Data Protection

Last reviewed: 20 July 2026.

We handle personal information in line with the UK GDPR, the Data Protection Act 2018 and other applicable UK data protection rules. The Data (Use and Access) Act 2025 may change parts of the framework as its provisions take effect, so this page is reviewed when official guidance changes.

Our data protection principles

• Use information lawfully, fairly and transparently.
• Collect it for clear and legitimate purposes.
• Collect only what is adequate, relevant and necessary.
• Keep information accurate where it needs to be relied upon.
• Keep it no longer than necessary.
• Protect it against unauthorised access, loss or misuse.
• Be able to demonstrate responsible handling.

Public forms and sensitive information

Public forms are designed for first contact and deliberately avoid requesting detailed special-category information. Users and referrers are asked to keep messages brief. More sensitive information should be gathered later only through an appropriate staffed process and where a lawful basis and Article 9 condition have been identified.

Access, correction and deletion

Requests to exercise data protection rights can be made using the contact details in our Privacy Policy. We may ask for information needed to confirm identity. A request may be limited where a legal exemption, safeguarding responsibility or the rights of another person applies.

Breaches and concerns

Suspected loss, unauthorised access or misuse of personal information is assessed promptly. Where required, affected people and the Information Commissioner's Office are notified in accordance with applicable reporting duties.