Data protection

Data protection legislation

The General Data Protection Regulation and the Data Protection Act 2018 together determine how, when and why any organisation can process personal data. Personal data is any information that can identify a living individual. These laws exist to ensure that your data is managed safely and used responsibly. They also provide you with certain rights in respect of your data and create a responsibility on us, as a user of personal data, to provide you with certain information. While most of this information is available elsewhere on our website and other promotional materials, gathering it here in one place should make it easier for you.

The Office for National Statistics (ONS) collects and processes a lot of information, both directly from individuals and in bulk from other organisations, and does so using a variety of methods.

The information that follows covers most of our statistical production activities. You may have received additional information from us regarding specific data processing. If you have any queries about how your personal data is used, please contact info@ons.gov.uk

The identity and contact details of the data controller

The data controller is the person or organisation who decides what personal data shall be processed and for what purpose. For the vast majority of our work ONS is the controller and makes those decisions. However, in some instances we provide statistical services to other organisations or government departments and collect or process data on their behalf. Whenever that is the case we will let you know.

You can get in contact with ONS either by telephone, email or post:

Telephone: 0345 601 3034
Email: sharedcustomercontactcentre@ons.gov.uk

Customer Contact Centre
Room D265
Office for National Statistics
Government Buildings
Cardiff Road, Newport
South Wales
NP10 8XG

The contact details of our Data Protection Officer

Our Data Protection Officer is the person charged with providing ONS with advice and guidance on the ways we can best protect the information we collect and use, and they are involved in all the major decisions we make in relation to personal data. If you have any queries or concerns regarding your data, or wish to exercise any of your rights (see later in this guidance), then please contact the Data Protection team via email or post:

Email: DPO@statistics.gov.uk

Data Protection Officer
Office for National Statistics
Segensworth Road
Titchfield
Fareham
Hampshire
PO15 5RR

If you would like to exercise your data protection rights via the telephone, please contact our Customer Contact Centre, providing details of your request and email and, or, written address details. They will then be able to pass this over to the Data Protection team to action and respond.

Telephone: 0345 601 3034

The purposes for which personal data are processed

The ONS has the statutory objective to promote and safeguard the production of official statistics that serve the public good. This means that any personal data we collect, whether it is for our own use or on behalf of someone else, will only ever be used to produce statistics or undertake statistical research. In order for us to produce statistics and enable research we may link the data that we collect with other data that we hold.  Further information on what we use data for is available

Occasionally, the ONS, or its third parties, will recruit people in advance to take part in research, and in doing so will collect some personal data (name, address, telephone number and email address) to allow us to make contact. When we do so the personal data that we collect will be used only for this purpose, will not be shared with any third parties, and will not be kept for longer than 12 months.

To help us carry out our statutory functions we may record telephone calls with respondents who answer our surveys carried out over the telephone, or who contact the ONS’ Enquiry Lines. The purpose of this is to monitor staff performance and training, check data quality and respondent understanding of survey questions, and to understand the impact of materials sent to respondents in advance of the survey being carried out. This data is stored and processed by third parties (8x8 and Anywhere365) using data centres located in the UK. These recordings will not be kept for any longer than 13 months.

The legal basis for the processing

Data protection legislation requires that all processing of personal data is undertaken under one or more of a set list of conditions. Unless stated otherwise all ONS statistical processing is undertaken under the following condition:

“Processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller.”

ONS is a statutory body, meaning we were created by legislation, specifically the Statistics and Registration Service Act 2007, with the objective of promoting and safeguarding the production and publication of official statistics that serve the public good. All our collection and use of data comes from powers that can be found in that Act or other UK legislation. A full list of all the legislation that we use is available.

An additional condition is required for any processing of special personal data. Special personal data is information about your racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, sex life or sexual orientation. It also includes genetic and biometric data. The condition that ONS uses to process such data is:

“Processing is necessary for archiving in the public interest, scientific or historical research purposes or statistical purposes based on UK law.”

The recipients of personal data

At the ONS, we treat the data we hold with respect, keeping it secure and confidential. However, to support statistical production and research, we will sometimes allow access to the information we hold where it is lawful to do so. More information on how we permit access to data for research is available. We also publish a full list of all of the approved researchers and government organisations who have been granted access. You can also learn more about the ONS Secure Research Service, providing access to secure de-identified data to approved researchers.

For example, the ONS has collaborated with NHS Digital to create the Public Health Research Database, which is an anonymised dataset that enables approved or accredited researchers to lawfully and ethically undertake coronavirus (COVID-19) research using 2011 Census data alongside mortality information, and data derived from hospital episodes and general practitioners. The NHS Digital's Privacy Policy Notice is available. The data may include subjects who have signed up to the NHS national data opt out, the justification for which includes the heavily derived and anonymous nature of the health data contained within this product. NHSD publish information on when the opt out does not apply.

The period for which personal data will be stored

Data protection law requires that personal data is kept for no longer than is necessary to fulfil the purposes for which it was originally collected. However, statistical use of data is often a secondary purpose and in recognition of this and the fact that using personal data to produce statistics has no direct effect on individuals, the law allows that information held for statistical purposes only may be kept for longer periods. ONS will only continue to hold personal data where it is still used to produce statistics. In addition, ONS will also de-identify or anonymise data at the earliest opportunity it can without compromising its utility.

Data subject rights

As a data subject (someone whose personal data we hold) you have rights available to you under data protection law. If you wish to exercise any of these rights then please contact our Data Protection Officer, but please be aware that we may not be required to comply if the data is being held for statistical purposes only. Compliance requirements are set out in the Data Protection Act 2018.

You have the right to request from any controller that holds your personal data: access to the information they hold about you and to amend any wrong or inaccurate information they hold about you. You have the right to object to your personal data being processed.

You have the right, in some circumstances, to request for any controller to: erase any personal data they may hold about you, stop processing your personal data, or pass any information they hold about you to another controller.

Further information on the rights available to you and the circumstances under which you can exercise them, is available from the Information Commissioner.

The Information Commissioner

The Information Commissioner’s Office is the independent body tasked with regulating data protection within the UK. They can provide you with additional information regarding data protection and your rights, and will deal with any complaints you may have regarding our use of your data:

0303 123 1113
casework@ico.org.uk

Information Commissioner’s Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF

Statutory provision of information

Some of the information we collect from you, for example, the census, is required by law and failure to provide it can be a criminal offence. Whenever we collect your personal data from you we will always let you know if you are required to provide the information and of the possible consequences of failure to do so.

Further information on how we collect, use and store data can be found on our data policies page. Further information on the specific surveys we run is available on our information for households and individuals page.