Warm Homes Loan Scheme: end-user privacy notice
Published 17 September 2026
© Crown copyright 2026
This publication is licensed under the terms of the Open Government Licence v3.0 except where otherwise stated. To view this licence, visit nationalarchives.gov.uk/doc/open-government-licence/version/3 or write to the Information Policy Team, The National Archives, Kew, London TW9 4DU, or email: psi@nationalarchives.gov.uk.
Where we have identified any third party copyright information you will need to obtain permission from the copyright holders concerned.
This publication is available at https://www.gov.uk/government/publications/warm-homes-loan-scheme-end-user-privacy-notice/warm-homes-loan-scheme-end-user-privacy-notice
The Warm Homes Loan Scheme (WHLS) is a government supported, lender-led initiative designed to increase the availability of affordable finance for low carbon home upgrades across the United Kingdom.
If you participate in the WHLS by receiving one or more loans, this privacy notice sets out how the Department for Energy Security and Net Zero processes your personal data under the Scheme. It is made under Articles 13 and 14 of the UK General Data Protection Regulation (UK GDPR).
For information about how your Lender processes your personal data please see their own privacy notice.
1. Your data
We will process the following personal data provided to us by your Lender and our contracted delivery partners:
Loan recipient
- name
- contact details (phone number, email address)
- address the funded measures are installed in. This is likely to be either the address of the loan recipient (if they are an owner occupier) or of their tenants (if they are a landlord)
- details of the loans issued to the loan recipient, including amount, duration and current status (including acceptance / rejection)
2. Purpose
The purposes for which we are processing your personal data are:
Research and evaluation
- to monitor and support the progress and administration of the scheme, including monitoring and supporting the effective use of scheme funding and the operational delivery of the scheme
- to support an assessment of WHLS performance and whether the scheme has achieved its objectives for statistical purposes, including the publication of Official Statistics to GOV.UK
- to review and develop government policy, research, evaluation, and service delivery. Where the research involves processing of personal data in addition to that already collected for delivery of the Scheme, you will be given the opportunity to opt-in to that research at the point of contact
- for the Department for Energy Security and Net Zero (DESNZ) and its appointed contractors to contact you to take part in further research
Fraud and Error
- for the prevention and detection of fraud, error and non-compliance the data listed will be processed for activity including but not limited to:
- preventing, detecting and investigating fraud, error and non-compliance
- conducting other activities such as linking WHLS data across other schemes (to prevent/detect breaches of schemes rules)
- statistical, audit, research, monitoring and evaluation purposes
- assurance audit activity to understand fraud and error exposure and how to reduce it.
- controls testing and assurance of oversight and delivery of the scheme to inform improvements
- progressing civil or criminal proceedings as a result of fraud
- taking administrative actions in connection with fraud
- debt recovery, prosecution and any other related activities
See the Fraud and Error Privacy Notice for further details: Using home retrofit scheme data to manage fraud and error
To support the above purposes, DESNZ may link your Personal Data with other data sources and may share your personal data with our contracted providers who will process your personal data on DESNZ behalf in line with the purposes set out above.
3. Legal basis of processing
The legal basis for processing your personal data under Article 6 of the UK GDPR is:
1(e) Public task: Processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the data controller. The public task is provided under Section 50 of the United Kingdom Internal Markets Act 2020 (UKIM). The loan scheme encourages the uptake of green home retrofit measures, which falls within the purposes of s50, the provision of financial assistance for, or in connection with economic development
4. Recipients
Your personal data may be shared with:
- DESNZ Delivery Partners, and contractors – any contractor or organisation that DESNZ appoints to act on their behalf in connection with WHLS, including to oversee the management and delivery of WHLS loans and for monitoring and evaluation purposes.
Our contracted providers process data on behalf of DESNZ and are required to take appropriate security measures to protect personal information in line with our policies. We only permit them to process personal data for the purposes outlined in this Privacy Notice and in accordance with our instructions.
Your personal data may also be shared by us in certain scenarios such as:
- where we are required to do so by law, for example by court order or to prevent fraud or other crime
- if we are exercising our legal rights and / or defending a legal claim your information may be transferred as required in connection with defending such claim or exercising such legal rights
- to protect yours’, ours’ or others’ rights, property, or safety
As part of our IT infrastructure, your personal data will be stored in the UK on systems provided by Microsoft and Amazon Web Services. This does not mean we actively share your personal data with these entities; rather, they are technical service providers who host infrastructure supporting our IT systems.
5. Retention
Your personal data will be kept by us for a period of up to 15 years after creation of the Scheme, for the delivery, administration and evaluation of the scheme.
For the purposes of prevention and detection of fraud, error and non-compliance, some data will be stored and shared for a maximum of 25 years. Individual records may be retained beyond this if they relate to ongoing actions such as prosecutions, appeals or debt recovery.
6. International transfers
Your personal data will only be processed in the UK.
7. Your rights
You have the right to request information about how your personal data are processed, and to request a copy of that personal data.
You have the right to request that any inaccuracies in your personal data are rectified without delay.
You have the right to request that any incomplete personal data are completed, including by means of a supplementary statement.
You have the right to request that your personal data are erased if there is no longer a justification for them to be processed.
You have the right in certain circumstances (for example, where accuracy is contested) to request that the processing of your personal data is restricted.
You have the right to object to the processing of your personal data where it is processed for direct marketing purposes.
You have the right to object to the processing of your personal data.
To exercise your rights please contact the Data Protection Officer using the contact details below.
8. Contact details
The data controller for your personal data is the Department for Energy Security and Net Zero (DESNZ).
Contact the DESNZ DPO:
DESNZ Data Protection Officer
Department for Energy Security and Net Zero
3-8 Whitehall Place
London
SW1A 2EG
If you are unhappy with the way we have handled your personal data, please write to the department’s Data Protection Officer in the first instance using the contact details above.
9. Complaints
If you consider that your personal data has been misused or mishandled, you may make a complaint to the Information Commissioner, who is an UK independent regulator.
Contact the Information Commissioner's Office (ICO):
Any complaint to the Information Commissioner is without prejudice to your right to seek redress through the courts.
10. Updates to this notice
If this privacy notice changes in any way, we will place an updated version on this page. Regularly reviewing this page ensures you are always aware of what information we collect, how we use it, and under what circumstances we will share it with other parties. The ‘last updated’ date at the bottom of this page will also change.
If these changes affect how your personal data is processed, we will take reasonable steps to let you know.
Last updated: 9 September 2026