View our 'what we do with your personal data when you...' infographic for a basic overview of the below information.


Purpose and legal basis for processing

Our purpose is to investigate and take regulatory action in line with our statutory duties.

We rely on Schedule 8 1(a)and (b) of the Data Protection Act 2018 to process your personal data.  This relates to processing ‘necessary for the exercise of a function conferred on a person by an enactment or rule of law, and is necessary for reasons of substantial public interest’. This is part of our regulatory function.

What we need

When we investigate an alleged criminal offence, we’ll compile information and evidence about it.

Why we need it

In our role as a regulator, we need to establish whether the legislation we oversee has been breached, so that we can take legal action if appropriate. So we’ll gather relevant information about you to do this.

What we do with it

We will only use your personal information to see whether the legislation has been breached, and for prosecution purposes if we have evidence of a breach.

In some circumstances we may share your personal information with law enforcement and other agencies during an investigation.

If we proceed to take legal action, we’ll share this information with our legal counsel, the courts and any co-defendants and their legal representatives.

When we take enforcement action against someone, we may publish the defendant’s identity in our Annual Report or in the media. Usually we do not identify any complainants unless the details have already been made public.

How long we keep it

For information about how long we hold personal data, see  our retention schedule.

What are your rights?

Personal data about criminal convictions and offences falls under Part 3 of the Data Protection Act 2018 for ‘law enforcement purposes’. There are specific rights for this type of personal data.

The law enforcement purposes are stated in the legislation as ‘the purposes for the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, including the safeguarding against and the prevention of threats to public security.’

You have a right to access your personal data held by or for us. You also have a right to get inaccurate data rectified and incomplete data completed, and for your personal data to be erased in certain circumstances.

You can also read our ‘Safeguarding Policy: sensitive processing for law enforcement purposes’ .

Do we use any data processors?

Yes – we may use external legal counsel for court proceedings.