College of Experts: privacy notice

This notice sets out how we will process your personal data, and your rights. It is made under Articles 13 and/or 14 of the UK General Data Protection Regulation (UK GDPR).

This note sets out how DSIT will handle, and process data collected in the College of Expert application form.

For data protection purposes, the Department for Science Innovation and Technology (DSIT) is the data controller.

Your data

We will process the following personal data:

• full name

• email address

• phone number

• right to work in the UK

• employer

• sector you work in
• career stage
• where you are based geographically
• areas of expertise
• CV
• statement of suitability.

With your permission, we will publish your name, job title and primary affiliation on the GOV.UK website, this is to ensure transparency, so the public can see where DSIT receives some of its scientific advice. This is entirely optional and will not affect your participation in the College of Experts.

Purpose

The reason why we are processing your personal data is to:

• provide DSIT with a flexible, pre-approved pool of volunteer scientific experts from academia and industry who can offer rapid, targeted advice to policy teams, helping ensure evidence-informed decisions and address complex policy challenges efficiently
• understand each expert’s background, skills, and experience – this ensures we have a diverse pool of experts and can match individuals with the right expertise to support specific policy teams *be transparent – we will publish the names of College of Experts members on the GOV.UK website (this will be entirely optional, and we will seek permission from each member before doing so)

Legal basis of processing

The legal basis for processing your personal data under Article 6 of the UK GDPR is:

• 1(e)Public task: Processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the data controller, to ensure we have the correct range of experts to support DSIT policy teams.

Recipients

Names and email addresses will be sent to Government Recruitment Services (GRS) for Baseline Personnel Security Standard (BPSS) and social media checks.  

As part of our IT infrastructure, your personal data will be stored in the UK on systems provided by our data processors – Microsoft and Amazon Web Services. This does not mean we actively share your personal data with these entities; rather, they are technical service providers who host infrastructure supporting our IT systems.

Retention

Your personal data will be kept by us for 18 months. After which we will conduct a review to ensure data is to up to date.

International transfers

Your personal data will only be processed in the UK.  

Your rights

You have the right to request information about how your personal data are processed, and to request a copy of that personal data.

You have the right to request that any inaccuracies in your personal data are rectified without delay.

You have the right to request that any incomplete personal data are completed, including by means of a supplementary statement.

You have the right to request that your personal data are erased if there is no longer a justification for them to be processed.

You have the right in certain circumstances (for example, where accuracy is contested) to request that the processing of your personal data is restricted.

You have the right to object to the processing of your personal data.

To exercise your rights please contact the data protection officer using the contact details below.

Contact details

The data controller for your personal data is the Department for Science. Innovation and Technology (DSIT). You can contact the DSIT data protection officer at:

Email: dataprotection@dsit.gov.uk

If you are unhappy with the way we have handled your personal data, please write to the department’s data protection officer in the first instance using the contact details above.

Complaints

If you consider that your personal data has been misused or mishandled, you may make a complaint to the Information Commissioner, who is an UK independent regulator.  The Information Commissioner can be contacted at:

Telephone: 0303 123 1113

ICO: make a complaint

Any complaint to the Information Commissioner is without prejudice to your right to seek redress through the courts.

 Updates to this notice

If this privacy notice changes in any way, we will place an updated version on this page. Regularly reviewing this page ensures you are always aware of what information we collect, how we use it, and under what circumstances we will share it with other parties. The ‘last updated’ date at the bottom of this page will also change.

If these changes affect how your personal data is processed, we will take reasonable steps to let you know.

Last updated: 7 November 2025