Last updated: 24 April 2025
Controller and data protection officer contact details
The Environment Agency is the controller for the personal data we process under the UK General Data Protection Regulation (UK GDPR) and Data Protection Act 2018 (DPA 2018).
Our personal information charter explains:
- how to contact our data protection officer
- what we do with your personal information (personal data) in general
- your rights and how to complain to the Information Commissioner’s Office
Why we may process your personal data
We process your personal data to do research to improve public services.
The lawful basis we rely on is article 6(1)(e) of the UK General Data Protection Regulation (UK GDPR), which allows us to process personal data when this is necessary to perform a task in the public interest. The processing has a basis in the Water Resources Act 1991 (as amended by the Water Act 2003), Environment Act 1995 and the Water Resources (Abstraction and Impounding) Regulations 2006.
For contacting you about research, we rely on your consent. You can withdraw your consent at any time by telling your researcher or emailing water_abstractiondigital@environment-agency.gov.uk.
For special category ‘sensitive’ data, we rely on article 9(2)(g) of the UK GDPR which allows us to process this where there is a substantial public interest.
What personal data we process and how we use it
We collect personal data directly from you, such as: your contact details, views and experiences of a topic, and personal characteristics relevant to the research.
We use your personal data to:
- create research insights to help improve public services
- communicate with you about relevant research activities
- decide if you’re suitable for a research activity (screening)
- manage and administer research activities
Your personal data may be processed by organisations acting on our behalf, such as:
- research agencies or consultants
- providers of tools and software
- incentive payment administrators
- the Department for Environment, Food & Rural Affairs
If you were recruited for this research via a third party, then they may share your contact and screening data with us.
We do not use your personal data to make an automated decision or for automated profiling.
Where personal data is stored and processed
Most of your personal data will be stored and processed in the UK or European Economic Area.
If we need to use storage based elsewhere, we will only transfer your data to a country that is deemed adequate under Article 45 of the UK GDPR.
How long we keep your personal data
We will keep your personal data for up to 3 years. We will erase data sooner if further research analysis is unlikely or if we don’t expect to contact you again.
Changes to this notice
We may change this privacy notice. When this happens, the last updated date will change.
If these changes affect how your personal data is processed, we will take reasonable steps to let you know.