Data brokers and national security: privacy notice
Published 17 March 2025
© Crown copyright 2025
This publication is licensed under the terms of the Open Government Licence v3.0 except where otherwise stated. To view this licence, visit nationalarchives.gov.uk/doc/open-government-licence/version/3 or write to the Information Policy Team, The National Archives, Kew, London TW9 4DU, or email: psi@nationalarchives.gov.uk.
Where we have identified any third party copyright information you will need to obtain permission from the copyright holders concerned.
This publication is available at https://www.gov.uk/government/calls-for-evidence/data-brokers-and-national-security/data-brokers-and-national-security-privacy-notice
This notice sets out how we will use your personal data, and your rights. It is made under Articles 13 and 14 of the UK General Data Protection Regulation (UK GDPR).
DSIT is conducting a call for views, which invites any person or organisation to provide their views on data brokers to ensure the security of UK data.
DSIT is the data controller for this call for views and Qualtrics is acting as DSIT’s data processor to collect survey responses.
Your data
We will process the following personal data:
- Names, contact details and organisation of respondents
Purpose
We are processing your personal data for the purposes of the call for views, so that we can contact you to discuss your response in greater detail. Respondents are free to provide their personal details with their survey submissions or not as they prefer.
Legal basis of processing
The legal basis for processing your personal data is that processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the data controller, i.e. a call for views which provides ministers and government officials with information about organisations that take part in data broking and the wider industry to inform future policy development.
Recipients
We may publish responses to the call for views. If we do this, these responses will be anonymised. We will take all reasonable measures to ensure that neither you nor the organisation you represent are identifiable, and any responses used to illustrate findings will be anonymised.
Qualtrics is a contracted provider, and their survey platform is used to collect your personal data and survey responses. As part of this survey, Qualtrics, will collect essential cookies such as your IP address and your browser to stop multiple responses and to make sure that the survey displays correctly. The full cookies policy from Qualtrics can be found here.
As part of our IT infrastructure, your personal data will be stored in the UK on systems provided by our data processors - Microsoft and Amazon Web Services. This does not mean we actively share your personal data with these entities; rather, they are technical service providers who host infrastructure supporting our IT systems.
Your personal data may be shared by us with other Government Departments or public authorities where necessary as part of the call for views. We may share your data if we are required to do so by law, for example by court order or to prevent fraud or other crime.
Your data may be analysed and summarised using technology, such as artificial intelligence (AI). Your name and contact details will be removed prior to the use of AI.
Retention
Your personal data will be kept by us for 2 years in line with DSIT retention policy.
International Transfers
Your personal data will be processed in the UK.
Your rights
You have the right to:
- request information about how your personal data is processed, and to request a copy of that personal data
- request that any inaccuracies in your personal data are rectified without delay
- request that any incomplete personal data is completed, including by means of a supplementary statement
- request that your personal data are erased if there is no longer a justification for it to be processed
- in certain circumstances (for example, where accuracy is contested) to request that the processing of your personal data is restricted
- object to the processing of your personal data
To exercise your rights please contact the Data Protection Officer using the contact details below.
Contact us or make a complaint
Contact the DSIT Data Protection Officer (DPO) if you:
- have any questions about anything in this document
- think that your personal data has been misused or mishandled
DSIT Data Protection Officer
Department for Science, Innovation and Technology
22-26 Whitehall
London
SW1A 2EG
You can also make a complaint to the Information Commissioner (supervisory authority), who is an independent regulator.
Contact the ICO:
Any complaint to the Information Commissioner is without prejudice to your right to seek redress through the courts.
Updates to this notice
If this privacy notice changes in any way, we will place an updated version on this page. Regularly reviewing this page ensures you are always aware of what information we collect, how we use it, and under what circumstances we will share it with other parties. The ‘last updated’ date at the bottom of this page will also change.
If these changes affect how your personal data is processed, we will take reasonable steps to let you know.
Last updated: 4 March 2025.