Data protection

The General Data Protection Regulation (GDPR) and the Data Protection Act 2018 apply in the UK and work together to govern the processing of personal data. They place duties on organisations on how they collect, process, store and disclose information about people. It also gives individuals (data subjects) the right of access to information held about themselves.

You can ask to see any information we hold about you as part of the General Data Protection Regulation. This is called a subject access request.

Find out what information you can request and how to make a request on our request your information page.

There may be some occasions when an exemption would apply from providing the information and if this is the case then we will write to you and let you know why.

Your rights

  • to ask us to remove data we hold about you or limit our use of it - this right is not absolute and we may not be able to comply with your request unless the following specific circumstances apply:
    1. Your personal data is no longer necessary in relation to the purpose for which it was originally collected and processed.
    2. You withdraw consent we have relied upon.
    3. You object to the processing of your information and there is no overriding legitimate interest for continuing the processing.
    4. Your personal data was unlawfully processed.
    5. Your personal data has to be erased in order to comply with a legal obligation.
  • to data portability - the right to obtain and reuse your personal data for your own purposes across different services only applies where the processing is based on your consent or for the performance of a contract, and when processing is carried out by automated means.
  • not to be subject to automated decision-making, including profiling - this right only applies where the decision is based on automated processing and it produces a legal effect or has a similarly significant effect on you.

You can make a request to:

  • rectify an inaccurate record
  • erase a record or to restrict processing
  • object to processing
  • request portable data
  • cease automated decision-making and/or profiling

For further information about your rights, including the circumstances in which they apply, see the guidance from the UK Information Commissioner's Office (ICO) on individuals’ rights under GDPR.

If you would like to exercise a right, please contact the Information Management team at

On receiving your request, we will get back to you with a timescale for carrying it out. If we aren't able to comply with your request for any reason we will explain why.

More information

Directorate record retention schedules