Guidance

RIO Front Door pilot: privacy notice

Published 16 January 2026

This notice is provided to meet the obligations as set out in Articles 13 and 14 of UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018 (DPA). This notice sets out how we will use your personal data and your rights. 

The Regulatory Innovation Office (RIO), is conducting a pilot to collect and address regulatory challenges in the defence technologies and robotics sectors. The pilot invites businesses, organisations, trade bodies, and/or investors to raise regulatory barriers to the Department for Science, Innovation and Technology’s (DSIT) to help inform future policy in the area.

1. Your data

We will process the following personal data:

• name of your organisation
• organisation type
• what your organisation does
• the sector your organisation operates in
• email address

We will also:

• collect details of any regulatory challenges, including any contact you have had with regulators
• collect details of how the regulatory challenges is impacting your organisation
• process any other information you volunteer about yourself or organisation

2. Purpose

We are processing your personal data for the purposes of the call for evidence, so that we can contact you to discuss your response in greater detail.

We may share anonymised data with other organisations which have a direct interest in the policy on which we are consulting, for example: Crown bodies, regulators, government departments or DSIT partner organisations. This is so that we can engage with relevant stakeholders in the development of future policy.

3. Legal basis of processing

1(e)Public task: The legal basis for processing your personal data is that processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the data controller, i.e. a call for evidence which provides ministers and government officials with information about businesses in order to inform future policy development.

4. Recipients

We may publish extracts and/or references to responses to the call for evidence. If we do this, these responses will be anonymised. We will take all reasonable measures to ensure that neither you nor the organisation you represent are identifiable, and any responses used to illustrate findings will be anonymised.

Your data may be analysed and summarised using technology, such as artificial intelligence (AI), to help us to handle consultation responses efficiently and accurately. We may also use your data to ensure that we improve how we process consultation responses as we develop our products. This may include your personal data if you choose to disclose personal information in your response. For the purposes of this activity, DSIT will be the data controller.

We will only use AI processing where your data is protected, processed in accordance with UK data protection regulations, and subject to human review to check for accuracy and ensure that processing is free from bias.

As part of our IT infrastructure, your personal data will be stored in the UK on systems provided by our data processors - Microsoft and Amazon Web Services. This does not mean we actively share your personal data with these entities; rather, they are technical service providers who host infrastructure supporting our IT systems. 

We may share your data if we are required to do so by law, for example by court order or to prevent fraud or other crime.

5. Retention

Your personal data will be kept by us for 2 years in line with DSIT retention policy.

6. International Transfers

Your personal data will be processed in the UK and the EEA.

7. Your rights

You have the right to:

• request information about how your personal data is processed, and to request a copy of that personal data
• request that any inaccuracies in your personal data are rectified without delay
• request that any incomplete personal data is completed, including by means of a supplementary statement
• request that your personal data are erased if there is no longer a justification for it to be processed
• in certain circumstances (for example, where accuracy is contested) to request that the processing of your personal data is restricted
• object to the processing of your personal data

To exercise your rights please contact the Data Protection Officer using the contact details below.  

8. Contact details

The data controller for your personal data is the Department for Science. Innovation and Technology (DSIT). You can contact the DSIT Data Protection Officer at: 

DSIT Data Protection Officer 
Department for Science, Innovation and Technology 
22-26 Whitehall 
London 
SW1A 2EG

Email: dataprotection@dsit.gov.uk.

9. Complaints

If you consider that your personal data has been misused or mishandled, you may make a complaint to the Information Commissioner, who is an UK independent regulator. The Information Commissioner can be contacted at:

Information Commissioner’s Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF

Telephone: 0303 123 1113.

https://ico.org.uk/make-a-complaint/

Any complaint to the Information Commissioner is without prejudice to your right to seek redress through the courts.

10. Updates to this notice

If this privacy notice changes in any way, we will place an updated version on this page. Regularly reviewing this page ensures you are always aware of what information we collect, how we use it, and under what circumstances we will share it with other parties. The ‘last updated’ date at the bottom of this page will also change.

If these changes affect how your personal data is processed, we will take reasonable steps to let you know.

Last updated: 16 January 2026