°Ç¸ç³Ô¹Ï

The Fair Work Agency (FWA) will treat all personal information in line with data protection legislation, including the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.ÌýÌý

What you are entitled to knowÌý

When we (or our partner organisations working with us) collect, hold, use or otherwise process your personal information, you are entitled to be told:ÌýÌý

• the purpose for using your information, and the lawful basis for processing itÌý

• how long we will keep it and who we will share it withÌý

• whether it will be transferred or accessed outside the UK (and what safeguards apply)Ìý

• what rights you have (including the right to access your information or object to certain uses)Ìý

• how to complain to the Information Commissioner’s Office (ICO) if you think your information has been mishandledÌý

• how to contact our Data Protection Officer (DPO) (or data protection function)ÌýÌý

What you are entitled to expectÌý

You are entitled to have your personal information:ÌýÌý

• protected and kept secureÌý

• keptÌýaccurateÌýand up to dateÌý

• used only for purposes that are compatible with why it was collectedÌý

• kept only for as long as it is needed (unless it must be kept as part of the historic record)ÌýÌý

Privacy notice

FWA is committed to protecting the privacy and security of your personal information. This privacy policy describes how we collect and use personal information about youÌýin accordance withÌýUK Data Protection legislation, including the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018 and section 8 of the Data Protection Act 2018.Ìý

We have a separate privacy notice which describes how we collect and use personal information about our staff in relation to their employment.Ìý

We’re required under data protection legislation toÌýnotify youÌýof the information contained in this privacy policy. It’s important that you read this policy so that you are aware of how and why we are using your information.Ìý

In addition to this privacy policy, when you interact with us, we may provide you with more specific information about how we will process your personal data.ÌýÌý

What data we collectÌý

Personal information (sometimes called ‘personal data’) is any information thatÌýidentifiesÌýand relates to a living person. This can include information that, when put together with other information, can thenÌýidentifyÌýa person.Ìý

Because personal information allows people to know things about you, we need to protect this information and only use it for certain purposes.Ìý

Some information needs more protection. It might be information that you would not want widely known or that is very personal to you. This is sometimes also referred to as ‘sensitive personal data’ or ‘special categories of data’. Ìý

We collect,ÌýstoreÌýand use certain categories of personal information about you such as:Ìý

• personal contact details such as name, title, addresses, email addresses and phone numbers

• job or role within your companyÌý

• National InsuranceÌýNumberÌý

• ²µ±ð²Ô»å±ð°ùÌý

• information about your employmentÌý

• information about your business activitiesÌý

• information about your domestic and business propertiesÌý

• passport and driving licence informationÌý

• use of assistive technologyÌý

• internet protocol (IP) address and details of which operating system and web browser you useÌý

We’llÌýalso collect,ÌýstoreÌýand use certain special categories of more sensitive personal information such as:Ìý

• information about criminal convictions,ÌýallegationsÌýand offences, where relevant in relation to our functionsÌý

We are trialling artificial intelligence (AI) solutions to support the delivery of our functions, including the provision ofÌýadditionalÌýbusiness support information. Unless made expressly clear to you, we will not use AI to make or inform decisions about you. Unless made expressly clear to you, we will not use your personal data to train the large language models used by the AI ²õ´Ç±ô³Ü³Ù¾±´Ç²Ô²õ.Ìý

We will apply effective data minimisation techniques to all such uses of your data.Ìý

Why we need your dataÌý

The data you provide will be processed byÌýFWAÌýin order toÌýdeliver our statutory functions including:Ìý

• regulating our licensed sectorsÌýÌý

• supporting businesses and workersÌý

• regulating employment agenciesÌýand businessesÌý

• undertaking enforcement investigations under the Employment Rights Act 2025Ìý

• handling enquiries,ÌýcomplaintsÌýand reporting made to FWAÌý

• providing guidanceÌý

• delivering programmes and servicesÌý

• improving our services through feedbackÌý

• protecting our systems and detecting security issuesÌý

Other purposes which may be relevant (to be considered on a case-by-case basis) are to:Ìý

• gather feedback to improve our servicesÌý

• respond to any feedback you sendÌýus, ifÌýyou have asked us toÌý

• allow you to access government services and make transactionsÌý

• provide you with information about relevant servicesÌý

• monitor use of the site toÌýidentifyÌýsecurity threatsÌý

Lawful basis for processingÌý

Our lawful basis for processing your personal data is that the processing is necessary:Ìý

• to perform a task in the public interest (Article 6(1)(e) of the UK GDPR and section 8 of the Data Protection Act 2018Ìý

• for the exercise of our functions as a government departmentÌý

In 2021, ICO issued guidance clarifying that promotional messages issued by public sector organisations would not be classed as direct marketing if those promotional messages are necessary for the performance of a public task or function. In view of this clarification,ÌýFWAÌýrelies on the ‘public task’ lawful basis when sending promotional messages to carry outÌýFWA’s public tasks or functions. This is without prejudice to your right to object and to exercise other applicable rights available under the regulation. The full details of data subjects’ rights and how to contact us are provided below.Ìý

Contacting youÌý

We will use your personal information to respond to your enquiry or to provide the service you have requested.Ìý

We may also send you information about related services where this supports our public task. You can object to receiving these messages at any time, and details of your rights and how to contact us are provided below.Ìý

HowÌýwe obtain yourÌýpersonalÌýinformationÌýÌý

We collect personal information directly from you in circumstances such as:Ìý

• visiting our website, interacting with ourÌýtoolsÌýand using our digital servicesÌý

• creating a profile on ourÌýlicensing portalÌý

• through inspectionsÌýand enforcementÌýinvestigationsÌý

• populating our online forms and completing our surveysÌý

• when you download documents from usÌý

• any communications you make with us by phone, email, post, websites, social media or otherwise. We routinely record calls for quality,ÌýtrainingÌýand security purposes.ÌýÌý

• when you apply for a job with usÌý

• when you visit us at our buildings and premisesÌý

Information we may obtain about youÌý

In some cases, we carry out checks on organisations and key individuals to meet legal and regulatory requirements, protect public funds, and ensure we can safely deliver our services. These checks help us fulfil our duties in the public interest, protect our employees and assets, and comply with obligations such as trade control, anti-money laundering, and bribery and corruption laws.

To do this, FWA may undertake checks on existing or potential commercial clients, both beforeÌýentering intoÌýa contract and at intervals afterwards. We may verify information about key individuals associated with these organisations, such as directors, officers, sole traders,ÌýshareholdersÌýand other key stakeholders. We only collect and use the minimum information necessary and only where the law allows.Ìý

This processing is carried out under the Public Task lawful basis, as it supports FWA’s statutory functions and ourÌýobjectivesÌýto promote economic growth and support UK businesses (Article 6(1)(e) UK GDPR and section 8 of the Data Protection Act 2018). In some cases, where we are legally required to carry out specific checks, we will process personal data under the Legal Obligation lawful basis (Article 6(1)(c) UK GDPR).Ìý

As part of these checks, we may review:Ìý

• publicly available information about your company or business activitiesÌý

• government issuedÌýsanctions lists or blocklistsÌý

• media sources, including social mediaÌý

Where necessary andÌýpermittedÌýby law, we may also review information relating to suspected or actual criminal behaviour, criminalÌýrecordsÌýor related proceedings. This is done solely to ensure compliance with legal and regulatory requirements and only to the extent allowed under UK law and relevant overseas laws.Ìý

You have the right to object to processing carried out under the Public Task lawful basis at any time. If you wish to object, please contact us at dataprotection@fairworkagency.gov.uk.

Who weÌýshare your informationÌýwith

We may share your personal data with third parties where this is necessary to deliver our services or carry out our statutory functions. When we use third party data processors, they must follow our instructions and apply appropriate security measures. They are not permitted to use your personal data for their own purposes.

In addition to our processors, we may share your information with:Ìý

• government departments, publicÌýagenciesÌýor public bodiesÌý

• third partyÌýservice providers (where they act independently of us)Ìý

• event partners and sponsors when you register for one of our eventsÌý

• businesses or organisations as part of the services we provideÌý

• law enforcement agencies and regulatorsÌý

• the National Archives for archival purposesÌý

If we need to share your information with a third party not listed above, we’ll let you know unless we are prevented from doing so by law. Aggregated analysis of responses may also be shared with ICO, the Government Internal Audit Agency (GIAA)Ìýand the National Audit Office (NAO).Ìý

We also collect, use and share aggregated or statistical data that does not identify individuals. Although this data may be derived from personal data, it’s not considered personal data in law as it cannot directly or indirectly identify you. For example, we may aggregate usage data to understand how people useÌýparticular websiteÌýfeatures.Ìý

We rely on the Public Task lawful basis for sharing information where this supports our statutory functions. You may object to processing under this lawful basis at any time by contacting dataprotection@fairworkagency.gov.uk.

Where weÌýare required toÌýshare information toÌýcomply withÌýthe law such as responding to FOI or Environmental Information Regulations (EIR) requests, meeting regulatory obligations, or responding to court orders, we do so under the Legal Obligation lawful basis. Under this basis, some rights (including the rights to object,ÌýerasureÌýand portability) do not apply.Ìý

We will never sell or rent your personal data, nor share it with third parties for their own marketing purposes. We may also share your information if required by law or regulation, for example to prevent fraud or other crime.Ìý

How long we keep your dataÌý

In line with our records management and retention and disposal policy, we will onlyÌýretainÌýyour personal information for as long as:Ìý

• it’s needed for the purposes set out in this documentÌý

• the law requires us toÌý

Rights afforded to data subjectsÌý

Lawful basis: Public Task (Article 6(1)(e) of the UK GDPR)Ìý

Under the lawful basis of Public Task, whichÌýpermitsÌýprocessing necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in us, data subjects are afforded the following rights:Ìý

• Right to object. You have the right to object to the processing of your personal data at any time.Ìý

• Right to access. You have the right to request access to your personal data and obtain information about how it’s being processed.Ìý

• Right to rectification. You have the right to request the correction of any inaccurate or incomplete personal data.Ìý

• Right to restriction of processing. You have the right to request the restriction of processing of your personal data under certain circumstances, such as if you contest the accuracy of the data or object to the processing.Ìý

• Right to data portability. You have the right to receive your personal data in a structured, commonly used, and machine-readable format, and to request the transfer of this data to another controller, where technically feasible.

Lawful basis: Legal Obligation (Article 6(1)(c) of the UK GDPR)Ìý

Under the lawful basis of Legal Obligation, whichÌýpermitsÌýprocessing necessary toÌýcomply withÌýa legal requirement, data subjects are afforded the following rights:Ìý

• Right to access. You have the right to request access to your personal data and obtain information about how it’s being processed.Ìý

• Right to rectification. You have the right to request the correction of any inaccurate or incomplete personal data.Ìý

• Right to restriction of processing. You have the right to request the restriction of processing of your personal data under certain circumstances, such as if you contest the accuracy of the data or object to the processing.Ìý

PleaseÌýnote: under the lawful basis of Legal Obligation, data subjects do not have the following rights:Ìý

• Right to object. You do not have the right to object to the processing of your personal data.Ìý

• Right to erasure. You do not have the right to request the deletion of your personal data.Ìý

• Right to data portability. You do not have the right to request the transfer of your personal data to another controller.Ìý

If you have any questions or wish to exercise your rights, contact dataprotection@fairworkagency.gov.uk.

How we protect your data and keep it secureÌý

We are committed to doing all that we can to keep your data secure. We have set up systems and processes to prevent unauthorised access or disclosure of your data. For example, we protect your data using varying levels of encryption.ÌýWeÌýprocess your personal data and information securely by using suitable technical and organisational controls to prevent unauthorised processing and against accidental loss, misuse,ÌýdestructionÌýor damage.ÌýWe also ensure that any third parties keep all personal data they process on our behalf secure.Ìý

Contact usÌý

If you have any requests relating to your rights or have questions about this privacy policy and how we handle your personal information, you can contact our Data Protection Officer, at dataprotection@fairworkagency.gov.ukÌýÌý

You can also contact ICO for independent advice about data protection, privacy, and data-sharing issues.Ìý

Changes to this privacy policyÌý

We reserve the right to update this privacy policy at anyÌýtimeÌýand we will provide you with a new privacy policy when we make anyÌýsubstantialÌýupdates.Ìý

ConfidentialityÌý

Information provided while using this service, including personal information, may beÌýdisclosedÌýin accordance withÌýaccess to information regimes, primarily the Freedom of Information Act 2000 (FOIA).Ìý

If you want the information you provide to be treated confidentially, please be aware that,Ìýin accordance withÌýthe FOIA, public authoritiesÌýare required toÌýcomply withÌýa statutory code of practice that addresses obligations of confidence, among other things.