The UK’s independent authority set up to uphold information rights in the public interest, promoting openness by public bodies and data privacy for individuals.

Purpose and lawful basis for processing

Our purpose for processing your personal data is so we can contact you about your organisations story being used as a case study.

The lawful basis we rely on to process your personal data is article 6(1)(e) of the GDPR, which allows us to process personal data when this is necessary to perform our public tasks as a regulator.

What we need

We’ll need your name, telephone number and email address and the name of your organisation. This will be obtained when you contact our helpline only if you want to take part in the study.

We will also ask for details about your organisation’s compliance with data protection that are relevant to the case study. 

What we do with it

We’ll use your telephone number and/or your email address to contact you in order to obtain the information we need for use in the case study.

We’ll use the name of your organisation and the details you provide about it on our website and other communication channels such as social media to share your example but we will not publish your personal data.

If you provide your details to be used as an end of transition example you details will also be shared with the communications team at the Department for Digital, Culture, Media and Sport (DCMS). They may also contact you for details about your organisation’s compliance with data protection that are relevant to the case study. Your case study may also be shared via their communications channels. A copy of the privacy notice for DCMS is here.

No personal or contact details will be shared via social media or other communications channels, however we will share the name of the organisation.

How long we keep it

For information about how long we hold personal data, see our retention schedule.

What are your rights?

We process personal data for the use of case studies in our capacity as a regulator, so you have a right to object to our processing of your personal data. There are some legitimate reasons why we may refuse your objection, which depend on why we are processing it.

For more information on your rights, please see ‘Your rights as an individual’ in the list on the left under the ‘General information’ header.

Do we use any data processors?