Notice

Nuclear Decommissioning Authority review: privacy notice

Published 12 March 2026

© Crown copyright 2026

This publication is licensed under the terms of the Open Government Licence v3.0 except where otherwise stated. To view this licence, visit nationalarchives.gov.uk/doc/open-government-licence/version/3 or write to the Information Policy Team, The National Archives, Kew, London TW9 4DU, or email: psi@nationalarchives.gov.uk.

Where we have identified any third party copyright information you will need to obtain permission from the copyright holders concerned.

This publication is available at https://www.gov.uk/government/publications/nuclear-decommissioning-authority-review-privacy-notice/nuclear-decommissioning-authority-review-privacy-notice

This notice sets out how we will process your personal data, and your information rights. It is made under Articles 13 and/or 14 of the UK General Data Protection Regulation (UK GDPR ).

We are conducting an independent review into the Nuclear Decommissioning Authority. This will require having interviews with relevant stakeholders to gather evidence in order to make recommendations. We will be using copilot to get transcripts from meetings.

The NDA was first created in 2004 under the Energy Act, following a decision to radically alter the arrangements for managing nuclear clean-up in the UK. The NDA came into existence on 1 April 2005 and is managed by HMG.

1. Your Data

We will process the following personal data:

  • your name
  • any other personal data that you provide us as part of interviews.
  • we may use co-pilot to transcribe the interview with your consent

2. How we collect your data

Your data may be collected in the following ways:

  • using publicly available information
  • stakeholder data already held by DESNZ
  • stakeholder data already known to the review panel

3. Purpose 

We are processing your personal data for the purposes of arranging interviews and for evidence gathering for the review. No one will have their personal data quoted within the report unless consent is provided and quotes or evidence has been approved by that individual or organisation.  

The legal basis for processing under the UK GDPR are:

  • Article 6 (1) e) the processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the data controller. The task is to carry out an independent review into the Nuclear Decommissioning Authority.
  • Article 6(1) (a) Consent: Please note that during interviews, we may use Co-pilot to transcribe the meeting, but we will only do so with your consent.

Once we have the interview notes, the transcription will be anonymised and used for the report. We will ask for your consent to use your personal data in the report.

Should you change your mind, you can withdraw consent at any time by emailing NDAReview2026@energysecurity.gov.uk. 

5. Recipients    

Your personal data will be processed by DESNZ, the lead reviewer and independent experts appointed by DESNZ to carry out the independent review . 

As part of our IT infrastructure, your personal data will be stored in the UK on systems provided by our data processors - Microsoft and Amazon Web Services. This does not mean we actively share your personal data with these entities; rather, they are technical service providers who host infrastructure supporting our IT systems

6. Retention  

Your personal data will be kept by us for no longer than 2 weeks.  

Once the official anonymised notes have been taken, the recordings will be deleted.  

7. International transfers

Your data will be processed in the UK. 

8. Your rights 

You have the right to:

  • request information about how your personal data is processed
  • request a copy of that personal data
  • request that any inaccuracies in your personal data are rectified without delay
  • request that any incomplete personal data are completed, including by means of a supplementary statement
  • request that your personal data are erased if there is no longer a justification for them to be processed
  • in certain circumstances (for example, where accuracy is contested) request that the processing of your personal data is restricted 
  • object to the processing of your personal data where it is processed for direct marketing purposes
  • withdraw consent to the processing of your personal data at any time by emailing NDAReview2026@energysecurity.gov.uk 
  • object to the processing or use of your personal data

To exercise your rights please contact the Data Protection Officer using the contact details below. 

9. Contact details 

The data controller for your personal data is the Department for Energy Security and Net Zero (DESNZ).

Contact the DESNZ DPO:

DESNZ Data Protection Officer
Department for Energy Security and Net Zero
3-8 Whitehall Place
London
SW1A 2EG

If you are unhappy with the way we have handled your personal data, please write to the department’s Data Protection Officer in the first instance using the contact details above.

10. Complaints

If you consider that your personal data has been misused or mishandled, you may make a complaint to the Information Commissioner, who is an UK independent regulator. 

The Information Commissioner can be contacted at:

Information Commissioner's Office

Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF

Email casework@ico.org.uk

Telephone 0303 123 1113

ICO: Make a complaint

Any complaint to the Information Commissioner is without prejudice to your right to seek redress through the courts.

11. Updates to this notice

If this privacy notice changes in any way, we will place an updated version on this page. Regularly reviewing this page ensures you are always aware of what information we collect, how we use it, and under what circumstances we will share it with other parties. The ‘last updated’ date at the bottom of this page will also change.

If these changes affect how your personal data is processed, we will take reasonable steps to let you know.

Last updated:  12 March 2026

Back to top