Privacy notice for applicants, advisers and complainants
Source: gov.uk (2025-09-15)

This is an explanation of how we process personal data.

1. Applications

If you want to submit an application to the IAA, you will need to do this online using the IAA’s online forms system.

In order access these forms, you will first need to create a Government One Log-In Account. This is a system that is administered by the Cabinet Office and acts as a gateway to the IAA online forms system.

Creating a Government One Log-In Account is a separate process. Details of how this process works and how your data is used is in the Cabinet Office’s privacy notice which can be found at Privacy notice - GOV.UK One Login (account.gov.uk) (https://signin.account.gov.uk/privacy-notice).

When logging in to access the IAA online application form, we will verify your identity using your name. If you are not able to log in after that then we will ask for your date of birth. If this also fails, we will ask you for your National Insurance number.

All of this information would have already been provided when you initially signed up for a Government One Log-In Account.

Once you have logged in and selected the correct IAA Webform for your purposes, please complete the form.

You will need to make an online payment of the IAA application fee(s) as part of completing your IAA Webform. This will be done using a service known as GOV.UK Pay. This is a separate process from the IAA online forms system. For further detail as how this works, please click here (#finance).

For further information on how GOV.UK Pay use your data, please go to Privacy notice – GOV.UK Pay (payments.service.gov.uk) (https://www.payments.service.gov.uk/privacy/#:~:text=This%20privacy%20notice%20explains%3A,in%20relation%20to%20your%20data).

What personal data do we process?

When applying for registration you must provide us with:

data relating to the organisation

data relating to the individual advisers

To find out more about what data we process about organisations please click here (#annex-a).

To find out more about what data we process about advisers please click here (#annex-b).

To find out more about what data we process about owners and trustees please click here (#annex-c).

Why do we process your personal data?

Under section 83(5)(a) of the Immigration and Asylum Act 1999 (as amended), we have a statutory duty to ensure that those who provide immigration advice and/or services are fit and competent to do so.

Therefore, if you are applying for initial registration, adding a new adviser, applying to change your level of registration, we must assess your fitness and competence at the level you have applied for.

Under Schedule 6, paragraph 2 of the Immigration and Asylum Act 1999 (as amended), you must be registered if we consider you are fit and competent to provide immigration advice and/or services.

Also, under Schedule 6, paragraph 3 of the Immigration and Asylum Act 1999 (as amended), we determine intervals where a person must submit an application for their registration to be continued. You must apply every year for us to continue your registration. You will be reminded at the time as to when you must submit a continuing registration application.

We will continue your registration only if you are fit and competent to provide immigration advice and/or services.

We must therefore process your data in the following ways to determine and ensure that you are fit and competent to provide immigration advice and/or services.

Therefore, as a public body, it is necessary for us to process your data in the following ways for the exercise of official authority vested in us (Article 6 GDPR).

As part of your application, we will process special category data (Article 9 GDPR). The processing of this data is necessary for reasons of substantial public interest, as the Immigration and Asylum Act 1999 (as amended) imposes a statutory duty on us to ensure that those who provide immigration advice and/or services are fit and competent to do so.

Processing this data forms part of our assessment as to whether you are fit and competent to provide immigration advice and/or services.

Some declarations in the application form relate to criminal convictions. As such, we are effectively processing personal data relating to criminal convictions and offences (Article 10 GDPR).

Some applications also require a DBS check for every applicant as part of the application process. As such, this is also considered processing personal data relating to criminal convictions and offences (Article 10 GDPR).

The processing of this data is necessary for reasons of substantial public interest, as the Immigration and Asylum Act 1999 (as amended) imposes a statutory duty on us to ensure that those who provide immigration advice and/or services are fit and competent to do so.

Processing this data forms part of our assessment as to whether you are fit to provide immigration advice and/or services.

How do we process your personal data?

Your data is provided to us when you submit your completed application form. Once you submit the completed form to us, our case management system is updated accordingly.

To find out more about how we retain data please click here (#retention).

Sharing your data outside the IAA:

HJT Training Limited

If you are applying for initial registration, applicant names, dates of birth and email addresses are shared with HJT Training Limited who facilitate the IAA competence assessments.

Your data will be shared with them so that they can enter you into the relevant IAA competence assessment, issue you with your candidate number and issue you with your assessment results.

The purpose for sharing this data is to enter you into our competence assessments process. Sitting the competence assessments are a way in which we assess your competence to provide immigration advice and/or services at the level you have applied for.

Disclosure and Barring Service

Your personal data will be shared with DBS so that they can do the necessary checks on you to verify whether you have any unspent convictions, cautions, reprimands, warnings, etc.

The purpose of this is to verify that what you have declared in your application form is true and to ensure that you are fit to provide immigration advice and/or services.

Home Office

The IAA will conduct vetting checks on you and your organisation to ensure you are fit and competent to provide immigration advice and/or services.

As part of this your name, organisation’s name and address, adviser’s name, date of birth, Home Office reference number(s) and the information from the declarations in the application form will be shared with the Home Office.

This will also include the Home Office checking whether you are permitted to stay and work in the UK.

To find out more about how we handle data within the IAA please click here (#datainsidetheiaa).

Other organisations

If you are declaring to be a solicitor, barrister and/or member of CILEx, your personal data will be shared with the SRA, BSB and CILEx to verify this.

We will also share your data with any other organisation(s) where we deem it necessary, appropriate and reasonable to do so, taking into account all the circumstances.

Declarations

If you have answered ‘Yes’ to any of the declarations, your data will be shared with external organisations to verify your answer.

An example of this is if you declare you have been involved in the running of any other business or are employed at another organisation, we will contact this organisation to verify your answer.

Section 93 Immigration and Asylum Act 1999 (as amended)

There is nothing preventing a person from giving us information that is necessary for the discharge of our functions (i.e. to determine whether you are fit and competent).

Therefore, when we request information from other organisations to determine whether you are fit and competent, they can give us any information that is necessary for us to do so.

Draft applications

Please note that the IAA can view draft applications as soon as they are started. The reason for this is so that we can provide any technical assistance and/or general assistance to applicants completing their application. The IAA can see all the data you have inputted on to your electronic application form as soon as you have inputted it. This means that the IAA can view all of your data you have entered into your application even before you submit it.

The IAA applications portal keeps detailed logs all the applications that have been started and the data contained therein. These logs are retained for a minimum of one year. We will store specific logs for longer for any of the following reasons:
- for the prevention, investigation, detection or prosecution of criminal offences
- for the purpose of, or in connection with, legal proceedings (including prospective legal proceedings)
- for the purpose of obtaining legal advice or otherwise establishing, exercising or defending legal rights
- for any other purpose permissible in law
When deciding whether to retain a log/logs for longer than one year, the IAA will consider all the circumstances.

The IAA will continue to process all of your personal data (and the personal data noted above) for both regulatory and law enforcement purposes in accordance with this privacy notice.

2. Complaints

When you send us a compliant about an adviser and/or organisation you should use our complaints form.

What personal data do we process?

To find out more about what data we process about complaints please click here (#annex-d).

Why do we process your personal data?

Under Schedule 5, paragraph 5(1) of the Immigration and Asylum Act 1999 (as amended), we must have a complaints scheme to investigate complaints. We must investigate complaints regarding:

an adviser’s/organisation’s fitness or competence

an alleged breach of the Code of Standards

Members of the public can also make a complaint about unregistered people/organisations providing or advertising the provision of immigration advice and/or services unlawfully. These complaints will be passed on to the relevant team who will process the data for the prevention, investigation, detection or prosecution of criminal offences.

As part of our complaint investigation, we will consider all the evidence available to us to reach an informed decision as to whether the complaint has been substantiated.

Therefore, as part of our investigation, we must process your personal data and the personal data of third parties.

Therefore, as a public body, it is necessary for us to process your data in the following ways for the exercise of official authority vested in us (Article 6 GDPR).

As part of the complaint investigation, we will process special category data (Article 9 GDPR). The processing of this data is necessary for reasons of substantial public interest, as the Immigration and Asylum Act 1999 (as amended) imposes a statutory duty on us to investigate relevant complaints, such as those listed above.

Processing your data forms part of our assessment as to whether the complaint is substantiated.

We will also process data relating to criminal convictions, but only if the complaint case file states that a party involved in the case has a criminal conviction(s), warning(s), reprimand(s), etc. This would be considered as processing personal data relating to criminal convictions and offences (Article 10 GDPR).

The processing of this data is necessary for reasons of substantial public interest, as the Immigration and Asylum Act 1999 (as amended) imposes a statutory duty on us to investigate relevant complaints, such as those listed above.

How do we process your personal data and third-party personal data?

Your data and third-party data is provided to us whenever you provide us with information about your complaint or when evidence is provided to us.

Your complaint form and any evidence in relation to the complaint will be stored on our case management system.

To find out more about how we retain data please click here (#retention).

Data will also be collected and processed from the complainant’s file. This is the file that the adviser has on the complainant.

To find out more about what data we process from the complainant’s case file please click here (#annex-e).

Sharing your data outside the IAA:

Home Office

Your name, date of birth and Home Office reference number will be shared with the Home Office if part of the complaint requests us to check the status of your immigration application.

The Home Office provides us with information regarding whether an adviser/organisation is regulated to provide immigration advice and/or services.

3. Audits

We conduct audits to regularly assess whether the work being done by the adviser/organisation is fit and competent.

What personal data do we process?

We examine case files selected by us to assess the quality of work being done. We determine whether the work that has been done is to a fit and competent standard. We also make any suggestions for improvement.

To find out more about data we process from audits please click here (#annex-f).

Why do we process your personal data?

Under section 83(5)(a) of the Immigration and Asylum Act 1999 (as amended), we have a statutory duty to ensure that those who provide immigration advice and/or services are fit and competent to do so.

Our audits procedure allows us to inspect the work being done by advisers/organisations and make an informed decision as to whether an adviser/organisation is fit and competent to provide immigration advice and/or services.

We must process your data in the following ways to determine and ensure that you are fit and competent to provide immigration advice and/or services to the necessary standard.

Therefore, as a public body, it is necessary for us to process your data in the following ways for the exercise of official authority vested in us (Article 6 GDPR).

As part of the audit, we will process special category data by conducting the case file reviews (Article 9 GDPR).

The processing of this data is necessary for reasons of substantial public interest, as the Immigration and Asylum Act 1999 (as amended) imposes a statutory duty on us to ensure that those who provide immigration advice or immigration services are fit and competent.

Processing your data forms part of our assessment as to whether you are fit and competent to provide immigration advice and/or services.

We will also process data relating to criminal convictions when we audit case files, but only if the audit case file states that a party involved in the case has a criminal conviction(s), warning(s), reprimand(s), etc. This would be considered as processing personal data relating to criminal convictions and offences (Article 10 GDPR).

The processing of this data is necessary for reasons of substantial public interest, as the Immigration and Asylum Act 1999 (as amended) imposes a statutory duty on us to ensure that those who provide immigration advice or immigration services are fit and competent.

How do we process your personal data and third-party personal data?

When we arrange an audit we use the personal data we store about you to schedule an audit. For example, we contact you using the email address and contact number you have provided to us and schedule the audit to take place either remotely or at your business address.

Personal data is also collected when auditing case files. We process personal data contained in those case files. This is the data you have on your client.

In some cases, this will also include the personal data of third parties, such as your client’s family members.

The facts of every case will be different, so the personal data that will be on the file will be different. As such, the personal data we process will be different for every case file we audit.

For further detail on what data we process from a case file please click here (#annex-f).

Our findings from an audit will be consolidated into an Identified Issues Report. This will be stored on our case management system.

To find out more about how we retain data please click here (#retention).

4. Data Inside the IAA

Knowledge & Intelligence:

Your personal data will be shared with the relevant team inside the IAA so that they can do any necessary checks to verify whether there are any concerns with your fitness to provide immigration advice, namely your character.

The relevant team will record, task and disseminate any data gathered to select teams and individuals within the IAA. Information shared internally will be used to help identify any issue(s) or potential issue(s) with the adviser’s/organisation’s fitness and competence.

The relevant team will request an applications list from the Home Office. This is a complete list of all the applications you/your organisation has submitted to the Home Office.

The relevant team will process your data, including sharing your data with other law enforcement agencies, such as the police, for the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties.

Data that will be shared with other law enforcement agencies include your name, your organisation’s name, your address and post code, your organisation’s address and post code, your date of birth, any Home Office reference numbers and any information given to us from the declarations in your past application forms.

Under section 93 of the Immigration and Asylum Act 1999 (as amended), there is nothing preventing a person from giving us information that is necessary for the discharge of our functions (i.e. to determine whether you are fit and competent).

Therefore, when we request intelligence from other organisations to determine whether you are fit and competent, they can give us any information that is necessary for us to do so.

Investigations:

The relevant team will process personal data for the purposes of the prevention, investigation, detection or prosecution of criminal offences.

Legal:

The relevant team will have regular access to your personal data on the case management system and will process your personal data for the purpose and in connection with any legal proceedings or prospective legal proceedings.

Under section 93 of the Immigration and Asylum Act 1999 (as amended), there is nothing preventing a person from giving the First-tier Tribunal information which is necessary for the discharge of its functions (i.e. making decisions of any appeals lodged).

As such, if you decide to appeal a decision made against you, the relevant team will disclose your personal data to the Tribunal over the course of the legal proceedings.

The relevant team will only process personal data that is relevant to the proceedings, such as the data regarding an application, audit and/or complaint.

The relevant team also provide overall support to caseworkers and advise them whenever their advice is sought on whether an adviser is fit and competent to provide immigration advice and/or services. To do this, the relevant team will process your data (examine the data) to help them form their advice.

Finance:

When you make payment on our online forms system using GOV.UK Pay, all transactions will be facilitated by GOV.UK Pay. This is a separate process from the IAA. The only data stored on our case management system from the transaction is the card type and card brand that was used. The relevant team will have access to the information thy need in order to issue you with a refund if necessary.

For further information on how GOV.UK Pay use your data, please go to Privacy notice – GOV.UK Pay (payments.service.gov.uk) (https://www.payments.service.gov.uk/privacy/#:~:text=This%20privacy%20notice%20explains%3A,in%20relation%20to%20your%20data).

HR:

If you make a complaint against a member of IAA staff, it will be investigated by the HR department.

HR have regular access to our case management system. If you are an adviser or an applicant adviser and make a complaint against a member of IAA staff, HR will have access to your personal file on our case management system.

IT:

IAA data, including data on our case management system is backed up for the purposes of disaster resilience.

5. Retention

We hold personal data for a period of six years. After this the personal data is securely destroyed.

We only store data for longer than this:

for the prevention, investigation, detection or prosecution of criminal offences

for the purpose of, or in connection with, legal proceedings (including prospective legal proceedings)

for the purpose of obtaining legal advice or otherwise establishing, exercising or defending legal rights

When deciding whether to retain the data for the above purposes, we consider all the circumstances and evidence before us.

This includes the history between the IAA and an adviser/organisation.

6. The IAA’s use of Artificial Intelligence

The IAA will use Artificial Intelligence (AI) solutions to assist in the discharge of its regulatory and business functions. The IAA will only use safe, secure and reputable AI solutions, such as, but not limited to, Microsoft Copilot.

In respect of the IAA’s regulatory scheme and the personal data that the IAA processes for applicants, advisers and complainants as detailed in this privacy notice, the IAA does not make any decisions based solely on automated processing. When considering applications, investigating complaints and conducting audits, the IAA will use AI as an assistive tool. All decisions will be made by members of IAA staff, and the decision-making process will continue to have meaningful human involvement.

Please note that the use of AI as an assistive tool does not affect the lawful basis for which the IAA processes your personal data as explained in this privacy notice.

The IAA will remain responsible and accountable for the decisions it makes, with AI only being used to assist staff.

Your personal data will continue to be processed in line with this privacy notice.

7. Your Rights

As a data subject, you have the following rights:

to be informed of how we process your personal data

subject access

rectification

erasure

restriction

portability

objection

Under GDPR there are also rights attached to the automated individual decision-making (i.e. profiling). However, we do not process your data using automated decision-making means.

Exercise Your Rights

If you choose to exercise your rights, please contact the IAA Information Officers who will take the necessary steps. They can be contacted on xxx@xxx.xx (mailto:xxx@xxx.xx).

Rights You Cannot Exercise

The reason we process personal data, as explained in this notice, is because it is necessary for the exercise of official authority vested in us. This is our lawful basis.

Our lawful basis affects certain rights that you can exercise. If you want to restrict or object to how we process your data, we will not be able to consider your application, as all of our processing activities are done to ensure you are fit and competent to provide immigration advice and/or services.

How do I complain about information security?

In the first instance, you can email the Data Protection Officers to submit a complaint. The DPOs will investigate the matter and respond to you by email.

If you are not satisfied with the response, you can submit a complaint to the ICO on their website (https://ico.org.uk/).

8. Who is the Data Controller?

The Data Controller is the IAA:

Immigration Services Commissioner

Immigration Advice AuthorityPO Box 567DartfordKentDA1 9WX

Telephone: xx-xxxx-xxxx

9. Who are the Data Protection Officers?

Details regarding the IAA’s Data Protection Officers are available upon request and can be obtained via our online Portal (https://portal.immigrationadviceauthority.gov.uk/s/general-enquiries).

10. Publishing

Under section 83(6)(a) of the Immigration and Asylum Act 1999 (as amended), we must arrange for the publication, in such form and manner and to such extent as we consider appropriate, of information about our functions and about the matters falling within the scope of our functions.

Under sections 91 and 92 of the Immigration and Asylum Act 1999 (as amended), it is a criminal offence to offer, advertise and/or provide unregulated immigration advice and/or services.

As part of our functions, we investigate and prosecute these offences. Therefore, as a public body, it is necessary for us to process your data in the following ways for the exercise of official authority vested in us (Article 6 GDPR).

We will publish details of ongoing criminal prosecutions and warrants on our website, including information relating to:

The defendant’s name, age and regional location

An update on the criminal proceedings

The purpose for publishing this data are for statutory purposes, to safeguard vulnerable advice-seekers and to prevent any further provision of unregulated immigration advice and/or services.

Under section 85 of the Immigration and Asylum Act 1999 (as amended), the IAA is required to prepare and maintain a register of registered IAA immigration advisers. Pursuant to paragraph 6 of Schedule 6 to the Immigration and Asylum Act 1999 (as amended), this register must be available for inspection by members of the public. This register will contain names of registered advisers, organisations, IAA reference numbers, level of registration, the organisation’s website and whether it is a fee charging or non-fee charging organisation. As this register is required by statute, it is necessary for us, as a public authority to process your data in the following ways for the exercise of official authority vested in us (Article 6 GDPR).

The IAA also has a tool known as Adviser Finder. This will contain organisation names, its website, email address and contact number, and whether it is a fee charging or non-fee charging organisation. We will only publish your data on Adviser Finder if you have given us your consent to do so (Article 6 GDPR).

Under section 89(9) of the Immigration and Asylum Act 1999 (as amended), the IAA must keep a public register of individuals who are subject to a direction issued by the Tribunal under section 89(8) of the Immigration and Asylum Act 1999 (as amended).

ANNEX A: Data we process about organisations

We process data relating to the organisation. This includes:

the organisation’s name, address and contact details

the organisation’s legal status

the organisation’s Companies House/charity registration number

the organisation’s bank details

the organisation’s IAA registration number

what IAA Level the organisation are registered at and permitted to work at

the IAA categories they are permitted to work at (i.e. Immigration and/or Asylum & Protection)

whether the organisation is a fee charging organisation or a non-fee charging organisation

the name(s) of the advisers working at the organisation

data of advisers working or who have worked at the organisation. For more detail on what data we process relating to adviser please click here.

ANNEX B: Data we process about advisers

We process data relating to the advisers of the organisation. This data includes:

Adviser details:

their name, previous name(s), title, gender, date and place of birth, nationality and contact details

their employment status at the organisation

their NI number

their employment history

their previous employer’s details which includes:

the organisation’s name, address and contact details

their job title whilst employed there

the organisation’s overseeing regulatory body

the dates they were employed by the organisation

details of their training and qualifications

whether they currently employed or own/work in any other business

copies of their identity (such as passports, identity cards, etc.)

Information about an adviser’s ability to work in the UK:
- whether they are subject to restrictions on their residence in the UK or permission to work in the UK
Information about an adviser’s financial background:

whether they have ever been declared bankrupt

whether they have been disqualified or banned from being a director of a company

whether they have ever been disqualified as acting as a charity trustee

Information about an adviser’s IAA registration:

their IAA registration number

what IAA Level they are registered at

the IAA categories they are permitted to work at (i.e. Immigration and/or Asylum & Protection)

whether you work for a fee charging organisation or a non-fee charging organisation

the name(s) of the organisation(s) the adviser works for and has worked at

address of the organisation(s) the adviser works at or has worked at

Data we already have on you:

If you are or have been in the IAA scheme before and we hold data on you. That data will be used to consider whether you are fit and competent to provide immigration advice and/or services, along with any new data you have provided to us.

This includes data collected from previous audits and any investigated complaints made against you.

To find out more about what data we process from audits please click here (#annex-f).

To find out more about what data we process about complaints please click here (#annex-d).

Information about an adviser’s character:

whether they have convictions, cautions, reprimands or final warnings that are not “protected” as defined by the Rehabilitation of Offenders Act 1974 (Exceptions) Order 1975 (as amended in 2013)

whether they have been or currently are subject to any criminal proceedings in the UK or abroad

information contained on an adviser’s DBS Disclosure Certificate (standard check)

whether they have been subject to any adverse finding or settlement in civil proceedings

whether they have been dismissed or asked to resign and resigned from employment or from a position of trust, fiduciary appointment or similar position

whether they have traded under a different name or been known by a different name in the last 5 years

whether they are currently regulated by or have previously been regulated by the IAA

whether they have/are a member of a professional body in the UK or abroad

whether they have been or are subject to any existing/previous disciplinary proceedings by other regulatory authorities or professional bodies in the UK or abroad

whether they or any business with which they have been an owner or manager has been subject to any substantiated complaint relating to regulated activities

whether they or any business with which they have been involved have ever been refused the right to carry out a trade, business or profession requiring a licence or other authority

whether they or any business with which they have been involved have ever had this authorisation revoked, withdrawn or terminated, or have been expelled by a regulatory or government body

whether they or any business that they have been involved has been investigated, disciplined, censured or suspended or criticised by a regulatory or professional body, a Court or Tribunal (publicly or privately)

whether they have been a barrister, solicitor, advocate or a member of CILEx, or supervised by one of the above

whether they have ever been subject to disciplinary action or intervention by a Designated Professional Body or Designated Qualifying Regulator or overseas body equivalent

whether they are prohibited by The Law Society’s Rules or equivalent from being employed as a solicitor’s clerk

whether they have been sued by a client or made a claim on their Professional Indemnity Insurance in the last 5 years

whether they have ever been involved in any conduct that may call into question their honesty, integrity or respect for the law

ANNEX C: Data we process about owners and trustees

We process data relating to the owner(s)/manager(s) or trustees of the organisation or charity. This includes:

their name(s)

their date(s) of birth

their title(s)

their nationality

their role(s) and position(s) within the organisation

details of any shares held

whether they have traded under a different name or been known by a different name in the last 5 years

whether they are involved in the running of any other business or employed at any other organisation

whether they have ever been involved in any conduct that may call their honesty, integrity or respect for the law into question

Owners’ character:

whether they have any unspent criminal convictions in the UK or abroad

whether they are currently subject to any criminal proceedings in the UK or abroad

whether they are subject to, or ever been, subject to disciplinary proceedings by regulatory/professional bodies in the UK or abroad

Owners’ financial background:

whether they have been a director of a company or member of an LLP that has been subject to a winding up order, an administrative order or administrative receivership, or entered into a voluntary arrangement under the Insolvency Act 1986, or whether the company has been wound up or put into administration in circumstances of insolvency

whether they have been declared bankrupt or entered into an individual voluntary arrangement or a partnership voluntary arrangement under the Insolvency Act 1986

whether they have ever been disqualified or banned from being a director of a company or from acting as a charity trustee

ANNEX D: Data we process about complaints

When submitting a formal complaint, the complainant must provide us with their personal data in accordance with our complaints scheme.

Details of the complainant:

their name, date of birth, address, email address and contact numbers

name, date of birth, address, email address and contact numbers of person who submits the complaint on behalf of the complainant

Details of adviser and/or organisation they are complaining about:
- adviser and/or organisation’s name, address, email address and contact numbers
Details of the complaint:

whether the complaint has been reported to any other agencies and details of the other agencies’ investigation

facts of the complaint, including information from any work undertaken by the adviser/organisation (i.e. the complainant’s case file)

For further detail on what data we process from the complainant’s case file please click here (#annex-e).

ANNEX E: Data we process from a complainant’s case file

If you make a complaint about the work undertaken by an adviser/organisation, as part of our investigation, we will request your case file(s) from the adviser/organisation to examine the work done on the file.

For example, if your complaint is about an adviser who did work on your asylum application and you allege that they did this work incompetently, we will request your case file. A complaints caseworker will then review the file and determine whether the work was done incompetently.

By doing this we are processing the data contained in your case file.

Your case file will in most cases contain personal information relating to third parties. This can be family members, witnesses or unmarried partners.

Every case file is different and the data processed from a case file will be different in every investigation.

Below is a list of all the data that we can process from a case file (your data and third party data).

Data from case file (yours and third parties):

This data will mainly come from any attendance notes, applications, submissions or representations contained in the case file.

facts of the case

date and place of births

names and previous names/identities

addresses and previous addresses

gender and sexual orientation

nationality and any other nationality/citizenships held

addresses and contact numbers

passport number, place of issue, issuing authority, date of issue, date of expiry

language(s) familiar with

NI numbers

BRP numbers

Home Office and/or Case ID reference numbers

immigration history

details of education, employment history and tax history (including details of payments made to HMRC)

relationship history including details of previous partners (name and date of birth), date and place of marriage and date of divorce

details of any children and/or parental responsibility arrangements

details of nature and dependency child has on client

details any visits to any other countries and time spent outside of UK

details of residency outside of UK

history relating to claiming any welfare benefit

details of living arrangements including number of rooms, people living there and whether it is rented or mortgaged

details of any business interests outside of the UK

details of any property owned in and outside of the UK

details regarding annual/monthly income

details of any employment benefits/arrangements

details of any court judgments/civil penalties

details of registered GP

bank details contained in application forms (business accounts and individuals’ accounts and any joint holder accounts)

name and address of any joint account holders

name and address of any person providing financial support

information relating to the complainant’s racial/ethnic origins, political opinions, religious beliefs, trade union membership(s), physical/mental conditions, sexual life

information relating to the commission or alleged commission of any criminal offence, the proceedings for the commission or alleged commission of a criminal offence

information (as above) relating to children

information (as above) relating to family members, unmarried partners, dependents (adult or child), sponsors, or anyone else mentioned in the complainant’s case file(s)

copies of any documents that are held on the case file. This can include copies of:

photographs

passports

BRPs

driving licences

national ID cards

travel documents

bank statements

payslips

certificates

marriage certificates

correspondence (emails, letters, attendance notes/minutes)

mortgage/rent agreements and other financial agreements

contracts

birth certificates

bills and invoices

police registration certificates

Under the IAA Code of Standards, in the client care letter, advisers usually confirm to their clients that they are regulated by us and that we have the power to examine the client’s file.

ANNEX F: Data we process from an audit

Data processed from case file (yours and third parties):

This data will mainly come from any attendance notes, applications, submissions or representations contained in the case file.

facts of the case

date and place of births

names and previous names/identities

addresses and previous addresses

gender and sexual orientation

nationality and any other nationality/citizenships held

addresses and contact numbers

passport number, place of issue, issuing authority, date of issue, date of expiry

language(s) familiar with

NI numbers

BRP numbers

Home Office and/or Case ID reference numbers

immigration history

details of education, employment history and tax history (including details of payments made to HMRC)

relationship history including details of previous partners (name and date of birth), date and place of marriage and date of divorce

details of any children and/or parental responsibility arrangements

details of nature and dependency child has on client

details any visits to any other countries and time spent outside of UK

details of residency outside of UK

history relating to claiming any welfare benefit

details of living arrangements including number of rooms, people living there and whether it is rented or mortgaged

details of any business interests outside of the UK

details of any property owned in and outside of the UK

details regarding annual/monthly income

details of any employment benefits/arrangements

details of any court judgments/civil penalties

details of registered GP

bank details contained in application forms (business accounts and individuals’ accounts and any joint holder accounts)

name and address of any joint account holders

name and address of any person providing financial support

information relating to the complainant’s racial/ethnic origins, political opinions, religious beliefs, trade union membership(s), physical/mental conditions, sexual life

information relating to the commission or alleged commission of any criminal offence, the proceedings for the commission or alleged commission of a criminal offence

information (as above) relating to children

information (as above) relating to family members, unmarried partners, dependents (adult or child), sponsors, or anyone else mentioned in the complainant’s case file(s)

copies of any documents that are held on the case file. This can include copies of:

photographs

passports

BRPs

driving licences

national ID cards

travel documents

bank statements

payslips

certificates

marriage certificates

correspondence (emails, letters, attendance notes/minutes)

mortgage/rent agreements and other financial agreements

contracts

birth certificates

bills and invoices

police registration certificates

Under the IAA Code of Standards, in the client care letter, advisers usually confirm to their clients that they are regulated by us and that we have the power to examine the client’s file.