Information we hold about you - the Data Protection Act (DPA)

A print-friendly version of the following information is available to download DP/FS1 (PDF 37K).

Introduction

The Data Protection Act (1998) requires organisations which process personal data to meet certain legal obligations. These are contained within the eight Data Protection Principles. HM Revenue & Customs (HMRC) is a data controller within the meaning of the Act and we process large volumes of personal data.

Information we collect

We collect information about you to help us to:

  • collect tax, National Insurance contributions and Value Added Tax (VAT)
  • pay Tax Credits and Child Benefit
  • administer the National Minimum Wage
  • enforce import and export legislation.

How we use information we hold

We may use information we hold about you:

  • for one or more of our lawful functions
  • to check that your existing information is accurate
  • to compare it against other information to help combat fraud and crime
  • to verify an entitlement that you may have
  • to assist in the authentication of your identity.

Information we may give to others

If the law allows, we may give information about you to:

  • other government departments and similar bodies
  • the police and law enforcement agencies
  • the courts, on production of a valid court order
  • foreign tax and customs authorities.

Requesting information we hold about you

HMRC is a very large organisation, and carries out a wide range of different functions. Therefore, to help locate the information you want and deal with your request more quickly, you should make your DPA request to the HMRC office that you have been dealing with. You should address your request to the 'Data Protection Officer', and you must include enough details to enable us to verify your identity and locate the relevant information. For example, you should tell us:

  • your date of birth
  • previous or other name(s) you have used
  • your previous addresses in the past five years
  • personal reference number(s) that we may have given you, for example your National Insurance number, your tax reference number or your VAT registration number
  • what type of information you want to know.

To make sure we are providing information to the right person, we will check the details that you provide to us against your National Insurance number.

If you do not have a National Insurance number, you must send a copy of the back page of your passport or a copy of your driving license together with a copy of a recent utility bill.

The DPA requires that we comply with a request for information promptly and in any event within 40 days of receipt. HMRC will always try to provide a response within this timescale.

We will not charge you for dealing with a DPA request.

Asking someone else to make a DPA request on your behalf

You can ask someone else to request information on your behalf, for example a friend, relative or solicitor. We must have your authority to do this. This is usually a letter signed by you stating that you authorise the person concerned to write to us for information about you, and/or receive our reply.

Requesting information via the HMRC website

As well as making requests in writing, you can use this link to submit a request for National Insurance records, or to be given details about pay and/or employment history.

(Please note that you can only use this online facility to submit a request for your own information. If you are acting on behalf of another individual, you must submit your request in writing, by post or fax. You must include a mandate, which has been signed by the person to whom the information relates within six months of the submission date of your request.)

Is all information always released?

The law allows us to refuse your request for information in certain circumstances. For example, if you have previously made a similar request and there has been little or no change to the data since we complied with the original request.

The law also allows us to withhold information where, for example, release would be likely to

  • prejudice the prevention or detection of crime
  • prejudice the apprehension (arrest) or prosecution of offenders
  • prejudice the assessment or collection of any tax or duty
  • reveal the identity of another person, or information about them.

We will do our best to apply these conditions carefully, without damaging the effectiveness of our work, so that we can meet your requests as often as possible.

Putting things right

If you have requested details of the information we hold about you and you are not happy with our response, or you think we have not complied with the DPA principles in some other way, you can complain to us.

You should write to the office that provided the information to you, explaining why you are not satisfied. We will look into your complaint and will reply to you within ten working days.

If you are still not happy with our response, then you can ask the Information Commissioner to assess whether we have contravened the Data Protection Act 1998.

The Information Commissioner

Here is how you can contact the Information Commissioner:

  • Telephone 01625 545 745
  • Fax 01625 524 510.
  • Email the Information Commissioner
  • Write to
    The Information Commissioner
    Wycliffe House
    Water Lane
    Wilmslow
    Cheshire
    SK9 5AF.

You can find more information about your rights under the DPA by visiting the Information Commissioner (Opens new window) website, where you will also find HMRC's 'notification' under the DPA (Registration Number: Z9034158).