Closed call for evidence

Privacy notice for the call for views on cyber governance

Published 23 January 2024

This was published under the 2022 to 2024 Sunak Conservative government

1. Who is collecting my data? 

The Department for Science, Innovation and Technology (DSIT) drives innovation that will deliver improved public services, create new better-paid jobs and grow the economy.  

DSIT brings together the relevant parts of the former Department for Business, Energy and Industrial Strategy and the former Department for Digital, Culture, Media and Sport. 

2. Purpose of this privacy notice 

This notice is provided within the context of the notice provided to meet the obligations as set out in Articles 13 and 14 of UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018 (DPA). This notice sets out how we will use your personal data. 

DSIT’s Personal Information Charter (opens in a new tab) provides additional information on how we handle your personal information. It also explains how you can ask to view, change or remove your information from our records. 

2.1 Data controller 

DSIT is responsible for conducting the Call for Views on the Code of Practice for Cyber Governance, which will enable the UK government to gather feedback on the proposed Code and establish publication and implementation plans that will align with broader governance reforms. DSIT is the Data Controller for this Call for Views. 

This notice only refers to your personal data (e.g. your name, email address, and anything that could be used to identify you personally). 

2.2 Personal data we collect 

Whilst much of this data is business in nature, some of this data may be personal information.  

The personal data relates to the following categories which will be collected from you directly. This includes: 

• Contact details (name, name of organisation, email address)  
• Job title  
• Individual/organisation regional location 
• Your IP address 

2.3 The collection of cookies 

As part of this survey Qualtrics, the survey platform, will collect essential cookies such as your IP address and your browser to stop multiple responses and to make sure that the survey displays correctly. The full cookies policy from Qualtrics can be found here. 

2.4 How we use your personal data 

The purpose for which we are processing your personal data is to enable us to carry out our functions as a government department. This includes:   

• analysis of responses to the Call for Views 
• to re-contact you (if you provide contact details) 

Anonymised reporting of trends/answers submitted to the Call for Views may be created and shared. This will not link back to you or any answers you submit. 

2.5 Our legal basis 

The legal basis for processing your personal data under Article 6 of the UK GDPR is:  

Article 6 (1) (e) Public task: Processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the data controller.  

This processing is necessary for the exercise of the functions of a government department (DPA Schedule 9, paragraph 5(d). This survey provides ministers and government officials with information about businesses in order to inform future policy development.   

3. Who your personal data will be shared with 

Qualtrics is a contracted provider and their survey platform is used to collect your personal data and survey responses (see section 2.3).  Your response is not shared with any other party.

3.1 How long your personal data will be kept for 

We will only retain your personal data for 2 years in line with DSIT retention policy.   

3.2 International transfers  

Your personal data will be processed in the UK. 

3.3 Will my data be used for automated decision making or profiling? 

We will not use your data for any automated decision making.  

4. Your rights 

You have rights over your personal data under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018 (DPA 2018). The Information Commissioner’s Office (ICO) is the supervisory authority for data protection legislation, and maintains a full explanation of these rights on their website.  

DSIT will ensure that it upholds your rights when processing your personal data.  

4.1 Contact details 

The data controller for your personal data is the Department for Science, Technology and Innovation. The contact details for the data controller’s Data Protection Officer (DPO) are: 

DSIT Data Protection Officer
Department for Science, Innovation and Technology
22-26 Whitehall
London
SW1A 2EG

Email: [email protected]

If you are unhappy with the way we have handled your personal data and want to make a complaint, please write to the department’s Data Protection Officer at the relevant agency. You can contact the department’s Data Protection Officer using the details above.  

4.2 Complaints 

If you consider that your personal data has been misused or mishandled, you may 

make a complaint to the Information Commissioner, who is an UK independent regulator.  The Information Commissioner can be contacted at:  

Information Commissioner’s Office Wycliffe House Water Lane Wilmslow Cheshire SK9 5AF 

Telephone: 0303 123 1113 

https://ico.org.uk/make-a-complaint/  

Any complaint to the Information Commissioner is without prejudice to your right to seek redress through the courts.  

4.3 Updates to this notice 

If this privacy notice changes in any way, we will place an updated version on this page. Regularly reviewing this page ensures you are always aware of what information we collect, how we use it, and under what circumstances we will share it with other parties. The ‘last updated’ date at the bottom of this page will also change. 

If these changes affect how your personal data is processed, we will take reasonable steps to let you know. 

Last updated 07/03/2023 to clarify section 3 and how the Qualtrics website is used to collect personal data.