Privacy Notice

This privacy notice explains how the Department for Business and Trade (DBT), as a ‘data controller’, processes personal data for the ‘View subsidies awarded by UK public authorities’ service on GOV.UK.

This service is made up of two parts – an open access public website for viewing published subsidy awards and schemes and a restricted access administration website (‘Manage UK subsidies’) that allows authenticated users to publish and manage data for public authorities. This notice covers both parts of the service.

This notice is supplemented by our main privacy notice which provides further information on how DBT processes personal data, and sets out your rights in respect of that personal data.

Personal data DBT collects

DBT collects information about people or businesses that receive a subsidy from a UK public authority, and information about individuals representing UK public authorities.

DBT collects the following categories of personal data:

  • Names of businesses or individual sole traders receiving a subsidy from a UK public authority
  • Identifiers of businesses and individuals, including Unique Tax Reference (UTR) numbers for sole traders
  • Names and email addresses of individuals representing UK public authorities

Why DBT asks for this information and what happens if it is not provided

DBT collects this information to meet its obligations under ‘The Subsidy Control (Subsidy Database Information Requirements) Regulations 2022', which requires UK public authorities to report on their subsidy schemes and subsidies they award.

The ‘View subsidies awarded by UK public authorities’ service is provided by DBT to enable this reporting to take place. Personal data is collected through this service to:

  • identify businesses and individuals who have received a subsidy award
  • allow individuals representing UK public authorities to log into the ‘Manage UK Subsidies’ part of the service
  • send confirmation emails and reminders to individuals publishing entries on behalf of public authorities

This personal data must be provided by all qualifying UK public authorities to meet their legal obligations under the regulations.

The legal basis for processing your personal data

The legal basis for processing your personal data (Article 6(1) UK General Data Protection Regulation (GDPR)) is that:

  • processing is necessary for compliance with a legal obligation to which the controller is subject
  • processing is necessary for the performance of a task of the controller carried out in the public interest or a task carried out in the exercise of official authority vested in the controller

In some instances, we may process your data further for a compatible purpose and/or on other legal bases. For example, your data may be used for archiving, research and/or statistical purposes. These are compatible purposes for further processing in UK GDPR and your data will be subject to appropriate safeguards if used for such purposes.

How DBT processes personal data it receives

Once received:

  • your data will be stored within the ‘View subsidies awarded by UK public authorities’ service
  • names of businesses and sole traders who have been awarded subsidies will be published openly on the ‘View subsidies awarded by UK public authorities’ service. Further publication may take place through a range of DBT digital channels
  • your data may also be processed within other DBT internal digital and data systems

Third-party processors

We use the following third-party processors to operate the service:

  • Microsoft Azure – DBT’s contracted cloud-hosting service provider for this service
  • Microsoft Active Directory – allows users to log in
  • CGI – the contracted supplier for developing and maintaining this service
  • Government Digital Service – provides the GOV.UK Notify service, used for confirmation emails

Information sharing

In addition to the open publishing of subsidy recipients, we may share personal data you provide:

  • with other government departments, public authorities, law enforcement agencies and regulators including where the data is necessary for them to discharge their statutory functions
  • with other third parties where we consider it necessary in order to further our functions as a government department
  • in response to information requests, for example, under Freedom of Information (FOI) law or the Environmental Information Regulations (EIR)
  • to a court, tribunal or party where the disclosure is necessary in order to exercise, establish or defend a legal claim
  • where we are ordered to do so or where we are otherwise required to do so by law
  • with third party data processors as governed by contract

You can find out more detailed information about how we share data and further processing in the main privacy notice.

How long will DBT hold your data for

DBT will only retain your personal data for as long as necessary to fulfil the purposes we collected it for, including for the purposes of satisfying any legal, accounting, or reporting requirements.

Your personal data will be kept by us for the duration of your subsidy remaining on the database.

If we decide that we need to process your personal data for a reason which is incompatible with the purposes for which we collected it for, we will contact you to explain why we are doing this and why it is lawful to do so.

To determine the appropriate retention period for personal data, we consider the amount, nature, and sensitivity of the personal data, the potential risk of harm from unauthorised use or disclosure of your personal data, the purposes for which we process your personal data and whether we can achieve those purposes through other means, and the applicable legal requirements.

Your Rights

You have a number of rights available to you under UK data protection legislation, including:

  • the right to request copies of the personal data we hold about you
  • the right to request that we rectify information about you which you think is inaccurate or incomplete
  • the right to request that we restrict your data from further processing (in certain circumstances)
  • the right to object to the processing of your data (in certain circumstances)
  • the right to data portability (in certain circumstances)
  • the right to request that we erasure your data (in certain circumstances)
  • the right not to be subject to a decision based on solely automated data processing

You can contact DBT’s Data Protection Officer for further information about how your data has been processed by the department or to make a complaint about how your data has been used. Please contact: data.protection@businessandtrade.gov.uk

You can also submit a complaint to the Information Commissioner’s Office (ICO) at:

Information Commissioner's Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF

Website: https://ico.org.uk/

Telephone: 0303 123 1113

You can find out more about your rights as a data subject, and details of how to contact our Data Protection Officer and the ICO in our main privacy notice.