HMRC Privacy Notice

A new short version of the Privacy Notice has been created. Changes have been made to the ‘Full Privacy Notice’ to confirm that the Valuation Office Agency became part of HMRC on 1 April 2026. The section titled ‘The purpose of this document’ has been shortened with added information about HMRCs function's. Information about how we use sensitive personal information has been moved to the section ‘The kind of information we hold about you’. Additional information has been added to the section ‘Data sharing’, to include examples of the types of third-party service providers HMRC uses. The update also includes technical amendments following changes to the data protection legislation brought about by the Data (Use and Access) Act 2025. The section 'Automated decision-making' has been updated to reflect amended legislation. A list of supplementary privacy notices published by HMRC has been added to the page.

Information about data sharing with the The Scottish Courts and Tribunals Service has been added.

The HMRC Privacy Notice has been updated to confirm that personal information may be used during the testing of IT systems or processes.

'How we use your information' has been updated to include the routine examination of business records which can contain personal data when carrying out civil and criminal investigative work. A new section on Artificial Intelligence, analytics and machine learning has been added. The 'Automated decision-making' section has been updated to include circumstances when automated decision-making is allowed including measures to safeguard individual rights.

EU institutions has been added to the list of third parties HMRC will share data with and information on UK and EU institutions has been added in the 'Data sharing' section.

'How we use your information' has been updated to include the use of GOV.UK One Login to verify identity.

Added translation

Links have been added to the 'Situations in which we’ll use your personal information' and 'When we may share your personal information with third parties' sections.

Department for International Trade (DIT) has now changed to the Department for Business and Trade (DBT).

When we may share your personal information with third parties now includes Education and Skills Funding Agency for apprentice levy and Department for Education for policy development and evaluation of training or education and the Department for International Trade, including the UK Export Support Service and Trade Remedies Authority, in support of their trade purposes and activities.

The sections about when we may share your personal information with third parties, how to complain to HMRC have been updated. Sections about data protection principles, coronavirus (COVID-19) and your personal information, automated decision making, the security of your data with third party service providers, rights of access, correction, erasure and restriction, right to withdraw consent, fees required and contacting the Information Commissioner’s Office (ICO) have been removed.

The section 'Contact HMRC or make a complaint' has been updated with the name of the interim Data Protection Officer and the process to follow when making a complaint.

The list of third parties we may share your personal information with has been updated.

Information about what personal data we make publicly available and share with accredited processors and researchers has been updated.

Guidance on when HMRC may share your personal information with third parties has been updated to include the Border Flow Service.

The Data Protection Officer (DPO) appointed by HMRC has changed to Nicholas de Lacy-Brown, to oversee compliance with its data protection obligations.

Information added about how coronavirus (COVID-19) measures may affect how personal information is collected, and sections on how to contact HMRC and the Information Commissioner’s Office updated.

Guidance on when we may share your personal information with third parties has been updated.

The 'Automatic Exchange of Information' link under the 'Data sharing' section has been updated to 'Automatic Exchange of Information Privacy Notice'.

Guidance on how we use particularly sensitive personal information, when we may share your personal information with third parties and information about criminal convictions has been updated.

Guidance has been updated about the kind of information we hold about you, situations in which we’ll use your personal information and when we may share your personal information with third parties. Information about transaction monitoring has been added.

The guidance has been updated to show how you can make a complaint to HMRC, and to update the address of HMRC's Data Protection Officer.

This guidance has been updated with information about the new General Data Protection Regulation (GDPR) 2018 and the Data Protection Act (DPA) 2018.

Updated with information about how to make a subject access request.

This guidance has been updated to explain how requests are made.

First published.