Data protection legislation and personal data
Data protection legislation determines how, when and why any organisation can process personal data. ‘Personal data’ means any information which can identify someone. ‘Processing’ means any actions performed on personal data, including collection, storage, alteration or deletion. These laws exist to ensure that your data are managed safely and used responsibly. They also give you certain rights in respect of your data. The Institute for Employment Studies (IES) has a responsibility to provide you with information about how your data are processed.
This research looks at the use of AI among staff delivering the Restart scheme. For this project, the Department for Work and Pensions (DWP) is the data controller, and the Institute for Employment Studies (IES) is the data processor. As the data controller, DWP is responsible for determining the purpose and legal basis for processing personal data collected as part of the research. The research is funded through the ReAct partnership, which brings together the Prime providers delivering Restart in different parts of England and Wales.
This privacy notice sets out the legal basis for processing data in relation to this research project. This includes who will have access to your personal data, how your data will be used, stored and deleted, your legal rights and who you can contact with a query or a complaint.
The legal basis for processing personal data
The legal basis under which this personal data will be processed is ‘public task’. This means that DWP is required to carry out this research in order to perform its functions in the public interest.
This legal basis applies to this research project, which is focused on ways to improve the delivery of the Restart scheme. The evaluation will involve interviews and observations with staff who deliver Restart and use AI tools in various roles within Prime Providers, and participants receiving support from AI tools. Where appropriate, it may also involve external organisations delivering training and support around AI tools. We may also observe interactions between customers and AI tools. All information will be treated confidentially and securely.
Any personal information we collect (such as your name and contact details) will only be processed for the purposes of conducting this research. Participation is entirely voluntary. You do not have to take part, and you may decline the invitation without providing a reason. Taking part or choosing not to take part will have no effect on your employment, your organisation’s relationship with DWP, or any services that you provide or receive.
Who will have access to my personal data?
Your contact details will be stored on an encrypted server, with access restricted solely to members of the research team. Even after these contacts details have been shared with the research team, you are still free to withdraw from the research and can decline to take part in an interview without having to give a reason.
If you agree to take part in a research interview, any information you provide will be summarised in an anonymised format. This means we will remove any information that could be used to identify you. For example, we might say that “some people thought X, other people thought Y”. Quotes may be used, but they will not be attributed to you. Anything that could identify you, such as an individual’s name, will be removed from the quote.
How will my data be treated?
If you choose to take part in an interview, the information you give will only be used for purposes of this study. IES will produce a report summarising the main findings from the interviews. The findings from this research will be shared with DWP and the Prime Providers of Restart and may be published on the IES website. Any reporting will be anonymised, and no individual will be identified in any reports or publications arising from the study.
Data protection law requires that personal data are kept for no longer than is necessary. We will anonymise the information you provide as soon as we practically can, and the personal data we used to contact you will be securely deleted from the IES systems three months after the project is complete (currently estimated to be the end of February 2027).
Who can I contact if I would like to withdraw my interview data?
You have rights under data protection law to make the following requests the personal data held about you that is being processed for this research, including:
- to request access to this data
- to amend any incorrect or inaccurate information
- to restrict or object to your data being processed
- to destroy this data
- to move, copy or transfer your data.
You have the right to withdraw the information you have provided as part of the interviews up to 2 weeks after the interview date. After this point the information will have been anonymised and will no longer be treated as personal data.
If you have taken part in an interview but would like your data withdrawn, please contact: [email protected]
Who can I contact with a query about how my data will be used?
If you have any questions about how your data will be used, please contact Joseph Cook, Project Manager of this research: [email protected]
You may also contact the IES Data Protection Adviser, Tony Lloyd: [email protected]
Who can I contact with a complaint?
Further information on the rights available to you is also available from the Information Commissioner’s Office – the independent body responsible for regulating data protection within the UK. They can also deal with any complaints you may have regarding our use of your data:
- Tel: 0303 123 1113
- Email: [email protected]
- Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF