A print-friendly version of the following information is available to download DP/FS1 (PDF 37K).
The Data Protection Act (1998) requires organisations which process personal data to meet certain legal obligations. These are contained within the eight Data Protection Principles. HM Revenue & Customs (HMRC) is a data controller within the meaning of the Act and we process large volumes of personal data.
We collect information about you to help us to:
We may use information we hold about you:
If the law allows, we may give information about you to:
HMRC is a very large organisation, and carries out a wide range of different functions. Therefore, to help locate the information you want and deal with your request more quickly, you should make your DPA request to the HMRC office that you have been dealing with. You should address your request to the 'Data Protection Officer', and you must include enough details to enable us to verify your identity and locate the relevant information. For example, you should tell us:
To make sure we are providing information to the right person, we will check the details that you provide to us against your National Insurance number.
If you do not have a National Insurance number, you must send a copy of the back page of your passport or a copy of your driving license together with a copy of a recent utility bill.
The DPA requires that we comply with a request for information promptly and in any event within 40 days of receipt. HMRC will always try to provide a response within this timescale.
We will not charge you for dealing with a DPA request.
You can ask someone else to request information on your behalf, for example a friend, relative or solicitor. We must have your authority to do this. This is usually a letter signed by you stating that you authorise the person concerned to write to us for information about you, and/or receive our reply.
As well as making requests in writing, you can use this link to submit a request for National Insurance records, or to be given details about pay and/or employment history.
(Please note that you can only use this online facility to submit a request for your own information. If you are acting on behalf of another individual, you must submit your request in writing, by post or fax. You must include a mandate, which has been signed by the person to whom the information relates within six months of the submission date of your request.)
The law allows us to refuse your request for information in certain circumstances. For example, if you have previously made a similar request and there has been little or no change to the data since we complied with the original request.
The law also allows us to withhold information where, for example, release would be likely to
We will do our best to apply these conditions carefully, without damaging the effectiveness of our work, so that we can meet your requests as often as possible.
If you have requested details of the information we hold about you and you are not happy with our response, or you think we have not complied with the DPA principles in some other way, you can complain to us.
You should write to the office that provided the information to you, explaining why you are not satisfied. We will look into your complaint and will reply to you within ten working days.
If you are still not happy with our response, then you can ask the Information
Commissioner to assess whether we have contravened the Data Protection
Here is how you can contact the Information Commissioner:
You can find more information about your rights under the DPA by visiting the Information Commissioner (Opens new window) website, where you will also find HMRC's 'notification' under the DPA (Registration Number: Z9034158).