Privacy Information Notice
July 2024
How We Manage Your Data
How we use your
information
His Majesty’s Passport Office
is responsible for the issue of
the UK passport and for
administering the civil
registration process in
England and Wales including a
publicly accessible central
index of registration events.
We will process your data
when you make or countersign
an application, use civil
registration services, contact
us for information or use your
passport.
We process your data to
decide whether to issue,
refuse or withdraw a product
or service, to comply with our
legal obligations or to carry
out necessary tasks in the
public interest.
We may contact you directly to
request further information
about your application, remind
you that your passport is due
to expire, or ask you about the
services we provide.
How we share your
information
We will only share data when it is
legal to do so. We will retain your
information only for as long as is
necessary and will never share
your data for marketing
purposes.
You have the right to be told if we
hold any personal information
about you and if so to be given a
copy. We may restrict the
information we provide to you for
the purposes of law enforcement.
We may pass your data to
organisations in the UK and
abroad. We may share data with
business partners, other
government departments, law
enforcement agencies and local
authorities to help fulfil their aims
and objectives.
Your data may be checked
against information from other
organisations to prevent or detect
crime.
If you deliberately give untrue or
misleading information to HM
Passport Office you could be
prosecuted.
More information
We will do our upmost to ensure
we record accurately information
provided on applications.
For more information on how we
process your personal data
please see HM Passport Office
Privacy Information Notice on
GOV.UK
For more information on how to
contact us or register a complaint
visit His Majesty’s Passport
Office pages on GOV.UK
If you do not wish to be
contacted for customer research
purposes, please inform a
member of staff.
Privacy Information Notice
Contents
Privacy Information Notice 3
Introduction 4
Who we are 4
1. Your Personal Data 4
1.1 Cookies 5
2. What personal information is held on a passport? 5
Lost or Stolen Passports 6
3. What information is shown on a birth, death or marriage / civil partnership
and adoption certificate? 6
4. Your rights in relation to the processing of your personal data 7
Automated Decision Making 8
5. Making a request for your data 8
6. Exemptions to the right to subject access 9
7. Restrictions 10
8. Rectification and Erasure of Data and Restriction of Processing. 10
9 Our Responsibilities 11
9.1 Our commitment to you 11
9.2 How we use the personal information you provide us 11
Detecting and preventing crime. 12
9.3 Information from third parties. 13
9.4 Where is my personal data held and for how long? 13
9.5 How is my information shared? 14
9.6 Information transferred outside of the United Kingdom 15
10 Third parties and business partners 16
10.1 Who has access to my personal information? 16
10.2 Contact Details. 17
11. Other sources of advice and assistance 18
Annex A. 20
Introduction
This document explains your rights as an individual when using services provided by His
Majesty’s Passport Office (HM Passport Office).
The Privacy Information Notice for other areas of the Home Office are covered here:
Borders, Immigration and Citizenship: Privacy Information Notice
The Home Office Personal Information Charter can be accessed on GOV.UK HERE.
Who we are
HM Passport Office is part of The Home Office.
HM Passport Office is responsible for the services and issue of UK passports and for
administering the civil registration process in England and Wales.
1. Your Personal Data
We will collect personal data when:
• Customers make an application for a passport.
• Referees corroborate an applicant’s identity on a passport application.
• During a passport interview to confirm identity. A digital audio recording of the
interview will be retained for 28 days.
• We receive information about registration of a birth, death, marriage, civil
partnership in England and Wales from local registrars or from the British authorities
such as Armed Forces or a consul where the event is registered overseas.
• We receive information about a parental order, adoption or gender recognition
certificate.
• An application is made for a Civil Registration certificate.
• We receive further information from customers or a third party in connection with a
passport or registration event, for example, if you apply for a birth, marriage or
death entry to be corrected.
This information will be used, as appropriate, to enable us to:
• Verify an identity and nationality to make a decision on an application and assist in
delivery of our services.
• Verify customer’s entitlement to hold a UK passport, for example being subject to a
football banning order.
• Verify information about passport or civil registration record once it has been made
• Create a central record of registration events for England and Wales and produce
indexes to enable any member of the public to apply for and obtain copies of
certificates
• Complete our response to any queries or comments customers submit about their
own application
• Improve our customer services
1.1 Cookies
When using our online services, we place small amounts of information on devices, for
example, computer or mobile phone. These include small files known as cookies. They
cannot be used to identify users personally. Our cookies policy provides more information:
https://www.gov.uk/help/cookies
2. What personal information is held on a passport?
A passport will contain the following personal information:
• Passport number
• Surname
• First name(s)
• Date of birth
• Place of birth
• Gender
• Digitised image (photograph)
• Signature (if recorded digitally).
Personal information and digitised image are located on the personal details page of the
passport. The page is in two parts. The upper part is for visual inspection, while the lower
part consists of two lines of print which can be read by special passport-reading equipment
at immigration controls – it contains no additional information compared to what is listed on
the page already. It simply repeats this information in a way that can be easily read by
such equipment. Depending on how old a passport is, it will either contain a digitised
image of a signature or the passport holder’s handwritten signature.
In 2006, HM Passport Office introduced the e-passports, which include a chip. The chip
stores a digitised image and the personal information printed on the personal details page
of the passport, there is no personal information held on the chip that cannot be seen
already.
Once information has been placed on the chip, it cannot be amended. When the chip is
being read by passport reading equipment, the information on the chip is protected against
third parties reading the information from a distance (known as “eavesdropping” or
“skimming”) by an advanced digital encryption technique.
Lost or Stolen Passports
You should report a lost or stolen passport as soon as possible. This will reduce the risk of
anyone else using your passport or your identity. You can report your passport lost or
stolen by:
• going to the Gov.UK website: Cancel a lost or stolen passport - GOV.UK (www.gov.uk)
• reporting the loss or theft to a consulate or embassy post (overseas)
• completing a paper notification form (known as an LS01)
• applying to replace the passport, giving the details of the loss (or theft) on the passport
application.
3. What information is shown on a birth, death or marriage / civil
partnership and adoption certificate?
The format of birth, marriage and death certificates has varied over the years and the
content may differ depending on when the event was registered, but generally speaking
will include the following information:
Birth:
• Registration district and sub district of birth
• Entry number, date and place of birth
• Name and surname
• Sex
• Name, surname and occupation of father/parent (if recorded)
• Name, surname and occupation of mother
• Usual address
• Name, surname and usual address of the informant (if not the mother or
father/parent)
• Date of registration
• Name of registrar
Death:
• Registration district and sub district of death
• Entry number
• Sex, date and place of death
• Name, surname, maiden name (if applicable)
• Occupation and usual address of the deceased
• Date and place of birth of the deceased
• Name, surname and usual address of the informant
• Cause of death
• Date of registration
• Name of the registrar
Marriage:
• District of marriage
• Place of marriage
• Entry number
• Date of marriage
• Name and surname of parties to the marriage
• Date of birth, condition, and occupation
• Residence at the time of the marriage
• Name, surname and occupation of each party’s mother/father/parent (if provided by
the parties to the marriage)
• Signatures of both parties
• Name and surname of witnesses
• Signature of the person(s) who officiated at the marriage
Adoption:
• Entry number
• Date of birth
• Registration district and sub district of birth, or place and country of birth (if born
abroad)
• Name and surname
• Sex
• Name and surname, address and occupation of the parent(s) of the adopted child
• Date of adoption order or date on which the adoption was affected
• Description of court by whom effected
• Date of entry
• Signature of officer deputed by Registrar General to attest the entry
Civil Partnership:
• Registration Authority where the civil partnership was registered
• Date and place of civil partnership registration
• Name and surname of civil partners
• Date of birth, condition and occupation of the civil partners
• Residence at the time of the civil partnership registration
• Name, surname and occupation of each civil partner’s mother/father/parent (if
provided by the civil partners)
• Signatures of civil partners
• Name and surname of witnesses
• Signature of civil partnership registrar
4. Your rights in relation to the processing of your personal data
You have the right to be told if HM Passport Office holds any personal information about
you. These are sometimes known as “subject access” rights.
The UK General Data Protection Regulation (UK GDPR) also provides you with other
rights about how your personal information is handled. We will help you exercise your data
protection rights by complying with the UK GDPR, including meeting rights to:
• Request a copy of the personal information we hold, subject to a number of
exceptions under data protection and civil registration law.
• The personal information will be provided in a clear form.
• Make sure that the personal information we hold is accurate.
• Ask for a correction if necessary and where legislation allows.
• Expect that personal information gathered during the passport process is never
used for the purpose of direct marketing. Please note that civil registration records
are records which the public have access to and it is a matter for any purchaser of
that record to ensure that personal information is used lawfully.
• Expect processing of your personal information in a way that is likely to cause
damage or distress is prevented or ceased.
• Ask that a decision which would significantly affect you should not be taken by
automatic means.
Automated Decision Making
• We use personal data to develop tools that allow us to assess and then process
applications in a particular way. Automation within the application process will
comply with our wider obligations under equality legislation. This helps us to target
our resources and ensure our processing is efficient, allowing us to minimise costs
while protecting the public effectively.
• Parts of our processing involve degrees of automation, but complex or adverse
decisions will always be taken by a trained officer or caseworker.
5. Making a request for your data
For help with current passport application queries or complaints, please contact HMPO
Helpline (0300 222 0000, Textphone: 18001 0300 222 0222)
You can submit a request for your data in writing or verbally to any part of the organisation
Our preferred customer contact point for personal data requests is:
Disclosure of Information Section
His Majesty’s Passport Office
2 East Station Road
Fletton Quays
Peterborough
PE2 8YY
Email: [email protected]
To make a request for your data you will need to provide information to help us find your
records. At a minimum, this should include:
• Your full name
• Your date of birth
• Your address
• Any previous name you were known by
• If applicable, your UK passport number, (if you have lost your passport, please try
to provide us with an approximate date and place of issue).
You will need to provide us with a means of verifying your identity. The best way of doing
this is to provide a copy of the personal details page of your passport. If you do not have a
passport, we will accept a photocopy of your photo card driving licence or another form of
official photo ID.
We have developed a subject access request form to help you provide all the information
we need in order to deal with your application as quickly and smoothly as possible.
Download the Subject access request form here.
You do not need to use the subject access request form to request your personal
information if you do not wish to. We will be happy to help you complete the request. The
Citizens Advice Bureau may also be able to help.
Requests relating to immigration status or whether you hold British Citizenship will not be
treated as a Subject Access Request under Article 15 of the UK GDPR following guidance
from the Information Commissioners Office.
If you are living in the UK the Gov.UK website can be used to apply online for confirmation
of immigration status or confirmation that you have not gained British Citizenship:
Nationality Services Base Product (visas-immigration.service.gov.uk)
The online service is not available if you live in the Channel Islands, on the Isle of Man or
in a British Overseas Territory. If you cannot, or do not wish to use the online service or
live outside the UK a postal application is available on the Gov.UK website: Apply for
proof that you do not have British citizenship (form NQ) - GOV.UK (www.gov.uk)
Where a request applies solely to information contained as part of a civil registration
record, such as a birth registration, an application for a copy of the certificate can be made
by applying online through the GOV.UK website:
https://www.gov.uk/order-copy-birth-death-marriage-certificate or by contacting the
Registration Office at the local authority for the area where the registration event occurred
and the record is held.
6. Exemptions to the right to subject access
There are specific exemptions within the UK General Data Protection Regulation and the
Freedom of Information Act 2000, allowing us to refuse requests for personal information
where providing personal information would be likely to:
• Prejudice the prevention or detection of crime.
• Disclose personal information about another person.
• Disclose adoption records for those not yet 18 years old.
• Disclose information which relates to a person who has made an application under
the Gender Recognition Act.
When we use an exemption set out in legislation we will let you know about this in our
response to your request. Consideration will be carried out in accordance with the Guides
to Information provided by the Information Commissioner’s Office.
7. Restrictions
HM Passport Office can restrict your right to information if doing so would be a necessary
and proportionate measure to:
• avoid obstructing an official or legal inquiry, investigation or procedure.
• avoid prejudicing the prevention, detection, investigation or prosecution of criminal
offences or the execution of criminal penalties.
• protect public security.
• protect national security; or
• protect the rights and freedoms of others.
In such circumstances HM Passport Office will notify you in writing of the following:
• what information has not been provided, and the reasons for this.
• your rights of complaint to the Information Commissioner, and to apply to a court.
This requirement to provide information about the exercise of the restriction does not apply
if the Home Office decides this would undermine the purpose of applying the restriction.
Because of the legal basis by which we process data a right to data portability does not
apply.
8. Rectification and Erasure of Data and Restriction of Processing.
HM Passport Office will do its upmost to ensure it records accurately the information
provided on applications. If errors exist customers can contact HM Passport Office to
correct records. Customers may need to provide evidence to support a change in order to
reduce the risk of crime or fraud. HM Passport Office may refuse to amend records where
sufficient evidence is not available or where a request is not within its legal jurisdiction.
The personal data collected from applications is used to administer existing services, such
as confirming the validity of passports or protecting individuals against fraudulent
applications submitted in their identity. The erasure or restricted processing of data
collected would have a disproportionate impact upon the ability of HM Passport Office to
carry out its core functions. Requests for restrictions of processing will be limited to
requests to be excluded from customer research.
Please see the Contact Details section of this document for information on opting out of
customer research.
9 Our Responsibilities
9.1 Our commitment to you
Our aim is to safeguard and manage personal information and ensure that it is held safely
and securely. This will ensure that we protect customers personal identity and support the
wider Home Office public protection agenda of combating fraud and identity theft.
We will do that by delivering policies and processes that meet the key values of:
Transparency: We will provide clear and accessible information about how and why we
gather, use, retain and share personal information as well as making customers aware of
how to exercise their rights to access or amend their information.
Trusted and Secure: We will ensure the security and accuracy of personal information,
protecting it from loss or unauthorised disclosure. We will ensure that we manage this
effectively, regularly monitoring and improving how our processes work. The overall
security of processing is deemed sufficient to protect special category data including
nationality, biometric (passport photos, etc) and children’s data as described in Article 9 (2)
(g) of UK GDPR.
Benefits to the Citizen: We will ensure that our management of personal information
delivers benefits to the law-abiding citizen, either as an individual (e.g. by helping people
travel abroad or access a service) or as a member of society (e.g. by helping protect the
public). We will only share personal information with others when Ministers have agreed
that such benefits exist in those circumstances, or where there is provision in law to
provide access to information.
Proportionality: We will only gather personal information that is needed for carrying out
our duties. We will not keep it for any longer than is necessary, ensuring that it is only seen
by those who need it to do their jobs. We will only share information with others where the
law allows this and we will provide the minimum amount of information needed to achieve
the benefit
Value for Money: We will ensure that we manage our data in a cost-effective way to
ensure we deliver value for money to those who pay fees for our services.
For more information visit: https://www.gov.uk/government/organisations/hm-passport-
office/about
9.2 How we use the personal information you provide us
Personal data is processed lawfully under Article 6 (1) (c) and/or (e) of the UK GDPR.
Article 6 (1) (c) relates to the lawful processing of personal data for compliance with legal
obligations to which the data controller is subject. Article 6 (1) (e) relates to the lawful
processing of personal data necessary for the performance of a task carried out in the
public interest or in the exercise of official authority vested in the data controller.
UK GDPR places restrictions on the processing of sensitive data known as Special
Category Data. We will process Special Category data such as biometric, nationality and
genetic data under Article 9 of UK GDPR. Biometric and nationality data is processed
under UK GDPR Article 9 (2) (g) - substantial public interest. Where customers have
decided to voluntarily submit evidence of genetic relationships in support of an application
it will be processed with the explicit consent of all parties under Article 9 (2) (a) consent.
In addition, we use personal information we hold for a number of other purposes:
• Customer Research: Customers may be contacted about the services we offer
and to get customer opinion about how such services should be run in the future.
You may be contacted by customer research companies appointed by HM Passport
Office to carry out surveys on our behalf.
• Training and Assurance: We use personal information when training our staff –
primarily when training those conducting interviews or dealing with customers over
the telephone. We will review personal information as a necessary part of
conducting audits to ensure that our staff are carrying out their duties effectively and
in accordance with the law.
• Testing our systems: We prefer to use “dummy” or anonymised data for testing
our IT systems but exceptionally, we use some personal information to assist in
testing our systems effectively where no other reasonable alternative exists. In such
circumstances, we ensure that the security and integrity of personal data is never
put at risk.
• Statistical analysis: In order to review the effectiveness of our services, we will
collate information to measure and judge our performance. Wherever possible, we
will use anonymised data to achieve this but some personal information may be
involved in conducting such analysis where no reasonable alternative exists.
• Customer Service Messaging: In some cases, we will send customers a text,
email or letter acknowledging receipt of an application, confirming successful
completion of an application or to confirm an appointment, when customers have
provided us with a mobile telephone number or email address. We will also attempt
to send a text, email or letter to remind customers when their passport is reaching
the end of its validity.
• Images in Publications and Projects: Data subjects that volunteer or give
permission to HM Passport Office to use their photographs in publications or
projects will be asked for consent to use their image. Consent is provided under
Article 6 (1) (a) of the UK General Data Protection Regulation and data subjects can
withdraw consent at any time.
Detecting and preventing crime.
• The data provided in applications is also used to identify fraud patterns and develop
fraud risk indicators.
• Passport photographs submitted with passport applications may be compared
against other passport photographs to prevent and detect identity fraud and may be
shared with other agencies to fulfil their aims and objectives where there is a legal
gateway to do so.
• Passport photographs submitted with passport applications may be compared
against facial images from law enforcement agencies in order to prevent or detect
crime as well as assisting in the locating or apprehension of known
criminals/suspects. We only share data when it is legal and proportionate to do so.
9.3 Information from third parties.
We will obtain personal data relating to British Citizenship applications collected by UK
Visas and Immigration (UKVI). HM Passport Office will only retain the minimum
information needed to process a passport application which include a photo of the data
subject. The data will be retained irrespective of the data subject submitting a passport
application and may be used in the detection and prevention of crime.
We may request information from other sources when you have applied for a passport or
contacted us about a registration event. We will do this in order to verify information or the
authenticity of supporting documents provided. This includes:
• Contacting someone chosen to corroborate an identity
• Obtaining information from other government departments or a credit reference
agency
• Contacting the issuer of a supporting document provided with an application to
ensure that it is authentic – this applies to documents issued in the UK and
overseas
• Other than the persons chosen to corroborate an identity, information from third
parties will only be sought where there is legal power to do so or it is expressly to
prevent or detect criminal activity.
9.4 Where is my personal data held and for how long?
Databases hosting passport and civil registration records are located in the UK. Passport
application details submitted via online channels are processed within the EEA and held
for 28 days after the application is passed for issue and then deleted from the online
channel. Our IT systems are subject to security oversight and review in compliance with
agreed Government standards. A record held in other formats such as paper or microfiche
are similarly subject to oversight and review.
Where passports are applied for overseas, records of application are held securely
overseas by our commercial partner VFS Global or at consular posts by the Foreign,
Commonwealth and Development Office. In some circumstances, our customer research
partners may store information securely overseas when they are collecting information
from participants. We tell participants when this is the case at the point of collection.
The information gathered from passport or certificate applications will be destroyed at
different times based on the information in question and how long it is necessary to keep it.
For example: Personal information obtained from other organisations in order to verify
information on a passport application or to support an interview will be deleted 28 days
after a passport has been issued. Such information may be retained for longer where the
application was refused or it is required for the purpose of the prevention or detection of
crime. When contacting the HMPO Helpline (0300 222 0000, Textphone: 18001 0300 222
0222) calls will be recorded and stored for 6 months.
Information about passport deliveries are ordinarily retained for three months for UK
deliveries and six months for overseas deliveries in order to address any subsequent
queries from customers and to retain evidence of delivery or attempted delivery. Such
information may be retained for longer where it is required for the purpose of the
prevention or detection of crime.
We keep records of civil registration events indefinitely as a record to which the public has
access. Records of what passports have been issued and the key information included on
such passports are kept for 80 years. Information will be recorded as part of dealing with
any applications or queries you make – for example, case notes on how we make a
decision on your passport application or whether to correct a civil registration record.
We keep our retention periods under review and will update this section should we make
changes.
For more information see What to keep: Home Office guide to managing information.
9.5 How is my information shared?
HM Passport Office shares data with other government departments, law enforcement
agencies and local authorities to help fulfill their aims and objectives. HM Passport Office
primarily relies upon common law as its legal basis for sharing data.
The Registrar General relies on a specific legal gateway as the legal basis for sharing
data. A copy of any register entry will be provided by the Registrar General in accordance
with the law to any applicant, provided they supply enough information to identify the entry
concerned and pay the appropriate fee. The copy can only be issued in the form of a
paper certified copy (a “certificate”). A PDF or digital image can also be obtained from the
General Register Office for historical births (over 100 years old), and deaths registered up
to 1957. An application for a certificate can also be made to the local office where the
event was registered.
A central index of registration events is publicly available in order to help members of the
public identify the registration record they might need. Information about the indexes can
be found at Research your family history using the General Register Office.
Civil registrations records are also shared for:
• Statistical or research purposes
• Administrative purposes by official bodies e.g. for ensuring records are up to date
• Fraud prevention or detection.
Life Events Verification (LEV) is a service that provides for the electronic verification of civil
registration data to government departments. LEV will enable government departments
where a legal gateway allows the data to be shared and approval has been given by the
Registrar General, including HMRC and UKVI, to verify civil partnerships and also to verify
births, marriages, and deaths registered in England and Wales after 2009 instead of
checking a paper birth certificate.
A full list of the Registrar General’s data sharing arrangements can be found at Annex A
Other services provided by HM Passport Office:
Passport Validation Service (PVS) to support the business community and government
departments in preventing fraud and crime.
This includes:
• Law enforcement agencies to help prevent and detect crime
• For employment purposes to confirm the identity and immigration status of potential
employees
• Facilitate passport and consular services overseas
• Financial services to prevent or detect fraud.
• Other government agencies to help fulfill their aims and objectives.
The PVS service will validate information provided by a PVS customer but will not provide
personal information. Law enforcement organisations, and other government departments
access the Data Verification Application (DVA) system records directly and therefore have
access to personal data. Data sharing will only take place where there is a lawful basis
that permits the data sharing to occur.
9.6 Information transferred outside of the United Kingdom
For overseas applications, information regarding the delivery of a passport or certificate
will be shared with DHL Global Forwarding (UK) Ltd who provide delivery services
overseas. Customer data may be stored outside of the United Kingdom by DHL Global
Forwarding (UK) Ltd but will be stored in a manner that meets HM Passport Office
standards.
HM Passport Office shares information with overseas law enforcement agencies such as
Interpol or Home Office staff overseas for the purpose of preventing, investigating and
prosecuting crime and fraud overseas and in the UK.
VFS Global, The Foreign, Commonwealth and Development Office and FCDO Services
receive and facilitate the processing of some British passport applications made overseas
on our behalf.
HM Passport Office may contact applicants, or persons chosen to corroborate an
application who may be located outside of the United Kingdom, directly by email, text,
phone or post. HM Passport Office cannot assure the integrity of communications or IT
systems which do not form part of HM Passport Office services or those of its business
partners.
10 Third parties and business partners
10.1 Who has access to my personal information?
HM Passport Office does not share data unless it is lawful, proportionate and relevant to
do so.
As part of our operational processes personal information will only be available to those
who have a need to see it in order to carry out their duties. We have put in place a range
of policies, processes, and system controls in order to enforce this principle. Staff who
have access to personal information are subject to pre-employment vetting appropriate to
their role and are subject to random audit and review.
A number of organisations are contracted by or subject to agreement with the Director
General of HM Passport Office to deliver HM Passport Office services. To do this, they will
often handle personal data on our behalf and under our instructions. These organisations,
as “data processors”, conduct the following work:
• Sopra Steria Limited: Opening passport applications received in the post and
recording their contents onto our passport application processing system; and
writing to you if we need some additional information to support your application.
Authenticating supporting documentation as part of the Scanning and Validation
Service.
• Iron Mountain: In partnership with Sopra Steria to provide the Scanning and
Validation Service. Storage and retrieval services for HM Passport Office and Civil
Registration Services.
• DXC: Developing and supporting our online application channel, passport
application processing system, passport records database and supporting IT
systems.
• Thales: Printing passports where an application has been approved by HM
Passport Office.
• DHL Global Forwarding (UK) Ltd: Delivering passports and returning supporting
document to customers outside of the UK. DHL Global Forwarding (UK) Ltd are the
data controllers for the customer data they process on our behalf. DHL Global
Forwarding (UK) Ltd may contact customers by email, text or phone call regarding
the delivery of a passport.
• Amazon Web Services (AWS): Storage of on-line passport application data.
• Credit reference agencies: Supporting identity verification.
• VFS Global: Provide passport application submission services, interview
facilitation, DNA facilitation, and passport and document collection services
overseas.
• The Foreign, Commonwealth Development Office and FCDO Services:
Receive and facilitate processing of some British passport applications made
overseas on our behalf.
• Home Office Digital Data and Technology: Host and maintain the computer
systems used for the registration of births, deaths, marriages and civil partnerships
and for online certificate ordering. Host and maintain computer systems in the UK
for the storage of Digital Application Processing (DAP) applications
• Post Office Ltd: Providing the Check & Send service which helps customers
submit applications to HM Passport Office.
• Royal Mail: Dispatch and delivery of Civil Registration documents and supporting
passport documents where a secure delivery service has not been requested.
Provide secure delivery of UK passports and supporting documents in the UK, as
well as delivery service for Civil Registration and UK Visas & Immigration. Royal
Mail are the data controllers for the customer data they process on our behalf.
Royal Mail may contact customers by email, text or phone call regarding the
delivery of a passport.
• Teleperformance: Answering initial customer enquiries at our contact centre
located in the UK for the Passport Advice Line and sending letters to invite some
applicants to an interview. Processing reports of passports which have been
reported as lost or stolen
• Kainos, Equal Experts, ATOS, Automation Logic and BAE Systems assist with
software and programme development of HM Passport Office systems.
• Top Level: provision of appointment booking and queuing systems
• IBM: Support for biometric verification services.
• WorldPay: Accessed via GOV.UK Pay to process payments.
• Worldreach: Supporting the processing of passport applications from British
Overseas Territories.
• ESynergy and Cognizant: Used to provide contractors for IT services. Private
contractors are also appointed independently.
• Serco: Answering initial customer enquiries at our contact centre located in the UK
for the Passport Advice Line
10.2 Contact Details.
HM Passport Office is part of The Home Office.
The Home Office is the controller for passport data. The Office of the Data Protection
Officer is responsible for data protection compliance within the Home Office and can be
contacted at Office of the Data Protection Officer, Peel Building, 2 Marsham Street,
London SW1P 4DF or Email: [email protected].
The Director General of HM Passport Office, Joanna Rowland, is responsible for issuing
passports on behalf of the Home Secretary under the powers of the Royal Prerogative.
The Registrar General for England and Wales, Tom Grieg, is responsible for the
registration of life events such as births, deaths, marriages and civil partnerships in
accordance with the law
1
. The service is delivered locally by registration officers and local
authorities in England and Wales.
The Registrar General is the controller for civil registration data and can be contacted at
General Register Office, Trafalgar Road, Southport, PR8 2HH. The Registrar General has
1
1 The main legislation governing civil registration is the Births and Deaths Registration Act 1953, the
Marriage Act 1949 and the Civil Partnership Act 2004
appointed the Data Protection Officer for the Home Office to also be the Data Protection
Officer for the Registrar General, they can be contacted at Office of the Data Protection
Officer, Peel Building, 2 Marsham Street, London SW1P 4DF or Email:
The Superintendent Registrar for each registration district is also a controller for birth,
death and marriage registrations and the relevant local authority is a controller for civil
partnership registrations held locally.
If you do not wish to be contacted for customer research purposes you can contact
[email protected] asking to be opted out of customer research. In your email
you should provide the following information:
Title
Full Name
Address
Date of Birth
Email address
Contact details for making a subject access request:
Disclosure of Information Section
His Majesty’s Passport Office
2 East Station Road
Fletton Quays
Peterborough
PE2 8YY
Email: [email protected]
If you are not satisfied by the service you have received from HM Passport Office or
would like to discuss our response to a Data Subject rights request please contact:
Customer Service Management Team
HM Passport Office
PO Box 767
Southport
PR8 9PW
Or use the Passport Enquiries form on Gov.uk which can be found here: Passport
enquiries (eforms.homeoffice.gov.uk)
11. Other sources of advice and assistance
You also have the right to complain to the Information Commissioner’s Office about the
way we are handling your personal information. Further information and advice can be
obtained from the Information Commissioner and the Citizens Advice Bureau, whose
contact details are as follows:
The Office of the Information Commissioner
Annex A.
List of personal data processing activities by the Registrar General
1. Collection of personal data
DATA
PROVIDER
PURPOSE
INFORMATION
PERSONAL
DATA
STATUTORY
BASIS
LAWFUL BASIS
(Under Article 6 UK
GDPR)
Superintendent
registrar
To compile
and maintain a
central record
of birth
registrations
Registration district and
sub district of birth
Entry number, date and
place of birth
Name and surname
Sex
Name, surname and
occupation of father (if
recorded)
Name, surname and
occupation of mother
Usual address
Name, surname and
usual address of the
informant (if not the
mother or father)
Date of registration
Name of registrar
Yes
S27 Births and
Deaths Registration
Act 1953
6 (c) legal obligation
The rights to object to
processing of
personal data or have
personal data erased
do not apply
Superintendent
registrar
To compile
and maintain a
central record
of death
registrations
Registration district and
sub district of death
Entry number, date and
place of death
Name, surname,
maiden name (if
applicable)
Sex
Occupation and usual
address of the
deceased
Date and place of birth
of the deceased
Name, surname and
usual address of the
informant
Cause of death
Date of registration
Name of the registrar
Yes, in
relation to
informant’s
details
S27 Births and
Deaths Registration
Act 1953
6 (c) legal obligation
The rights to object to
processing of
personal data or have
personal data erased
do not apply
Superintendent
registrar
Statistical
purposes
In relation to birth:
Age of mother
Age of father or parent
(if registered)
No. of previous children
Date of marriage or civil
partnership of parents
(if appropriate)
Yes, as
linked to
registration
record
S3 Population
Statistics Act 1938
6 (c) legal obligation
The rights to object to
processing of
personal data or have
personal data erased
do not apply
Whether the mother
had any marriage or
civil partnership before
that date
In relation to death:
Condition of deceased
(i.e. single, married,
etc)
Age of surviving
spouse or civil partner
(if any)
Superintendent
registrar
Statistical
purposes
In relation to birth:
Industry of employment
and employment status
In relation to death:
Length of stay in a
communal
establishment
Industry of employment
and employment status
of deceased
Yes, as
linked to
registration
record
No provision as
collected voluntarily
6 (e) public task
The right to have
personal data erased
does not apply
Superintendent
registrar
To compile
and maintain a
central record
of marriage
registrations
District of marriage
Place of marriage
Entry number
Date of marriage
Name and surname of
parties to the marriage
Age, condition, rank or
profession
Residence at the time
of the marriage
Name, surname and
rank or profession of
each party’s father
Signatures of both
parties and their
witnesses
Name of the person(s)
who conducted, and
registered the marriage
Yes
S58 Marriage Act
1949
6 (c) legal obligation
The rights to object to
processing of
personal data or have
personal data erased
do not apply
Parties who
have formed a
civil partnership
To compile
and main a
central record
of civil
partnership
registrations
Registration Authority
where the civil
partnership was
registered
Date and place of civil
partnership registration
Name and surname of
civil partners
Date of birth, sex,
condition and
occupation of the civil
partners
Yes
S30 Civil
Partnership Act
6 (c) legal obligation
The rights to object to
processing of
personal data or have
personal data erased
do not apply
Residence at the time
of the civil partnership
registration
Father’s name,
surname and
occupation of each civil
partner
Mother’s name,
surname and
occupation of each civil
partner
Signatures of civil
partners
Name and surname of
witnesses
Signature of civil
partnership registrar
Adoption court
orders from
relevant courts
in England and
Wales and some
overseas
adoptions
To compile
and maintain a
central record
of adoptions
Entry number, date and
place of birth
Name and surname
Sex
Name, surname
address and
occupation of parents
Date of adoption and
name of court
Date of entry
Officer who attested the
entry
Yes
S77 Adoption and
Children Act 2002
6 (c) legal obligation
The rights to object to
processing of
personal data or have
personal data erased
do not apply
Registrar
To ensure the
records are
accurate.
Birth registration data
for births in England
and Wales along with
the corresponding NHS
number
Yes
S19AA Registration
Service Act 1953
6(e) public task. The
right to have personal
data erased does not
apply.
2. Sharing of registration information
RECIPIENT
PURPOSE
INFORMATION
PERSONAL
DATA
STATUTORY
PROVISION
LAWFUL BASIS
(under Article 6
UK GDPR)
Applicant for a
certificate
To obtain a
certified copy of a
birth, death,
marriage, civil
partnership or
adoption entry
Where the applicant can
identify the relevant entry
and pay the fee, all the
information in a birth,
death or marriage entry;
name, surname and date
of birth for a short birth or
adoption certificate; full
details from a civil
partnership entry where
the applicant can provide
the address of the civil
partners; all information
excluding address of the
civil partners where the
applicant cannot provide
it.
Yes
S30 and 33 Births and
Deaths Registration Act
1953
S65 Marriage Act 1949
Regulation 13 Civil
Partnership
(Registration
provisions) Regulations
2005
S78 Adoption and
Children Act 2002
6 (c) legal
obligation
The rights to
object to
processing of
personal data or
have personal
data erased do
not apply
Statistics
Board (Office
for National
Statistics)
To support UK
Statistics Authority
requirement to
produce
statistical
information
Birth, Death, Still-birth,
Adoption, Marriage and
Civil partnership
registrations
Any other birth or death
information received by
the RG (includes Birth,
Still-birth, and Death
confidential and voluntary
statistical information)
Yes
S42 Statistics and
Registration Service
Act 2007
6 (e) public task
The right to have
personal data
erased does not
apply
Secretary of
State for
Health and
Social Care
To assist the
Secretary of State
in the
performance of
functions in
relation to health
Birth, Death and
Adoption registrations.
Any other birth and death
information kept under
legislation
Yes
S270 National Health
Service Act 2006
6 (e) public task
The right to have
personal data
erased does not
apply
Welsh
Ministers (for
Health)
To assist Welsh
Ministers in the
performance of
functions in
relation to health
Birth, Death and
Adoption registrations.
Any other birth and death
information kept under
legislation
Yes
S.201 National Health
Service (Wales) Act
2006
6 (e) public task
The right to have
personal data
erased does not
apply
Department for
Education
For research
purposes
For research purposes
any information that
relates to a person who
was or may have been
under 18 at the time of
death
Yes, in
relation to
the parents
of the
deceased
and the
informant
S32 Children and
Young Persons Act
2008
6 (e) public task
The right to have
personal data
erased does not
apply
Public sector
agencies and
law
enforcement
organisations
For the
prevention,
detection,
investigation and
prosecution of
offences
Verification of birth, death
and marriage registration
information when
requested
Yes
Schedule 6 Immigration
Act 2014
6 (e) public task
The right to have
personal data
erased does not
apply
His Majesty’s
Passport office
To assist the
Home Secretary
in the
performance of
duties in
connection with
passport issue
Verification of information
provided for the purposes
of, or in connection with,
an application for the
issue of a passport, or
determining whether to
withdraw an individual’s
passport
Yes
S10 Identity
Documents Act 2010
6 (e) public task
The right to have
personal data
erased does not
apply
Variety of
Libraries and
Records
Offices
For the RG to
provide an index
of registration
events
A microfiche subset of
birth, death, marriages,
civil partnership, adoption
and overseas indexes
Yes
S30 Births and Deaths
Registration Act 1953
S65 Marriage Act 1949
Regulation 13 Civil
Partnership
(Registration
provisions) Regulations
2005
S78 Adoption and
Children Act 2002
6 (c) legal
obligation
The rights to
object to
processing of
personal data or
have personal
data erased do
not apply
Adopted
People
To enable
adopted people to
trace their original
birth record
Information to allow them
to purchase a certificate
of original birth record
Yes
S79 and Schedule 2
Adoption and Children
Act 2002
6 (c) legal
obligation
The rights to
object to
processing of
personal data or
have personal
data erased do
not apply
Adoption
Agencies
(Intermediary
Agencies)
To enable
adopted people to
trace their original
birth record and
make contact with
birth relatives
Information from the
Adopted Children
Register, Adoption
Contact Register, court
details and original birth
details as required
Yes
Regulation 13 Adoption
Information and
Intermediary Services
(Pre-Commencement
Adoptions) and
equivalent Welsh
Regulations 2005.
The Disclosure of
Adoption Information
(Post-Commencement
Adoptions) Regulations
2005
Regulation 18 Access
to Information (Post-
Commencement
Adoptions) (Wales)
Regulations 2005
6 (c) legal
obligation
The rights to
object to
processing of
personal data or
have personal
data erased do
not apply
Adopted
people and
birth relatives
To facilitate
contact between
adopted people
and birth relatives
Information from adopted
people and their relatives
which is necessary to
complete an application
for the Adoption Contact
Register
Yes
S80 Adoption and
Children Act 2002
6 (c) legal
obligation
The rights to
object to
processing of
personal data or
have personal
data erased do
not apply
Other
government
departments
To enable the
recipient to
exercise one or
more of its
functions
Birth, Death, Marriage
and Civil partnership
registrations
Yes
S19AA Registration
Service Act 1953
6(e) public task.
The right to have
personal data
erased does not
apply.
