Personal information charter
How the Cabinet Office collects, uses, protects and shares personal information, and how people can exercise their data protection rights.
About this charter
This Charter explains the standards people can expect when the Cabinet Office collects, holds, uses, shares or otherwise processes personal information. It also explains how to exercise data-protection rights and how to raise a concern.
The Cabinet Office processes personal data under the Data Protection Act 2026. Different Cabinet Office functions may publish more specific privacy information where the purpose, data, recipients or retention arrangements require it. Specific notices supplement this Charter and do not reduce the rights or safeguards provided by law.
1. Our commitments
The Cabinet Office will process personal information lawfully, fairly and transparently; use it for specified and legitimate purposes; collect no more than is necessary; take reasonable steps to keep it accurate; retain it only for as long as required by the applicable purpose, records rule or legal obligation; protect it with security appropriate to risk; and be able to demonstrate compliance.
2. Information we may process
Depending on the function, the Cabinet Office may process identity and contact information; correspondence and enquiries; ministerial and public appointment information; Civil Service and workforce information; records concerning public bodies, propriety and ethics; equality and accessibility information; information required for Cabinet Office services; security and access information; information-rights case records; and other information necessary for a lawful Cabinet Office function.
Some functions may involve special-category or criminal-offence data. Such information is processed only where the Data Protection Act 2026 and any other applicable law permit it and additional safeguards are applied.
3. Why we process personal information
The Cabinet Office processes personal information where necessary for lawful public tasks and official functions, compliance with legal obligations, employment or contractual administration, protection of vital interests, another lawful basis under the Data Protection Act 2026, or a recognised condition applicable to the particular processing.
Consent is used only where it is a genuine and appropriate lawful basis. The Cabinet Office will not describe consent as voluntary where a person cannot realistically refuse without consequence.
4. Your rights
Subject to the Data Protection Act 2026 and any lawful restriction, a data subject may have rights to information about processing; access to personal data; rectification of inaccurate data; erasure where the statutory conditions are met; restriction of processing; data portability where applicable; objection; safeguards concerning significant automated decisions; and complaint to the Cabinet Office and the Information Commissioner.
The availability and scope of a particular right depend on the processing and the law. A right is not refused merely because exercising it requires a search across more than one Cabinet Office system.
5. How to ask for your personal information
A request for access to personal data is a subject access request. A person may make a recorded request to the Cabinet Office and provide a means for correspondence. The Cabinet Office must maintain a reliable, secure public contact route for handling these requests.
A request should identify the person making it and give enough information to help locate the relevant records, such as the Cabinet Office function involved, approximate dates, correspondence references or the nature of the contact. A person does not have to know the name of the system in which information is held.
Where reasonably necessary, the Cabinet Office may ask for information to verify identity or authority to act for another person. Verification must be proportionate to the sensitivity and disclosure risk. Verification material must be handled securely and retained only for as long as required by the applicable records rule.
6. Requests made for another person
A person acting for someone else must provide sufficient evidence of authority to act. This may include written authority, a legally recognised representative status or another reliable form of authority appropriate to the circumstances.
Knowing a person, holding senior office, having practical access to a record or being able to view information on a platform does not itself establish authority to receive that person’s personal data.
7. Searching for information
The Cabinet Office will carry out reasonable and proportionate searches for personal data falling within a valid request. Business areas must support the search of records they hold or control.
Where a request is unusually broad or unclear, the Cabinet Office may seek clarification genuinely necessary to identify the information requested. Clarification must not be used to discourage or obstruct a person from exercising a right.
8. Information about other people
A response may contain information about other individuals. The Cabinet Office will consider their rights, consent, confidentiality and the circumstances before deciding what can lawfully be disclosed. Where possible, information may be provided with appropriate redaction rather than withholding the requester’s own information in full.
9. Restrictions and exemptions
A data-protection right may be restricted only where the Data Protection Act 2026 or another competent enactment permits it and the restriction is necessary and proportionate.
Restrictions may be relevant, for example, to national security, crime and regulatory functions, legal professional privilege, judicial or parliamentary functions, confidential references, the rights of other people or other protected matters identified by law. The Cabinet Office must record the legal basis and reasoning for a material restriction.
10. Accuracy and correction
The Cabinet Office will take reasonable steps to keep personal data accurate where accuracy matters to the purpose for which it is used. A person may ask for inaccurate data to be corrected or incomplete data to be completed where the law provides.
Where a record must be preserved for accountability, legal or archival reasons, correction may require an auditable annotation or linked correction rather than deletion of the original historical record.
11. Retention and public records
Personal data is retained according to the Cabinet Office Records Retention and Disposal Schedule, applicable legislation and any legal hold or preservation requirement.
Some records may be preserved for archiving in the public interest under public-records law. Archival preservation does not remove data-protection safeguards governing access and use.
12. Sharing personal information
The Cabinet Office may share personal information with another department, public body, service provider, regulator, law-enforcement body or other recipient only where there is a lawful basis and the sharing is necessary and proportionate for the relevant purpose.
A data-sharing agreement, memorandum or technical permission does not itself create legal authority to disclose personal data. Where a processor handles personal data on behalf of the Cabinet Office, the arrangement must include the controls required by the Data Protection Act 2026.
13. External platforms and services
The Cabinet Office may use authorised digital services and operating platforms in carrying out its work. Use of Discord, Roblox, Google Workspace or another service does not alter the Department’s responsibility for lawful processing. Where the use of a service involves an external transfer of personal data, the controller must establish and document the relevant protection or other lawful transfer condition under section 31 of the Data Protection Act 2026.
Access must be controlled according to function and need. Personal information must not be copied into wider channels or repositories merely because a technical feature permits it.
14. Security
The Cabinet Office applies proportionate technical and organisational measures to protect personal data. These may include role-based access, authentication, restricted repositories, logging, secure configuration, retention controls, staff training, incident management and review of access.
Security measures must reflect the sensitivity of the information and the consequences of unauthorised access, alteration, loss or disclosure.
15. Personal data breaches
A suspected personal data breach must be reported promptly through the Cabinet Office security and data-protection incident route. The Cabinet Office must document breaches and notify the Information Commissioner and affected data subjects where the Data Protection Act 2026 requires it.
16. Data Protection Officer
Under section 27 of the Data Protection Act 2026, the Cabinet Office must designate a suitably qualified Data Protection Officer with the required independence and resources. The officer advises the Department, monitors compliance, supports impact assessment and acts as a contact point for data subjects and the Information Commissioner.
The Data Protection Officer advises and monitors; responsibility for lawful processing remains with the Cabinet Office and the accountable owners of the processing.
17. Complaints
A person who believes the Cabinet Office has infringed the Data Protection Act 2026 may complain to the Department. The Cabinet Office must provide a verified public route for data-protection complaints, facilitate their consideration and explain the outcome and any corrective action. Complaints are subject to the statutory safeguards, including the requirement to acknowledge a complaint within 30 days.
A person may also complain to the Information Commissioner in accordance with the Data Protection Act 2026. Nothing in this Charter removes any court or tribunal remedy available by law.
18. Privacy notices
Where a Cabinet Office activity collects personal information in circumstances requiring more specific transparency, the responsible function must publish or provide a privacy notice describing the purpose, lawful basis, data involved, recipients, retention, rights, contact route and any significant external transfer or automated decision-making.
A generic reference to this Charter is not sufficient where the individual needs more specific information to understand how their data will be used.
18A. Freedom of Information requests and internal reviews
This supplementary privacy information applies when a person asks the Cabinet Office for recorded information under the Freedom of Information Act 2026 or requests an internal review of its response. The Cabinet Office is the controller for its handling of those requests. The published Cabinet Office contact page provides the current correspondence address. This information also applies to the dedicated GOV.UH request and review forms if and when they are made available.
The Cabinet Office may collect the requester’s name, reply address, description of the recorded information sought, correspondence and supporting documents, an earlier request or decision reference, reasons for a review, accessibility arrangements the person chooses to disclose, message and submission metadata, and the Department’s case notes, searches, redactions, decisions and responses. Relevant records may contain personal information about other people, which must be considered separately before disclosure.
The purposes are to receive, identify and assess requests; search for records; determine whether information is held and may lawfully be released; provide advice or clarification; issue responses and refusal notices; conduct reviews; handle complaints, appeals and legal obligations; and maintain an accountable record. Processing is necessary for the Cabinet Office’s legal obligations and public functions under the Freedom of Information Act 2026, using the applicable lawful basis and safeguards under the Data Protection Act 2026. Information is not collected on the basis of purported consent merely because a person submits a statutory request.
Only authorised personnel and service providers should have access as necessary for those purposes. Information may be shared with other relevant record holders for a lawful search or consultation, and with the Information Commissioner or competent courts and tribunals where required or permitted. The Cabinet Office must document processor arrangements and any external transfers in accordance with section 31 of the Data Protection Act 2026; using Google Workspace, GOV.UH Forms or a casework application does not itself establish a lawful transfer or disclosure. Decisions on releasing information are subject to responsible human determination, not merely a form submission.
Requester details and case records are retained for the time necessary to administer the request and any review, complaint or appeal, and thereafter in accordance with the Cabinet Office Records Retention and Disposal Schedule, applicable law and legal holds. The Cabinet Office will apply rights of access, correction, complaint and other data-protection rights where applicable. A subject access request is different from an FOI request. People should use the Cabinet Office’s published contact details to raise a data-protection concern and must not send identity documents or sensitive evidence through an unverified ordinary email route. The Department must provide a secure route where identity evidence or sensitive disclosure is needed. The requirement to designate an independent Data Protection Officer under section 27 remains applicable.
19. Children and people requiring additional support
Where personal information concerns a child, the Cabinet Office must provide age-appropriate transparency and apply the higher protection required by the Data Protection Act 2026. Safeguarding concerns must be referred through the competent safeguarding route and must not be treated merely as data-protection administration.
The Cabinet Office will provide reasonable adjustments and accessible routes for people who need support to understand or exercise their information rights.
20. Review
The Cabinet Office information governance function is responsible for maintaining this Charter. Advice and monitoring by the designated Data Protection Officer must be provided in accordance with section 27 of the Data Protection Act 2026. This Charter must be reviewed following material change to data-protection law, Cabinet Office processing, Information Commissioner guidance or the Department’s information-management arrangements.