Guidance

RIO Front Door pilot: privacy notice

Published 23 October 2026

This notice sets out how we will process your personal data, and your rights. It is made under Articles 13 and/or 14 of the UK General Data Protection Regulation (UK GDPR).

The Regulatory Innovation Office (RIO) is opening the third phase of its Front Door initiative to collect and address regulatory challenges. This invites businesses, organisations, trade bodies, and/or investors to raise regulatory barriers to the Department for Business, Innovation, Science and Trade (BIST) to help inform future policy in the area.

1. Your data

We will process the following personal data:

• name of your organisation
• organisation type
• what your organisation does
• the sector your organisation operates in
• email address

We will also:

• collect details of any regulatory challenges, including any contact you have had with regulators
• collect details of how the regulatory challenges is impacting your organisation
• process any other information you volunteer about yourself or organisation

2. Purpose

We are processing your personal data for the purposes of the call for evidence, so that we can contact you to discuss your response in greater detail.

We may share anonymised data with other organisations which have a direct interest in the policy on which we are consulting, for example: Crown bodies, regulators, government departments or DSIT partner organisations. This is so that we can engage with relevant stakeholders in the development of future policy.

3. Legal basis of processing

The legal basis for processing your personal data under Article 6 of the UK GDPR is:

1(e) Public task: Processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the data controller i.e. facilitating the sharing of knowledge to accelerate the adoption of AI within UK regulators

4. Recipients

We may publish extracts and/or references to responses to the call for evidence. If we do this, these responses will be anonymised. We will take all reasonable measures to ensure that neither you nor the organisation you represent are identifiable, and any responses used to illustrate findings will be anonymised.

Your data may be analysed and summarised using technology, such as artificial intelligence (AI), to help us to handle consultation responses efficiently and accurately. We may also use your data to ensure that we improve how we process consultation responses as we develop our products. This may include your personal data if you choose to disclose personal information in your response.

We will only use AI processing where your data is protected, processed in accordance with UK data protection regulations, and subject to human review to check for accuracy and ensure that processing is free from bias.

As part of our IT infrastructure, your personal data will be stored in the UK on systems provided by our data processors - Microsoft and Amazon Web Services. This does not mean we actively share your personal data with these entities; rather, they are technical service providers who host infrastructure supporting our IT systems. 

We may share your data if we are required to do so by law, for example by court order or to prevent fraud or other crime.

5. Retention

Your personal data will be kept by us for 2 years. 

6. International Transfers

Your personal data will only be processed in the UK and the EEA.
Where your personal data is processed in the EEA, the following safeguards will be in place:  

• UK Adequacy Regulations

 7. Your rights

You have the right to:

• request information about how your personal data are processed, and to request a copy of that personal data.
• request that any inaccuracies in your personal data are rectified without delay.
• request that any incomplete personal data are completed, including by means of a supplementary statement.
• request that your personal data are erased if there is no longer a justification for them to be processed.
• in certain circumstances (for example, where accuracy is contested) to request that the processing of your personal data is restricted.
• to object to the processing of your personal data.

To exercise your rights please contact the Data Protection Officer using the contact details below.

8. Contact details

The data controller for your personal data is the Department for Business, Innovation, Science and Technology (BIST). During the transition period related to the recently announced government departmental changes, where data controllership has transferred from DSIT to BIST, you can contact the DSIT Data Protection Officer at:

DSIT Data Protection Officer
Department for Business, Innovation, Science and Technology
22-26 Whitehall
London
SW1A 2EG

 Email: dataprotection@dsit.gov.uk

If you are unhappy with the way we have handled your personal data, please write to the department’s Data Protection Officer in the first instance using the contact details above.

9. Complaints

If you consider that your personal data has been misused or mishandled, you may make a complaint to the Information Commissioner, who is an UK independent regulator.  The Information Commissioner can be contacted at:

Information Commissioner’s Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF

Telephone: 0303 123 1113

https://ico.org.uk/make-a-complaint/

Any complaint to the Information Commissioner is without prejudice to your right to seek redress through the courts.

10. Updates to this notice

If this privacy notice changes in any way, we will place an updated version on this page. Regularly reviewing this page ensures you are always aware of what information we collect, how we use it, and under what circumstances we will share it with other parties. The ‘last updated’ date at the bottom of this page will also change.

If these changes affect how your personal data is processed, we will take reasonable steps to let you know.