Policy paper

Privacy Notice: Independent Review of the Loan Charge

Updated 4 February 2025

This notice sets out how the review team will use your personal data for the purposes of the Independent Review of the Loan Charge. This notice also explains your relevant rights under the UK General Data Protection Regulation (UK GDPR). For the purposes of the UK GDPR, HM Treasury is the data controller for any personal data you provide. However, only the review team and IT administrators will have access to the review’s mailbox, information and records during the review unless information sharing is necessary to ensure HM Treasury’s legal obligations with regards to information and data management are met. Such information sharing will be strictly limited to these circumstances and the information will only be shared with individuals who need it for this purpose. Your personal data will not be shared with HMRC.

1. Data subjects

The personal information relates to those corresponding with, or submitting evidence to, the review as either a member of the public, parliamentarian, or representative of organisations or companies.

2. Personal data  

We may collect the following personal data: your name, email address, job title, and employer, as well as your opinions and contributions. It is possible that you will volunteer additional identifying information about yourself or third parties.

3. How we use your personal data 

Any personal information may be processed for the purpose of handling correspondence and submissions to the review. This may include obtaining the opinions of members of the public, parliamentarians and representatives of organisations and companies, on government policy and its implementation. It may also include representations about the impacts of government policy and its implementation. Information submitted for the purposes of the Independent Review of the Loan Charge may inform the work of the review.

4. Our lawful basis for processing your personal data

The lawful basis for the processing of personal data is that it is necessary for the performance of a task carried out in the public interest (Article 6(1)(e) UK GDPR). The processing is necessary for the task of managing correspondence and submissions to the review.

The lawful basis for the processing of personal data for the management of Data Subject Access Requests and FOI requests is Article 6(1)(c), compliance with a legal obligation to which we are subject.

5. Special category data 

Any of the categories of special category data such as political opinions may be processed in line with the above if such data is volunteered by the individual contacting the review team, and its further processing is proportionate to the aim being pursued.

6. Our lawful basis for processing your special category data 

Where special category data is further processed by the review team, the legal basis relied upon for processing it is Article 9(2)(g) UK GDPR. The processing is necessary for reasons of substantial public interest and in the exercise of a function of the Crown, a Minister of the Crown, or a government department (Schedule 1, Part 2(6) Data Protection Act 2018).

7. Who will have access to your data 

Your personal data will only be made available to the review team who have a business need to see it for the purposes of managing correspondence and submissions to the review unless information sharing is necessary to ensure HM Treasury’s legal obligations with regards to information and data management are met. Such information sharing will be strictly limited to these circumstances and the information will only be shared with individuals who need it for this purpose. Your personal data will not be shared with HMRC.

As the personal data is stored on our infrastructure, it will be accessible to our third-party IT service providers. They will only access personal data where strictly necessary, for our purposes and in fulfilment with the contractual obligations they have with us. 

Your personal data will be protected by adequate security measures, to safeguard your data both in transit and at rest, in a manner proportionate to the threat level and sensitivity of the data.

How long we hold your personal data for 

We will retain your personal data for as long as it is needed for the review’s purposes, after which time it will be securely destroyed unless needed to fulfil additional requirements in respect of the public task or legal obligations, for example information needed for inquiries or legal proceedings.

8. Contact us 

For more information on how we use your personal data, please contact the review team at: contact@lcreview2025.org.uk.

9. Your data protection rights  

You have the right to:  

• request information about how we process your personal data and request a copy of it
• object to the processing of your personal data
• request that any inaccuracies in your personal data are rectified without delay
• request that your personal data are erased if there is no longer a justification for them to be processed
• complain to the Information Commissioner’s Office if you are unhappy with the way in which we have processed your personal data

A full list of your data protection rights appears on the ICO website.

10. How to submit a data subject access request (DSAR)  

To request access to your personal data that HM Treasury holds, please email: dsar@hmtreasury.gov.uk who will work with the review team to action this request.

11. Complaints  

If you have concerns about our use of your personal data, please contact Treasury’s Data Protection Officer (DPO) in the first instance at: privacy@hmtreasury.gov.uk  

If we are unable to address your concerns to your satisfaction, you can make a complaint to the Information Commissioner at casework@ico.org.uk or via this website: https://ico.org.uk/make-a-complaint.