Extended producer responsibility for packaging: privacy notice
Source: gov.uk (2025-08-29)

This privacy notice explains what personal data is collected through the extended producer responsibility for packaging service, including from producers, reprocessors, and exporters, and how that personal data is used

Extended Producer Responsibility (EPR) for packaging is a component part of wider Collection and Packaging Reforms (CPR) programme that will require certain producers of packaging to take greater responsibility for its disposal and recycling and secure the financial sustainability of the recycling industry. This privacy notice explains what personal data is being collected through the services (including ‘report packaging data’) provided under EPR for packaging and how that personal data is used.

If you have any queries about the content of this privacy notice, email:

xxx@xxx.xx (mailto:xxx@xxx.xx)

Who collects your personal data

The environmental regulators are joint controllers of personal data. These are:
- Environment Agency (EA)
- Natural Resources Wales (NRW)
- Northern Ireland’s Department for Agriculture and Rural Affairs (DAERA)
- Scottish Environment Protection Agency (SEPA)
Defra acts as the Scheme Administrator and is an independent controller of a subset of the personal data submitted by producers that is necessary for calculating disposal costs.

Defra also acts as a processor when operating the EPR for packaging digital services on behalf of the regulators and the Scheme Administrator.

If you need further information about how Defra uses your personal data and your associated rights, contact the Defra data protection manager at xxx@xxx.xx (mailto:xxx@xxx.xx)

The data protection officer for Defra is responsible for checking that Defra complies with legislation. You can contact the Defra data protection officer at xxx@xxx.xx (mailto:xxx@xxx.xx)

What personal data Defra collects

Depending on the services you use, Defra collects your:
- name
- contact details
- organisation name
- Internet Protocol (IP) address, and details of which version of web browser you used
- information on how you use the site, using cookies and page tagging techniques
- questions, queries, or feedback you leave
How this data will be used

We collect this data for the following purposes.

How environmental regulators will use your data

The environmental regulators will use your data to undertake their statutory monitoring role for EPR for packaging. This includes:
- approving or refusing a request to be an ‘approved person’ or someone with ‘delegated authority’
- tracking who has submitted organisation and packaging data.
- calculating recycling obligations
- assessing applications for registration and accreditation as packaging waste reprocessors or exporters
- monitoring of activities and trends in packaging and packaging waste markets
- carrying out compliance and enforcement activities
How the scheme administrator will use your data

The scheme administrator will use the data to:
- calculate fees where applicable, for example calculating the disposal cost obligations of producers
- issue invoices and manage incoming and outgoing payments
- calculate the grants payable to local authorities
- share data with a third-party organisation contracted to manage the invoicing of organisations for disposal cost obligations
- prevent and detect crime
- gather and respond to feedback aimed at improving our services
- monitor the performance and security of the online services
- process and respond to your complaint or data subject access request (DSAR)
- contact you to obtain further information
- inform you when a new document is available in your online account
How Defra will use your data

Defra will use your data:
- to invite you to join one or more services
- so that you can set up an account and access those services
- so the scheme administrator can contact you about those services
- to contact you about your submission
- to inform you when a new document is available in your online account
Data obtained from third parties

Depending on the services you use, Defra obtains your personal data from:
- one or more of the environmental regulators
- your representative
- a local authority
- the Ministry of Housing, Communities and Local Government
- publicly available sources
Lawful basis for processing your personal data

The lawful basis for processing your personal data is that it is necessary to:
- perform a task in the public interest as part of EPR for packaging
- do work as a government department under EPR for packaging
Legislation that supports this basis

The processing of personal data is primarily supported by the Producer Responsibility Obligations (Packaging and Packaging Waste) Regulations 2024 (https://www.legislation.gov.uk/uksi/2024/1332/contents/made), which apply across all UK nations.

Prior to these regulations coming into force, each nation implemented data collection regulations in 2023, which have now been revoked. Data collected under those regulations may continue to be processed under the 2024 framework.

Consent to process your personal data

The processing of your personal data is not based on consent. You cannot withdraw it.

Sharing your personal data

We will share the personal data collected under this privacy notice with the environmental regulators. We do this to deliver services as part of EPR for packaging.

The environmental regulators are controllers in their own right. You can learn more about how your personal data is processed by reading the environmental regulators’ joint privacy notice (https://npwd.environment-agency.gov.uk/Public/Guidance.aspx?CategoryId=ad749427-9848-41a6-9d8e-ddf142e98720&ReturnUrl=%2fPublic%2fNewsAndGuidance.aspx).

We will publish a public list of large producers (PLLP) in accordance with legislation in each nation and subsequent amendments.

Defra respects your personal privacy when responding to access to information requests. We only share information when necessary to meet the statutory requirements of the Environmental Information Regulations 2004 and the Freedom of Information Act 2000.

How long Defra holds personal data for

We will keep your personal data for 7 years in line with the requirements of the EPR for packaging, except data related to Invoicing activities which will be retained for 11 years.

What happens if you do not provide the personal data

You will not be able to use EPR for packaging digital services.

Use of automated decision-making or profiling

The personal data you provide is not used for:
- automated decision making (making a decision by automated means without any human involvement)
- profiling (automated processing of personal data to evaluate certain things about an individual)
Transfer of your personal data outside of the UK

If Defra needs to transfer your personal data outside the UK, we will only do so to countries deemed adequate for data protection purposes, and only where necessary for regulatory or technical reasons.

Your rights

Based on the lawful processing above, your individual rights are:
- the right to be informed
- the right of access
- the right to rectification
- the right to restrict processing
- the right to object
- rights in relation to automated decision making and profiling
Find out more about your individual rights (https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/individual-rights/individual-rights/) under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018 (DPA 2018).

Complaints

You have the right to make a complaint to the Information Commissioner’s Office (https://ico.org.uk/make-a-complaint) at any time.

Defra’s personal information charter

Defra’s personal information charter (https://www.gov.uk/government/organisations/department-for-environment-food-rural-affairs/about/personal-information-charter) explains more about your rights over your personal data.

Updates

This privacy notice will be reviewed regularly and updated to reflect changes in legislation, services, or data processing activities