This notice sets out how we will process your personal data, and your rights. It is made under Articles 13 and/or 14 of the UK General Data Protection Regulation (UK GDPR).  

The Department for Science, Innovation and Technology (DSIT) helps to drive innovation that will deliver improved public services, create new better-paid jobs and grow the economy. 

This Privacy Notice concerns the Cyber Security Longitudinal Survey Wave Four. The Cyber Security Longitudinal Survey surveys businesses and charities about their cyber security.  

The Cyber Security Longitudinal Survey is commissioned by the DSIT (“we” and “us“, “DSIT“). DSIT is the Controller for the personal information processed as part of this survey.  

Ipsos Ltd works on behalf of DSIT for the Cyber Security Longitudinal Survey as a data processor (to collect and process personal information). DSIT will not have access to any personal data. Ipsos’s Privacy Notices provide more information on how your personal data will be processed. 

DSIT will not process any personal data. Information on personal data is provided by Ipsos, our data processor, in their Privacy Notices.

The purpose(s) for which Ipsos is processing your personal data is to conduct Wave 5 of the Cyber Security Longitudinal Survey (including an online/telephone survey and follow-up interviews). This research informs government policy on cyber security. 

The legal basis for processing your personal data under Article 6 of the UK GDPR is:  

1(a)Consent: You consent to the processing of your personal data for one or more specific purposes. Should you change your mind, you can withdraw consent at any time by seeing Ipsos’s Privacy Notices.  

DSIT will not receive or store any personal data. Our data processor, Ipsos, has provided information on retention of personal data in their Privacy Notices. 

You have the right to request information about how your personal data are processed, and to request a copy of that personal data.  

You have the right to request that any inaccuracies in your personal data are rectified without delay.  

You have the right to request that any incomplete personal data are completed, including by means of a supplementary statement.  

You have the right to request that your personal data are erased if there is no longer a justification for them to be processed.  

You have the right in certain circumstances (for example, where accuracy is contested) to request that the processing of your personal data is restricted.  

You have the right to object to the processing of your personal data where it is processed for direct marketing purposes.  

You have the right to withdraw consent to the processing of your personal data at any time.    

To exercise your rights please contact the Data Protection Officer using the contact details below. 

The data controller for your personal data is the Department for Science. Innovation and Technology (DSIT). You can contact the DSIT Data Protection Officer at:  

DSIT Data Protection Officer  Department for Science, Innovation &Technology  22-26 Whitehall  London  SW1A 2EG 

Email: [email protected] 

If you are unhappy with the way we have handled your personal data, please write to the department’s Data Protection Officer in the first instance using the contact details above.  

If you consider that your personal data has been misused or mishandled, you may make a complaint to the Information Commissioner, who is an UK independent regulator.  The Information Commissioner can be contacted at:  

Information Commissioner’s Office Wycliffe House Water Lane Wilmslow Cheshire SK9 5AF 

Telephone: 0303 123 1113 

https://ico.org.uk/make-a-complaint/ 

Any complaint to the Information Commissioner is without prejudice to your right to seek redress through the courts.  

If this privacy notice changes in any way, we will place an updated version on this page. Regularly reviewing this page ensures you are always aware of what information we collect, how we use it, and under what circumstances we will share it with other parties. The ‘last updated’ date at the bottom of this page will also change. 

If these changes affect how your personal data is processed, we will take reasonable steps to let you know. 

Last updated: 07/06/25.