Guidance

Biodiversity net gain privacy notice

Updated 13 November 2024

Applies to England

Who collects your personal data

The data controller is Natural England at:

Foss House, Kings Pool, 1-2 Peasholme Green, York, Y01 7PX

Send questions about how Natural England uses your personal data and your associated rights to the Natural England Data Protection Manager at RecordsandDataProtection@naturalengland.org.uk or:

Natural England, County Hall, Spetchley Road, Worcester, WR5 2NP

The Data Protection Officer for the Department for Environment, Food and Rural Affairs (Defra) group is responsible for checking that Natural England complies with legislation. You can contact them at DefraGroupDataProtectionOfficer@defra.gov.uk or:

Department for Environment, Food and Rural Affairs, SW Quarter, 2nd floor, Seacole Block, 2 Marsham Street, London SW1P 4DF

What personal data is collected and how we use it

Natural England will collect the following information:

Statutory biodiversity credits

• name

• address

• postcode

• date of birth

• email address

• telephone number

• mobile number

• job title and employer information

• financial information

Biodiversity gain site register

• name

• address

• postcode

• location information

• date of birth

• email address

• telephone number

• mobile number

• job title and employer information

• financial information

• signatures

• property title information

Natural England has been appointed as register operator for the biodiversity gain site register under the biodiversity gain site register Regulation 2024 pursuant to section 100 of the Environment Act 2021, and administrator of the statutory biodiversity credits sales services on behalf of the Secretary of State for the Department of Environment Food and Rural Affairs pursuant to section 101 of the Environment Act 2021, and will use this information to deliver services and carry out it functions in this respect, including:

• to process and determine applications to the biodiversity gain site register and to purchase statutory biodiversity credits

• contacting applicants to the biodiversity gain site register and notifying them of updates and request further information and outcomes of applications

• processing payments in respect of applications to the biodiversity gain site register and statutory biodiversity credits

• processing fines in respect of applications to the biodiversity gain site register

• contact applicants regarding their registered site and allocation on the biodiversity gain site register

• maintaining the biodiversity gain site register and communications in relation to this

• contact applicants, issuing them relevant documents and notifying them of updates and request further information and outcomes of applications regarding their request to purchase statutory biodiversity credits

The legal basis for processing your personal data

Biodiversity gain site register

Processing is necessary for compliance with a legal obligation to which the controller is subject, and processing of the data is necessary for the performance of a task carried out in the public interest.

Statutory biodiversity credits

Processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract and processing of the data is necessary for the performance of a task carried out in the public interest, which is laid down by law. 

Natural England’s general purposes can be found in Sections 1 and 2 of the Natural Environment and Rural Communities Act 2006 (NERC 2006), and more specifically in respect of the biodiversity gain site register the Environment Act 2021 section 100 and the biodiversity gain site register Regulations 2024, and in respect of the statutory biodiversity credits the Environment Act 2021 section 101. 

Consent to process your personal data

The processing of your data is not based on consent.

Who Natural England shares your personal data with

Your personal data may be shared with Defra and other third-parties acting on Natural England’s behalf. For example, Natural England may use subcontractors for:

• customer due diligence checks before purchasing credits

• processing of payments

• supporting the biodiversity gain site register, register operator role

• policy evaluation process and delivery of Natural England general purpose under Sections 1 and 2 of the Natural Environment and Rural Communities Act 2006 (NERC 2006)

If during due diligence or verification checks of an application it appears that a crime has been committed, then we will share data with the relevant competent body or bodies.

Natural England respects your personal privacy when responding to access to information requests. We only share information when necessary to meet the statutory requirements of:

• the Environmental Information Regulations 2004

• the Freedom of Information Act 2000

How long Natural England holds personal data

If an application to the biodiversity gain site register is accepted, Natural England has a legal duty, under the biodiversity gain site register Regulations 2024, to publish details of the site on the biodiversity gain site register.   

For the biodiversity gain site register, Natural England will hold personal data for the full period the record must be published on the biodiversity gain site register.  The legal minimum period for securing legal agreement is 30 years.   

This includes personal data held on Natural England’s internal database for issuing notices from the Register Operator Service.

Information on the biodiversity gain site register associated with site records can be removed.  For example:

• if the gain site is removed by the applicant for any reason, or  

• if a record is amended

When details are removed from the biodiversity gain site register, Natural England will retain personal data for 5 years for audit purposes.  

For statutory biodiversity credits purchases Natural England will hold your personal details for 10 years from receipt of payment, to support financial auditing.  

If an application for either the biodiversity gain site register or statutory biodiversity credits is rejected, Natural England will retain personal data for 10 years from time of application, to support financial auditing.  

What happens if you do not provide the data requested

If you do not provide the data, we will be unable to progress any application for the Biodiversity Net Gain Service.

Use of automated decision-making or profiling

The information you provide is not used for:

• automated decision making (making a decision by automated means without any human involvement)

• profiling (automated processing of personal data to evaluate certain things about an individual)

Transfer of data outside of the UK

For statutory biodiversity credits, to complete the customer due diligence check stage, our third party processor will process your personal data in India, using their SharePoint site hosted in the United States of America.

Your rights

Find out about your individual rights under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018 (DPA 2018).

Complaints

You have the right to make a complaint to the Information Commissioner’s Office at any time.

Natural England’s personal information charter

Natural England’s personal information charter explains more about your rights over your personal data.