Transparency data

Privacy Notice for Travel Management

Published 24 September 2026

This notice sets out how we will use your personal data, and your rights. It is made under Articles 13 and/or 14 of the UK General Data Protection Regulation (UK GDPR). 

Your data

Purpose

The purpose(s) for which we are processing your personal data is(are): 

The Cabinet Office contracts suppliers acting as our data processors to provide travel booking platforms. These platforms enable you to book flights, accommodation, trains, and taxis. There are also offline facilities supporting visas, buses/coaches, car parking, ferries and similar travel arrangements.

To arrange travel across either supplier, users select their required options and submit necessary booking details. Bookings can be made either online (via the respective supplier’s web platform) or offline (via phone or email). The selected supplier processes this data directly to confirm bookings with final travel operators (e.g., airlines, hotel chains, rail companies). 

Non-Cabinet Office staff data (such as external contractors) may occasionally be processed when travel is booked on behalf of non-employees traveling for official business, or to fulfill duty-of-care obligations.
Monthly MI data provided by suppliers back to the Cabinet Office is not aggregated. Individual-level data is required for audit assurance, fraud detection, and spend compliance. 

The data

The specific personal data processed will vary depending on the type of travel arrangement being made, but may include: 

• Name
• Email address
• Date of birth
• Addresses (for hotels, or pick-up and drop-off addresses)
• On a posting term (Y/N)
• Whether a GCO employee/ GCO department
• Telephone number
• Health information including disability or dietary requirements (including whether there is One HMG Healix Healthline Approval)
• Passport Data
• Rail Card Data
• Travel Details (method and dates of travel)
• Reasons for travel
• Staff Number
• Parent & Child Cost Centre
• Emergency Contact Information
• Other preferences, such as seat preferences
• Information required for visas, which will vary on a case by case basis depending on the destination country’s requirements.

Where you have not provided your data directly to us, it has been provided by a Cabinet Office employee booking on your behalf.

Legal basis of processing 

The legal basis for processing your personal data is: 

Generally processing is necessary for the performance of a contract to which the data subject is a party, in this case that is employment or service contracts. In some cases, processing is necessary to comply with legal obligations as an employer.

Sensitive personal data is personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, and the processing of genetic data, biometric data for the purpose of uniquely identifying a natural person, data concerning health or data concerning a natural person’s sex life or sexual orientation.
The legal basis for processing your sensitive personal data are employment obligations under Data Protection Act 2018 sch.1, para 1, or statutory etc and Government purposes under Data Protection Act 2018 sch.1, para 6 .

Recipients

Your personal data will be shared by us with our travel management suppliers who act as data processors.

The travel management supplier will then share relevant details with other parties such as airlines, hotel, train services, and similar, to make your travel arrangements. These other parties will be independent data controllers for this information.

Retention 

Your personal data will be kept by us until the end of the contract period with the supplier for the processing activity, or for 2 years following the last activity on an account, whichever is sooner.

Your rights

You have the right to request information about how your personal data are processed, and to request a copy of that personal data. 

You have the right to request that any inaccuracies in your personal data are rectified without delay. 

You have the right to request that any incomplete personal data are completed, including by means of a supplementary statement. 

You have the right to request that your personal data are erased if there is no longer a justification for them to be processed. 

You have the right in certain circumstances (for example, where accuracy is contested) to request that the processing of your personal data is restricted. 

You have the right to request a copy of any personal data you have provided, and for this to be provided in a structured, commonly used and machine-readable format

International transfers

As part of this processing activity, your personal data may be processed globally depending on the travel booking requirement on the basis that it is necessary for a contract (Article 49 of the UK GDPR.)

Complaints 

The Cabinet Office data protection complaint process is available here.

Contact details

The data controller for your personal data is the Cabinet Office. The contact details for the data controller are:

Cabinet Office
70 Whitehall
London
SW1A 2AS

or 0207 276 1234, or you can use this webform. 

The contact details for the data controller’s Data Protection Officer are: dpo@cabinetoffice.gov.uk. 

The Data Protection Officer provides independent advice and monitoring of Cabinet Office’s use of personal information.

You can also send or escalate complaints to the Information Commissioner, who is an independent regulator. The Information Commissioner can be contacted at: 

Information Commissioner’s Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF

or 0303 123 1113, or icocasework@ico.org.uk.  Any complaint to the Information Commissioner is without prejudice to your right to seek redress through the courts.