Notice

Supplier management research privacy notice: Freefind

Published 26 November 2025

© Crown copyright 2025

This publication is licensed under the terms of the Open Government Licence v3.0 except where otherwise stated. To view this licence, visit nationalarchives.gov.uk/doc/open-government-licence/version/3 or write to the Information Policy Team, The National Archives, Kew, London TW9 4DU, or email: psi@nationalarchives.gov.uk.

Where we have identified any third party copyright information you will need to obtain permission from the copyright holders concerned.

This publication is available at https://www.gov.uk/government/publications/research-on-cyber-security-in-supplier-management-and-procurement/supplier-management-research-privacy-notice-freefind

This notice sets out how we will process your personal data, and your rights. It is made under Articles 13 and/or 14 of the UK General Data Protection Regulation (UK GDPR).

1. This project

The Department for Science, Innovation and Technology (DSIT) has asked Ipsos UK to carry out research on their behalf, looking at organisations’ approaches to managing their external suppliers.

The research involves qualitative one-on-one interviews with Ipsos UK researchers, lasting one hour, taking place over MS Teams. Participants will be asked to consent for these interviews to be digitally recorded (audio only).

DSIT is the data controller and Ipsos UK is the data processor on this project.

DSIT will receive only fully anonymised reports and notes from Ipsos UK and Ipsos UK will not share any personal identifying with DSIT.

Ipsos UK will keep your personal data and responses in strict confidence in accordance with this privacy notice and you will only be identifiable in any published results if you consent.

We will only share recorded material(s) from the group with the Project Team: the Project Team is the Ipsos UK Project Team and supplier organisations working on this project.

The recorded materials will be used for research and analysis purposes only.

2. Your data 

We will process the following personal data:

  • Your employer’s name
  • Your job title
  • Your name
  • Your contact details (email, phone number, employer address)
  • Details of other employees at your business, to whom you may refer us for the purposes of this research.
  • Should you take part in an interview with Ipsos, your opinions and experiences related to the subject of this research

Where personal data has not been obtained from the data subject

At first point of contact, Ipsos UK and its recruitment partners at Viewpoint obtained your data used to invite you to take part in this project from publicly available information, for example on LinkedIn.

Further personal data will be obtained by Ipsos UK and Viewpoint only with your consent.

3. Purpose 

The purposes for which we are processing your personal data are:

  • to contact you and invite you to take part in this research
  • to analyse your responses to this research
  • to keep your details for further follow up research within 12 months of your interview, if you agree to do so
  • to process your consent to an audio recording of your interview being made

The legal basis for processing your personal data under Article 6 of the UK GDPR is:  

1(e)Public task: Processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the data controller: public research to inform policy.

Consent: where you have provided your consent to being re-contacted to take part in follow-up research on this topic up to 12 months after your interview, to having your interview audio recorded, to being identifiable in the published results of this research. 

Participation in the research, and any follow-up exercise, is entirely voluntary. If you change your mind about taking part, you can withdraw at any time by contacting DSIT at: cyber.resilience.consultations@dsit.gov.uk, or Ipsos at: UK-PA-CSiSMStudy@ipsos.com.

5. Recipients 

Ipsos UK will use the supplier organisation Viewpoint for recruitment for qualitative interviews. If you consent to take part in this research after contact by Viewpoint, they will share your personal data with Ipsos and arrange an interview with an Ipsos researcher.

As part of DSIT’s IT infrastructure, your personal data will be stored in the UK on systems provided by Ipsos’s data processors - Microsoft and Amazon Web Services. This does not mean we actively share your personal data with these entities; rather, they are technical service providers who host infrastructure supporting our IT systems

6. Retention  

Ipsos UK will only retain any personal data and identifiable answers for as long as is necessary to support this research. In practice, this means that once Ipsos UK reports final anonymous research findings to DSIT, we will securely remove any personal data from our systems.

For this project we will securely remove your personal data from our systems by June 2026, which is 3 months after the completion of the research project, to allow a period of amends post-project completion. This is unless you give your consent to be recontacted to take part in follow-up research on this topic up to 12 months after your interview. In this case, Ipsos will securely remove your personal data from our systems by March 2027.

7. International transfers

Your personal data will be processed by Ipsos in the European Economic Area (EEA). Where your personal data is processed in the EEA, the following safeguards will be in place:

  • UK Adequacy Regulations.

8. Your rights 

You have the right to:

  • request information about how your personal data are processed, and to request a copy of that personal data.  
  • request that any inaccuracies in your personal data are rectified without delay.  
  • request that any incomplete personal data are completed, including by means of a supplementary statement.  
  • the right to request that your personal data are erased if there is no longer a justification for them to be processed.  
  • the right in certain circumstances (for example, where accuracy is contested) to request that the processing of your personal data is restricted.  
  • the right to object to the processing of your personal data where it is processed for direct marketing purposes.  
  • the right to withdraw consent to the processing of your personal data at any time. 
  • the right to object to the processing of your personal data. 

To exercise your rights please contact the Data Protection Officer using the contact details below.

9. Contact details 

The data controller for your personal data is the Department for Science. Innovation and Technology (DSIT). You can contact the DSIT Data Protection Officer at:  

Email: dataprotection@dsit.gov.uk with: “25-067818-01 Supplier Management Research” in the subject line.

Post: 25-067818-01 Supplier Management Research
DSIT Data Protection Officer
Department for Science, Innovation and Technology
22-26 Whitehall
London
SW1A 2EG 

Or contact the relevant DSIT Research team:

Email: Contact Lorna Kirkby at the following email address: cyber.resilience.consultations@dsit.gov.uk “25-067818-01 Supplier Management Research” in the email subject line.

The data processor for your personal data is Ipsos UK. Should you wish to opt out of the research, you can contact Ipsos UK at:

Email: Email Ipsos at UK-PA-CSiSMStudy@ipsos.com with “25-067818-01 Supplier Management Research” in the email subject line.

Post: 25-067818-01 Supplier Management Research
Data Protection Officer, Compliance Department
Ipsos (market research) Limited and Ipsos MORI UK Limited
3 Thomas More Square
London E1W 1YW
United Kingdom

If you are unhappy with the way we have handled your personal data, please write to the department’s Data Protection Officer in the first instance using the contact details above.

10. Complaints 

If you consider that your personal data has been misused or mishandled, you may make a complaint to the Information Commissioner, who is an UK independent regulator. The Information Commissioner can be contacted at:  

Information Commissioner’s Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF

Telephone: 0303 123 1113 

https://ico.org.uk/make-a-complaint/

Any complaint to the Information Commissioner is without prejudice to your right to seek redress through the courts.  

11. Updates to this notice 

If this privacy notice changes in any way, we will place an updated version on this page. Regularly reviewing this page ensures you are always aware of what information we collect, how we use it, and under what circumstances we will share it with other parties. The ‘last updated’ date at the bottom of this page will also change.

If these changes affect how your personal data is processed, we will take reasonable steps to let you know.

Last updated: 20 November 2025

Back to top