ERSM01000 - Data Protection
Source: gov.uk (2025-03-21)


HMRC will:
- process personal data under article 6(e) of the General Data Protection Regulation (GDPR) HMRC Privacy Notice (link is external) (https://eur03.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.gov.uk%2Fgovernment%2Fpublications%2Fdata-protection-act-dpa-information-hm-revenue-and-customs-hold-about-you%2Fdata-protection-act-dpa-information-hm-revenue-and-customs-hold-about-you&data=04%7C01%7Candy.harley%40hmrc.gov.uk%7C10dd56b997d4477e29e708d8a66c7c80%7Cac52f73cfd1a4a9a8e7a4a248f3139e1%7C0%7C0%7C637442332190780613%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C1000&sdata=cwnHgikgeQD4zGf1g9%2BwxaBujI7d2s52SAv9whp0KSI%3D&reserved=0)
- process special category data under article 9 of the GDPR and schedule 1 of the Data Protection Act (DPA) 2018 HMRC appropriate Policy document (link is external) (https://eur03.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.gov.uk%2Fgovernment%2Fpublications%2Fhmrc-appropriate-policy-document%2Fhmrc-appropriate-policy-document&data=04%7C01%7Candy.harley%40hmrc.gov.uk%7C10dd56b997d4477e29e708d8a66c7c80%7Cac52f73cfd1a4a9a8e7a4a248f3139e1%7C0%7C0%7C637442332190790569%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C1000&sdata=ZvOjhgc9KXcHXam%2FdMq1z1jAlJlPORWcdtklozbmdns%3D&reserved=0)
- retain personal data in line with the HMRC Records Management and Retention and Disposal Policy (link is external) (https://eur03.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.gov.uk%2Fgovernment%2Fpublications%2Fhmrc-records-management-and-retention-and-disposal-policy%2Frecords-management-and-retention-and-disposal-policy&data=04%7C01%7Candy.harley%40hmrc.gov.uk%7C10dd56b997d4477e29e708d8a66c7c80%7Cac52f73cfd1a4a9a8e7a4a248f3139e1%7C0%7C0%7C637442332190790569%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C1000&sdata=ZVZ8GpGKTINjCFs55gJVaqN6tkfEAOhBpVGdxInNoIo%3D&reserved=0)
Any sharing of personal data outside of HMRC will follow the:
- data sharing (link is external) (https://eur03.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.gov.uk%2Fgovernment%2Fpublications%2Fdata-protection-act-dpa-information-hm-revenue-and-customs-hold-about-you%2Fdata-protection-act-dpa-information-hm-revenue-and-customs-hold-about-you%23data-sharing&data=04%7C01%7Candy.harley%40hmrc.gov.uk%7C10dd56b997d4477e29e708d8a66c7c80%7Cac52f73cfd1a4a9a8e7a4a248f3139e1%7C0%7C0%7C637442332190800529%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C1000&sdata=PwdlgvyesC8E0pRzGsojxDZkD5oZ9KMJARL6%2BHOhXeM%3D&reserved=0) guidance within the HMRC Privacy Notice
- contracts and data sharing (link is external) (https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/accountability-and-governance/accountability-framework/contracts-and-data-sharing/) guidance published on the ICO website
- HMRC Information Disclosure Guide (link is external) (https://eur03.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.gov.uk%2Fhmrc-internal-manuals%2Finformation-disclosure-guide&data=04%7C01%7Candy.harley%40hmrc.gov.uk%7C10dd56b997d4477e29e708d8a66c7c80%7Cac52f73cfd1a4a9a8e7a4a248f3139e1%7C0%7C0%7C637442332190810486%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C1000&sdata=kMMxR3L3CS3KRSE8uAZR6wm%2FbkhcKl3oCYDHt6lWGOI%3D&reserved=0) available on GOV.UK