Guidance

Access to information and data subject access requests privacy notice

Updated 13 November 2024

Applies to England

© Crown copyright 2024

This publication is licensed under the terms of the Open Government Licence v3.0 except where otherwise stated. To view this licence, visit nationalarchives.gov.uk/doc/open-government-licence/version/3 or write to the Information Policy Team, The National Archives, Kew, London TW9 4DU, or email: psi@nationalarchives.gov.uk.

Where we have identified any third party copyright information you will need to obtain permission from the copyright holders concerned.

This publication is available at https://www.gov.uk/government/publications/natural-england-privacy-notices/access-to-information-and-data-subject-access-requests-privacy-notice

Who collects your personal data

The data controller is Natural England at:

Foss House, Kings Pool, 1-2 Peasholme Green, York, Y01 7PX

Send questions about how Natural England uses your personal data and your associated rights to the Natural England Data Protection Manager at foi@naturalengland.org.uk or:

Natural England, County Hall, Spetchley Road, Worcester, WR5 2NP

The Data Protection Officer for the Department for Environment, Food and Rural Affairs (Defra) group is responsible for checking that Natural England complies with legislation. You can contact them at DefraGroupDataProtectionOfficer@defra.gov.uk or:

Department for Environment, Food and Rural Affairs, SW Quarter, 2nd floor, Seacole Block, 2 Marsham Street, London SW1P 4DF

What personal data’s collected and how it’s used

With access to information requests, Natural England processes:

  • your name
  • your contact details
  • your request
  • data that you volunteer
  • data that we discover on our systems

With data subject access requests (DSARs), Natural England uses the personal data on your request form to:

  • check your identity so it can process the request
  • search its systems and records to find any information it may hold about you
  • prepare the information to be sent to you - this will be information Natural England already holds and it will not reprocess your information to create new records or products

With access to information requests, the legal basis for processing your personal data is to meet legal obligations placed on Natural England as the data controller. These are the Environmental Information Regulations 2004 and the Freedom of Information Regulations 2000.

With DSARs, the legal basis for processing your personal data is to meet legal obligations placed on Natural England as the data controller. These are the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018 (DPA 2018).

The processing of your data is not based on consent. You cannot withdraw it.

If you want Natural England to stop processing your request for information or your DSAR email foi@naturalengland.org.uk.

Who Natural England shares your personal data with

Natural England shares your personal data with:

  • the Information Commissioner’s Office - where requested by them to carry out their statutory duties
  • law enforcement agencies – when we can lawfully do so for the prevention and detection of crime and fraud

Natural England respects your personal privacy when responding to access to information requests. It only shares information when necessary to meet the statutory requirements of the Environmental Information Regulations 2004 and the Freedom of Information Act 2000.

How long Natural England holds personal data

Natural England will keep your access to information request for 7 years after its completion.

Natural England will keep your DSAR for 3 years after its completion. It will keep your name and the date of your DSAR, or any complaint, for 7 years.

What happens if you do not provide the data

Natural England may not be able to process your request for information or provide you with your personal information in response to a DSAR.

Use of automated decision-making or profiling

The information you provide is not used for:

  • automated decision making (making a decision by automated means without any human involvement)
  • profiling (automated processing of personal data to evaluate certain things about an individual)

Transfer of data outside of the UK

Natural England will only transfer your data to another country that is deemed adequate for data protection purposes.

Your rights

Find out about your individual rights under the UK GDPR and the DPA 2018.

Complaints

You have the right to make a complaint to the Information Commissioner’s Office at any time.

Natural England’s personal information charter

Natural England’s personal information charter explains more about your rights over your personal data.

Back to top