Consultation outcome

Privacy notice - cyber resilience legislation

Updated 30 November 2022

This was published under the 2019 to 2022 Johnson Conservative government

1. Department for Digital, Culture, Media & Sport privacy notice for the consultation on proposals for legislation to improve the UK’s cyber resilience

1.1 Who is collecting my data?

The Department for Digital, Culture, Media & Sport (DCMS) helps to drive growth, enrich lives and promote Britain abroad.

We protect and promote our cultural and artistic heritage and help businesses and communities to grow by investing in innovation and highlighting Britain as a fantastic place to visit. We help to give the UK a unique advantage on the global stage, striving for economic success.

1.2 Purpose of this Privacy Notice

This notice is provided within the context of the changes required by the Article 13 & 14 of EU General Data Protection Regulation (GDPR) and the Data Protection Act 2018 (DPA). This notice sets out how we will use your personal data as part of our legal obligations with regard to Data Protection.

DCMS’s personal information charter explains how we deal with your information. It also explains how you can ask to view, change or remove your information from our records.

1.3 Why are we collecting your personal data?

As part of the UK Cyber Resilience Consultation, we are processing your personal data in order to understand your responses and use this to inform our policies.

1.4 What personal data do we collect?

Most of the personal information we collect and process is provided to us directly by you. This includes:

• personal identifiers (name and contact details)
• your IP address

1.5 How will we use your data?

We use personal information for a wide range of purposes, to enable us to carry out our functions as a government department. This includes:

• analysis of responses to the consultation
• to re-contact you (if you provide permission)

1.6 What is the legal basis for processing my data?

To process this personal data, our lawful basis for collecting or processing this data is:

• Article 6 (1) (a) Consent - You have freely given your express permission for DCMS to process your personal data, when completing the consultation survey.

Where we rely on consent to process your personal data, you may withdraw your consent at any time, if you longer wish to be contacted as part of this consultation. You can do so by contacting nis@dcms.gov.uk.

• Article 6 (1) (e) Public Task - As government departments, DCMS will process your personal data as necessary for the effective performance of a task carried out in the public interest (i.e. a consultation).

1.7 What will happen if I do not provide this data?

Completion of the consultation is optional and you are not obligated to complete the survey. In addition, you can complete the survey and opt out of providing personal data by not answering the questions relating to personal identifiers (name and contact details).

1.8 Who will your data be shared with?

We will not share your data with any third parties.

If you write to us on a subject that is not our policy area, and the response needs to come from another government department, we will transfer your correspondence, including the personal data, to that department.

1.9 How long will my data be held for?

We will only retain your personal data for 2 years in line with DCMS retention policy.

1.10 Will my data be used for automated decision making or profiling?

We will not normally use your data for any automated decision making.

1.11 Will my data be transferred outside the UK and if it is how will it be protected?

We will not send your data overseas.

1.12 What are your data protection rights?

You have rights over your personal data under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018 (DPA 2018). The Information Commissioner’s Office (ICO) is the supervisory authority for UK data protection legislation, and maintains a full explanation of these rights on their website DCMS will ensure that we uphold your rights when processing your personal data.

1.13 How do I complain?

Data Controllers Title: Head of Cyber Security

Data Controllers Address: The Department for Digital, Culture, Media & Sport, 100 Parliament Street, London, SW1A 2BQ

Data Controllers Email address: nis@dcms.gov.uk

The contact details for the data controller’s Data Protection Officer (DPO) are:

Data Protection Officer
The Department for Digital, Culture, Media & Sport
100 Parliament Street
London
SW1A 2BQ

Email: DCMSdataprotection@dcms.gov.uk

If you’re unhappy with the way we have handled your personal data and want to make a complaint, please write to the department’s Data Protection Officer or the Data Protection Manager at the relevant agency. You can contact the department’s Data Protection Officer using the details above.

1.14 How to contact the Information Commissioner’s Office

If you believe that your personal data has been misused or mishandled, you may make a complaint to the Information Commissioner, who is an independent regulator. You may also contact them to seek independent advice about data protection, privacy and data sharing.

Information Commissioner’s Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF

Website: www.ico.org.uk

Telephone: 0303 123 1113

Email: casework@ico.org.uk

Any complaint to the Information Commissioner is without prejudice to your right to seek redress through the courts.

1.15 Changes to our privacy notice

We may make changes to this privacy policy. In that case, the ‘last updated’ date at the bottom of this page will also change. Any changes to this privacy policy will apply to you and your data immediately.

If these changes affect how your personal data is processed, DCMS will take reasonable steps to let you know.

This notice was last updated on 05/11/2021.