House of Commons privacy notice for the public

In this privacy notice, references to ‘we’, ‘our’ or ‘us’ are to the House of Commons. Everything that we do with your personal data – for example, collecting, storing, using, sharing or deleting it – is referred to as ‘processing’.

Please note that Members of Parliament (MPs) are separate controllers for the purposes of data protection legislation. This notice only applies to personal data which is processed by the House of Commons. For personal data processed by MPs, please contact the relevant Member directly. Similarly, the House of Lords is also a separate controller: https://www.parliament.uk/site-information/data-protection/lords-data-protection-information/.

This notice will be reviewed periodically and, if necessary, updated.

Other privacy notices may also apply when you engage directly with certain services. These will be provided directly by the service area and will explain how personal data is used in relation to specific circumstances (for example, in the cases of email and subscription services or e-petitions).

About us

The Corporate Officer of the House of Commons (a role performed by the Clerk of the House) is the controller of any personal data processed as described in this privacy notice.

The House of Commons Data Protection Officer is the Head of Information Compliance. Contact details for them can be found at the end of this notice.

In some instances, we process personal data jointly with the House of Lords. In these cases, the Corporate Officer of the House of Commons and the Corporate Officer of the House of Lords (a role performed by the Clerk of the Parliaments) act as joint controllers.

Effect of parliamentary privilege

Parliament carries out unique functions. Please note that we may process personal data while performing such parliamentary functions, which may be subject to parliamentary privilege. In such cases, your usual rights over your personal data may not apply.

Examples of such parliamentary functions include committee inquiries, the e-petitions system, and the work of the Parliamentary Commissioner for Standards in investigating allegations against Members.

This privacy notice specifies circumstances where processing may relate to parliamentary functions and so be subject to parliamentary privilege – but please note that these references are not exhaustive.

The personal data we process

Where necessary, we may process the following personal data of members of the public:

• Your name, address and contact details
• Your bank account and/or payment card details
• Images and video of you, including CCTV footage taken on the parliamentary estate or photographs taken at events you attend
• Audio and visual recordings of meetings or events, where you appear (the recording of which you will be informed about prior)
• Personal requirements or preferences such as dietary, access or religious needs
• Your experiences of and opinions about the goods or services we provide, such as when you make a complaint or comment, or respond to a survey
• If you submit information to a committee (such as written evidence), any personal data you include as part of that information (parliamentary privilege may apply)
• If you use any of our websites, your IP address, how you use our websites, and certain user preferences. Further information about cookies can be found elsewhere on our website: https://www.parliament.uk/site-information/privacy/.
• If you are involved in a safety incident or require first aid while on the parliamentary estate, your date of birth, sex, data concerning your health, images relating to the incident, and sickness or absence records relating to the incident
• If you are using one of our engagement or education services, your geographical location or region and the organisation you represent or work for, if any
• If we ask you and you consent to sharing it with us, diversity monitoring information about you, including your age range, geographical region, education history and qualifications, employment and socio-economic status (including whether you are in parental leave), racial or ethnic origin, religious or philosophical beliefs, health or medical conditions (including whether you have a disability or whether you are pregnant), sex and gender identity, and your sexual orientation
• Other personal data that you may share when you contact us by letter, email, phone or other means.

How we collect your personal data

Your personal data is provided to us:

• when you correspond with the House or take part in its work, for example when submitting evidence to a committee, making an enquiry or submitting a form (parliamentary privilege may apply)
• when you use our websites
• when you visit the parliamentary estate, including the Parliamentary Archives, the House of Commons Library, the gift shops, catering venues, or the education centre
• when you meet with or are interviewed by our representatives, such as our staff
• when you request a publication from us, such as a newsletter
• when you purchase goods or services from us, for example from one of our gift shops
• when you provide feedback or complete a survey
• by third parties who may contact us about you
• from sources in the public domain.

Purposes of the processing

The processing of your personal data is necessary for the following purposes:

• to support the functioning of Parliament
• to allow the public to access the parliamentary estate and to watch proceedings
• to allow members of the public to make enquiries or submit information, and for us to respond (parliamentary privilege may apply)
• to run tours and events, including registration, balloting and/or invitation processes, evaluation, and follow-up contact
• to ensure the security of the parliamentary estate and the people on it, including carrying out CCTV monitoring and security checks at entrances
• to allow you to use our websites, and, where you have consented to supplying the requisite cookies, to improve your user experience and to provide you with adverts about our services. Further information about cookies can be found elsewhere on our website: https://www.parliament.uk/site-information/privacy/.
• to engage with the public and to provide, promote and evaluate education and outreach services, for example providing learning materials on request and running events as part of UK Parliament Week
• to recognise the contributions of individuals or organisations through award schemes, such as the Your UK Parliament Awards
• to receive complaints, comments or compliments about the services we provide, to survey the users of them, and to resolve complaints and improve services
• to report and take remedial action in relation to health and safety incidents on and near to the parliamentary estate
• to monitor trends in the people who engage with Parliament, specifically with regard to their diversity information, which in turn helps us identify ways of achieving our strategic aim of engaging with a diverse range of people
• if you are a sole trader engaging with the House of Commons, we may use personal data you provide in your capacity as a sole trader to both run data analytics exercises to prevent and detect fraud internally, and to participate in the National Fraud Initiative
• to enable the House to fulfil its legal obligations

If you do not provide your personal data, the extent to which each of these purposes can be fulfilled may be affected. While there is no obligation to provide your personal data, this may in turn affect the range of services you can access.

The lawful basis of the processing

In order to process your personal data, we must have a ‘lawful basis’. The lawful bases are set out in the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018 (DPA 2018).

The lawful bases for processing your personal data will depend on the purpose we have collected it. In each case, one or more of the following lawful bases for processing will apply:

• UK GDPR Article 6(1)(a) – we have your consent
• UK GDPR Article 6(1)(b) – the processing is necessary in relation to a contract we have with you (or are entering into)
• UK GDPR Article 6(1)(c) – the processing is necessary for us to comply with the law
• UK GDPR Article 6(1)(e) – the processing is necessary for the performance of a public task, which includes the exercise of a function of either House of Parliament (DPA 2018 Section 8), or where the processing is in the public interest
• UK GDPR Article 6(1)(f) – the processing is necessary for the purposes of our legitimate interests or those of a third party, when balanced against your interests and rights. For example, if you submit feedback or make a complaint to the House about our services, our legitimate interest is in responding to your complaint and/or improving the services we provide.

A further ‘condition for processing’ is required when processing special categories of personal data. Special categories include racial or ethnic origin, religious or philosophical beliefs, trade union membership, genetic and biometric data, health data, and information about sex life or sexual orientation. The conditions for processing are set out in the UK GDPR and the DPA 2018.

The conditions for processing your special category personal data are:

• you have provided your explicit consent (UK GDPR Article 9(2)(a))
• processing relates to personal data which are manifestly made public by the data subject (UK GDPR Article 9(2)(e))
• processing is necessary for the establishment, exercise or defence of legal claims (UK GDPR Article 9(2)(f))
• processing is necessary for reasons of substantial public interest (UK GDPR Article 9(2)(g)) including the conditions set out in Schedule 1, Part 2 of the DPA 2018.

In accordance with the DPA 2018, our policy for processing special category data can be found on our website: https://www.parliament.uk/site-information/data-protection/policies/hc-special-category-policy/.

Other lawful bases and conditions for processing may apply if the processing of personal data is necessary in emergency circumstances, for example, to protect an individual’s vital interests or for the provision of health or medical services.

Who we share your personal data with

Where necessary, we may share your personal data with or disclose it to:

• Other organisations we deliver services with, such as the House of Lords, the Restoration and Renewal Delivery Authority and the National Archives
• Providers of goods and services contracted by the House, such as website providers, ticketing providers, and providers of email and subscription services
• If you have submitted evidence to a committee or appear as a witness, your evidence may be published or broadcast in the public domain
• If you are registered to attend or have attended an event, the organisers of that event
• Where you are being sent physical educational resources, our distributors
• If you are a sole trader, a specialist external auditor and the Cabinet Office (the latter of whom run the National Fraud Initiative). This is limited to the personal data you provide us in your capacity as a sole trader.
• If you have been involved in a health and safety incident, third parties such as the Health and Safety Executive. This is so that we can fulfil our health and safety responsibilities.
• Other organisations where there is a legal obligation to do so. For example, the Police, for the purposes of prevention and detection of crime.

We will never share or sell your personal data to other organisations for direct marketing purposes.

Events hosted by the House of Commons

If you attend an event hosted by the House of Commons, please be aware that personal data of yours (such as images, video and sound recordings) may be collected. These may be reproduced in print and online via our social media channels, our website, and education or engagement materials we commission about Parliament. If you would like to be excluded from these recordings, please contact the organisers prior to the event.

Please note that if you share images, video or sound recordings from events we host, either publicly or with us directly, these may be reproduced via our social media channels, our website, or education or engagement materials we commission about Parliament.

Storage of your personal data

We will retain your personal data for as long as is necessary for the purpose it was collected. The length of time personal data is retained for differs dependent on the purpose of their collection as well as any relevant legal requirements. The applicable retention period can be found in the Authorised Retention and Disposal Policy (ARDP), which is Parliament’s information disposal policy. The ARDP can be found on our website: https://www.parliament.uk/business/publications/parliamentary-archives/who-we-are/information-records-management-service/.

We take the security of your data seriously. All personal data you provide to us, whether electronically or in paper form, will be stored securely in accordance with our policies. We have information security measures in place to oversee the effective and secure processing of it.

Some personal data controlled by us is held outside the UK, For the purposes of the UK GDPR and the DPA 2018, all countries within the EEA are regarded as providing an adequate level of data protection. We would not transfer personal data to a person in a country outside the UK or EEA unless satisfied that that person and country had appropriate safeguards in place to protect personal data.

If you are a sole trader, we will in the case of our data analytics exercises and the National Fraud Initiative (NFI) securely transmit your personal data to our external auditor or the Cabinet Office. The protocols for these transfers have been agreed by our Senior Information Risk Owner or their representatives and, in the case of the NFI, they have been specified by the NFI team.

Your rights

Data protection laws provide you with rights over your personal data. Subject to limited exceptions, these are:

• Where we are relying on your consent to process your personal data, you can withdraw that consent or unsubscribe from our services
• The right to access your personal data
• The right to rectification of your personal data
• The right to erasure of your personal data
• The right to restrict the processing of your personal data if you have an objection to us doing so
• The right to object to the processing of your personal data
• The right to portability of your personal data
• Rights in relation to automated decision-making and profiling.

You can contact us if you wish to exercise any of these rights. Contact details can be found at the end of this notice.

Please note that formal individual rights requests are managed by the House of Commons Information Compliance Service. They will retain your request, including any relevant personal data, to demonstrate that we have met our legal obligations under the UK GDPR. These records are kept securely for two years.

As explained above, parliamentary privilege means that your usual rights over your personal data may not apply where we are processing it while performing parliamentary functions. In such cases, we will consider requests on a case-by-case basis. Please be aware that we are able to alter the parliamentary record only in the most exceptional circumstances.

Contact details

If you have any concerns relating to the use of your personal data, please contact the relevant service area in the first instance.

If you have any further questions about the use of your personal data, please contact the Data Protection Officer:

• Email: hcinformationcompliance@parliament.uk
• Post: Data Protection Officer, Information Compliance Service, House of Commons, SW1A 0AA
• Phone: 020 7219 4296

You also have the right to complain to the Information Commissioner’s Office, the supervisory authority, by contacting them: www.ico.org.uk/global/contact-us/.

Further information about data protection in Parliament can be found on our website: https://www.parliament.uk/site-information/data-protection/.

Version 4.1 – applies from 06/02/2025