TechFirst Community Privacy Notice
This privacy notice explains how your personal data is processed when you register to join the TechFirst community.
This notice sets out how we will process your personal data, and your rights. It is made under Articles 13 and/or 14 of the UK General Data Protection Regulation (UK GDPR).
This privacy notice explains how your personal data is processed when you register to join the TechFirst community. TechFirst is the government’s flagship tech skills programme, opening pathways into the UK’s fast-growing tech sector. By joining the community you will hear about opportunities to get involved, receive updates on the programme, and connect with others across the UK’s frontier technology sectors.
For data protection purposes, the Department for Digital, Culture, Media and Sport (DCMS) is the data controller. Following the July 2026 Machinery of Government changes, DCMS became the data controller for TechFirst, with the Department for Science, Innovation and Technology (DSIT) being the former data controller.
1. Your data
We will process the following personal data:
- your name
- your email address
- your organisation name
- your role or job title (where you provide it)
- the frontier technology area(s) your organisation works in
- the UK region(s) and nation(s) your organisation is based in or active in
- any additional information you choose to provide in the free-text box (please note personal data should not be shared).
2. Purpose
The purposes for which we are processing your personal data are:
- to set up and manage your membership of the TechFirst community.
- to contact you about opportunities to get involved with TechFirst across its strands, including sharing contact details for TechFirst delivery partners with you.
- to send you the monthly TechFirst newsletter.
- to share contact details of relevant TechFirst delivery partners with you so you can choose to engage with programme activities directly.
- to understand the reach and make-up of the community (e.g. ensuring national and tech sector coverage), and to monitor and evaluate the programme so we can improve it and inform future government policy
- to carry out due diligence checks on your organisation, to confirm it is a legitimate organisation for TechFirst to work with and to identify any associated risks
3. Legal basis for processing
The legal basis for processing your personal data under Article 6 of the UK GDPR is:
Consent (Article 6(1)(a)): to manage your membership of the TechFirst community and to contact you via email with news, activities and services relating to TechFirst. This will include DCMS sending the monthly newsletter and sharing contact details of TechFirst delivery partners with you so you can get involved with programme activities.
You can withdraw your consent at any time by emailing TechFirst@dsit.gov.uk. Please note that all processing of your personal data will cease once you have withdrawn consent, other than where this is required by law, but this will not affect any personal data that has already been processed prior to this point.
and
Public task (Article 6(1)(e)): to carry out due diligence checks on your organisation as part of our assessment of prospective TechFirst community members. This processing is necessary for us to exercise our official functions in delivering the TechFirst programme, and does not rely on your consent.
4. Recipients
As part of our IT infrastructure, your personal data will be stored in the UK on systems provided by our data processors: Microsoft and Amazon Web Services. This does not mean we actively share your personal data with these entities; rather, they are technical service providers who host infrastructure supporting our IT systems.
We will not sell your personal data, and we will not use it for any purpose other than those described in this notice.
We will only share your personal data where this is necessary for the purposes described in this privacy notice, or where we are required to do so by law.
TechFirst delivery partners may distribute the Community Membership offer document and sign-up form on DCMS’s behalf, but they do not collect or receive the personal data you submit, your details go directly to DCMS, the sole data controller. Where you give permission, we may share delivery partners’ contact details with you so you can engage with them directly. Where you choose to engage with a TechFirst delivery partner, they may collect and process personal data necessary to deliver TechFirst activities on DCMS’s behalf, acting as a data processor under contract with DCMS.
We use Creditsafe, a business risk intelligence provider, as a contracted data processor to carry out due diligence checks on organisations applying to join the TechFirst community. These checks draw on Creditsafe’s Credit & Risk and KYC Protect services. Where appropriate and proportionate, this may include Know Your Customer (KYC) checks on an organisation, which can include limited personal data about that organisation’s directors, such as name, date of birth and address, as listed on Companies House or a similar register. We will not always use every element of Creditsafe’s offering for every organisation; for example, we may rely on Credit & Risk checks only at initial onboarding and use KYC checks separately for ongoing monitoring where needed.
5. Retention
Your personal data will be kept by us as long as you remain an active member of the TechFirst community. Every 12 months we will send you an email to verify your continued interest in being a member and to check your role and contact details are up to date. If no response or confirmation is received, your membership will be terminated and your personal data deleted.
Members who have been inactive for a continuous period of 12 months (e.g. have not engaged with any community activities or communications) will have their membership terminated and their personal data deleted.
If you withdraw your consent, we will stop data processing.
6. Automated decision making
Your personal data will not be subject to any automated decision-making.
7. International transfers
Your personal data will only be processed in the UK.
8. Your rights
Under the UK GDPR, you have the following rights:
- You have the right to request information about how your personal data are processed, and to request a copy of that personal data.
- You have the right to request that any inaccuracies in your personal data are rectified without delay.
- You have the right to request that any incomplete personal data are completed, including by means of a supplementary statement.
- You have the right to request that your personal data are erased if there is no longer a justification for them to be processed.
- You have the right in certain circumstances (for example, where accuracy is contested) to request that the processing of your personal data is restricted.
- You have the right to object to the processing of your personal data.
- Where we rely on your consent, you have the right to withdraw your consent at any time.
- Where the processing is based on consent and carried out by automated means, you have the right to data portability — to request a copy of the personal data you have provided in a structured, commonly used and machine-readable format.
To exercise any of these rights, to leave the community, or to change your preferences, please contact TechFirst@dsit.gov.uk, or the DCMS Data Protection Officer using the contact details below.
9. Contact details
The data controller for your personal data is the Department for Digital, Culture, Media and Sport (DCMS).
During the Machinery of Government transition, you can continue to contact the DSIT Data Protection Officer using the details below.
DSIT Data Protection Officer
Department for Digital, Culture, Media and Sport
22-26 Whitehall
London
SW1A 2EG
Email: dataprotection@dsit.gov.uk
If you are unhappy with the way we have handled your personal data, please write to the department’s Data Protection Officer in the first instance using the contact details above.
10. Complaints
If you consider that your personal data has been misused or mishandled, you may make a complaint to the Information Commissioner, who is a UK independent regulator. The Information Commissioner can be contacted at:
Information Commissioner’s Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF
Telephone: 0303 123 1113
https://ico.org.uk/make-a-complaint/
Any complaint to the Information Commissioner is without prejudice to your right to seek redress through the courts.
11. Updates to this notice
If this privacy notice changes in any way, we will place an updated version on this page. Regularly reviewing this page ensures you are always aware of what information we collect, how we use it, and under what circumstances we will share it with other parties. The ‘last updated’ date at the top of this page will also change.
If these changes affect how your personal data is processed, we will take reasonable steps to let you know.