Open call for evidence

Small business access to finance: privacy notice

Updated 20 March 2025

This privacy notice explains how the Department for Business and Trade (DBT), as a ‘data controller’, processes personal data for the call for evidence on small business access to finance.

This notice is supplemented by our main privacy notice which provides further information on how DBT processes personal data, and sets out your rights in respect of that personal data.

Your data

DBT collects information about:

• individuals and organisations responding to the call for evidence

DBT collects the following categories of personal data:

• name 
• contact details, such as email address, postal address, phone number, job title, and organisation

DBT also collects the following personal data categories, if they are voluntarily shared in responses to the call for evidence:

• gender
• disability
• ethnicity
• location

Purpose

DBT collects this information in order to conduct analysis of your responses to the call for evidence questions to better understand barriers to access to finance from the perspective of market participants. This will enable us to inform the government response to the call for evidence and ongoing policy development activities.

Sharing of personal data by respondents to the call for evidence is voluntary and there are no consequences if this information is not shared. However, it may be useful for contact details to be provided in the event that we would like to reach out to a respondent for further information.

Legal basis for processing personal data

Table 1 sets out the primary legal bases we rely on for processing the personal data we collect about you.

In some instances we may process your data further for a compatible purpose or on other legal bases. For example, your data may be used for archiving, research or statistical purposes. These are compatible purposes for further processing in UK GDPR and your data will be subject to appropriate safeguards if used for such purposes.

Table 1: legal basis for processing

Personal data (Article 6(1) UK GDPR)	Special category data
Processing is necessary for a task carried out in the public interest or in the exercise of official authority vested in the controller	Art 9(2) (g) - substantial public interest and  Schedule 1 part (2) (8) of the DPA 2018 - Equality of Opportunity  or treatment

How personal data is processed

Once received, your data will be:

• stored within DBT’s internal database, which is managed by the Access to Finance Policy Team, with staff access limited to ‘security cleared’ individuals
• analysed along with other responses to the call for evidence to inform the government response and ongoing policy development

Information sharing

We may share personal data you provide:

• with other government departments, specifically HM Treasury and the Intellectual Property Office (only in relation to questions 12 and 13 of the call for evidence)
• in response to information requests, for example, under Freedom of Information (FOI) law or the Environmental Information Regulations (EIR)
• where we are ordered to do so or where we are otherwise required to do so by law

Data retention

DBT will only retain your personal data for as long as necessary to fulfil the purposes we collected it for, including for the purposes of satisfying any legal, accounting, or reporting requirements.

Your responses to the call for evidence will be held for 15 years and reviewed for potential transfer to the National Archives for permanent preservation. Where personal data has been shared, we will anonymise the returns 3 years after the conclusion of the exercise.

We will analyse the information that you provide to produce and publish a government response that summarises the findings from the call for evidence. This publication will not contain any information from which any individual respondent might be identified. We may however use anonymised quotations from your answers. Anonymised data that forms part of the published government response will be kept indefinitely.

If we decide that we need to process your personal data for a reason which is incompatible with the purposes for which we collected it for, we will contact you to explain why we are doing this and why it is lawful to do so.

To determine the appropriate retention period for personal data, we consider the amount, nature, and sensitivity of the personal data, the potential risk of harm from unauthorised use or disclosure of your personal data, the purposes for which we process your personal data and whether we can achieve those purposes through other means, and the applicable legal requirements.

Your rights

You have a number of rights available to you under UK data protection legislation, including the right to:

• request copies of the personal data we hold about you
• request that we rectify information about you which you think is inaccurate or incomplete
• request that we restrict your data from further processing (in certain circumstances)
• object to the processing of your data (in certain circumstances)
• data portability (in certain circumstances)
• request that we erasure your data (in certain circumstances)
• not be subject to a decision based on solely automated data processing

Contact us

You can contact DBT’s Data Protection Officer for further information about how your data has been processed by the department or to make a complaint about how your data has been used. Please contact data.protection@businessandtrade.gov.uk. 

You can also submit a complaint to the Information Commissioner’s Office (ICO) at:

Information Commissioner’s Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF

Website: https://ico.org.uk/

Telephone: 0303 123 1113

You can find out more about your rights as a data subject, and details of how to contact our Data Protection Officer and the ICO in our main privacy notice.