the Ministry of Justice (MoJ) and other organisations that are part of it, including the Office of the Public Guardian (OPG), Legal Aid Agency (LAA), Criminal Injuries Compensation Authority (CICA) and His Majesty’s Prison and Probation Service (HMPPS).

This privacy notice explains what personal information we process, how we get it, what we do with it and why. It also explains your data protection rights and how to complain if you’re unhappy with how your data has been used.

The type of personal information we collect

We only collect the personal data we need to meet our research goals. Depending on the research, this can include:

• name
• contact details (for example telephone number, email address)
• job title/role
• employment details
• location
• disability and/or access needs (for example sight loss, or speech-to-text software user)
• gender
• age
• racial or ethnic origin
• sexual orientation
• family, lifestyle and social circumstances
• financial information
• nationality and immigration information

How we get the personal information and why we have it

Most of the personal information we process is provided to us directly by you. If you were recruited by an external company to take part in our research, that company will have provided some data to us. 

During the research session we may collect data in the form of:

• written notes
• video recordings
• screen recordings
• audio recordings
• photos

We use personal information to carry out research to improve the MOJ’s understanding of existing and potential service users, so that we can create and run services that work for users and for government.

We use your personal data to:

• decide if a research study is relevant to you
• ensure we’re including a wide range of people
• invite you to take part in research (an immediate study, or potential future studies)
• arrange/schedule the research with you
• ask you if you agree to take part in the research and record your agreement
• make a record of your data recording and sharing permissions
• carry out the research (for example, an interview or online survey)
• in some cases, send you a voucher after the research to say thank you for your time
• enable you to request your information, withdraw from the research and manage your permissions

Any information collected before and during research will be de-identified or anonymised before it is shared with anyone. After it has been de-identified or anonymised, snippets may be shared with others so they can understand your experiences and what’s important to you. These people could include other user researchers in MOJ, members of digital teams within MOJ, employees of MOJ and its agencies, or other organisations we’re working with.

Our lawful basis for processing your data

Under the UK General Data Protection Regulation (UK GDPR), the lawful basis we rely on for processing this information is our legitimate interest in understanding the users of MOJ services so we can create and run services that work well for them and for government.

How we store your personal information

We use a third-party service called Consent Kit to securely collect and store:

• your first name and email address
• the date you took part in research
• your data recording and sharing permissions

The Consent Kit privacy policy explains how Consent Kit uses personal data.

We may also use other third party tools and services to collect, transcribe or analyse your data, such as:

• survey tools
• online collaboration tools, including video conference and virtual whiteboard tools
• transcription services, including automatic transcription and analysis tools

Recordings of research sessions may be securely stored in:

• the MOJ’s Google Workspace
• the MOJ’s Microsoft SharePoint site
• our Dovetail research workspace

If you have signed up to the HMPPS research panel, your information will be securely stored in Airtable or Consent Kit, where we host our database of research volunteers.

Only anonymised/de-identified information will be stored in other locations.

Your information will be kept for up to 2 years before being deleted, as referred to in the GOV.UK Service Manual for User Research.

Legal obligations

We will share your data if there’s any evidence of wrongdoing or if we’re required to by law. We will also share your data if there’s a serious safeguarding concern - for example, if we are concerned about the welfare of a child or vulnerable adult.

We will not:

• sell or rent any of your data to third parties
• share your data with third parties for marketing purposes

Your data protection rights

Under data protection law, you have the following rights:

• Your right of access - You have the right to ask us for copies of your personal information.
• Your right to rectification - You have the right to ask us to rectify personal information you think is inaccurate. You also have the right to ask us to complete information you think is incomplete.
• Your right to erasure - You have the right to ask us to erase your personal information in certain circumstances.
• Your right to restriction of processing - You have the right to ask us to restrict the processing of your personal information in certain circumstances.
• Your right to object to processing - You have the right to object to the processing of your personal information in certain circumstances.
• Your right to data portability - You have the right to ask that we transfer the personal information you gave us to another organisation, or to you, in certain circumstances.

You are not required to pay any charge for exercising your rights. If you make a request, we have one month to respond to you.

If you wish to make a request, follow the instructions in the Ministry of Justice personal information charter.

How to complain

If you have any concerns about our use of your personal information, you can complain to us at:

Data Protection Officer

Ministry of Justice

5th Floor, Post Point 5.18

102 Petty France

London

SW1H 9AJ

or email: dpo@justice.gov.uk

You can also complain to the Information Commissioner’s Office (ICO) if you are unhappy with how we have used your data:          

Information Commissioner’s Office

Wycliffe House

Water Lane

Wilmslow

Cheshire

SK9 5AF

Helpline number: 0303 123 1113

ICO website: https://www.ico.org.uk