Tax data privacy notice

We’ll be the data controller for your personal data gathered as part of the 2 taxes we manage.

A data controller is someone who, on their own or jointly with others, decides what and how your personal data is used.

If other organisations give us information about you, and we add it to information we already hold about you, we’re also the data controller for this.

The personal data we collect, store, and use when you deal with us, includes your:

• title and full name
• current and previous addresses
• date of birth
• email address
• phone numbers
• forms of identification, such as National Insurance number, passport, driving licence
• information related to tax transactions, including any:
  • addresses
  • amounts involved

We’ll also collect information about any business involved, including their:

• company or trading name
• contact details
• addresses
• company number, if applicable
• VAT registration number, if applicable

We may also collect further personal data to assist with refunds, enquiries, and investigations.

We’ll only use your personal information in the following ways to support the Welsh taxes we collect and manage.

To ensure compliance with tax legislation

We’ll use your data to:

• assess the risk of tax avoidance, error and fraud in returns and payments
• take risk‑based decisions via automated processing which may lead to further investigation
• reduce avoidance, error, and fraud by recovering debt and issuing penalties
• take any lawful action for tax compliance
• send operational updates to agents

To work with public sector partners

In some cases, where the law allows, we’ll share and link data about you or your agent with:

• law enforcement agencies
• other government departments, including:
  • HMRC
  • Revenue Scotland
  • HM Land Registry
  • Welsh Government
• local authorities
• Natural Resources Wales

We’ll ensure information about you or your agent is not shared outside the WRA, unless:

• there’s a lawful reason to do so
• the processing is fair and necessary

Data shared with us, such as from other government departments, is generally not available to everyone. Sometimes non-personal data may be available, for example, property information provided by HM Land Registry.

For our analysis and research

We’ll use data to help us better understand Welsh taxes and improve our services, such as providing guidance and communication in the way you asked.

We also analyse data and publish statistics on our website. We’ll ensure neither you nor your agent can be identified in analyses or research reports that we publish.

The public can use the information we can publish for their purposes via an Open Government Licence.

We’ll only use your personal information when the law allows us to and most commonly in the following circumstances:

• due to our statutory function
• where we need to comply with a legal obligation
• where we may be obligated to hold data for compliance reasons
• where we have your informed consent

Specific powers within the Tax Collection and Management (Wales) Act 2016 apply in these cases, under:

• Section 12 Main functions
• Section 13 Internal authorisation to carry out functions
• Section 14 Delegation of functions
• Section 16 Use of information by the WRA and delegates

Our lawful basis for using your personal information under the UK General Data Protection Regulation (UK GDPR) is usually Article 6(1)(e) – public task, and Article 6(1)(a), where we ask for your consent.

This means we can use your personal information to collect and manage devolved taxes and ensure you pay the correct amount of tax.

Sometimes we’ll need to process special categories of personal data. We may need to do this to provide extra support to you or to store communication preferences which may reveal something about your health, even if you’ve not told us yourself. We’ll rely on your consent to hold this data.

All data we hold is subject to:

• UK General Data Protection Regulation (UK GDPR)
• Data Protection Act 2018
• any other applicable domestic and EU law

As the data controller, we may decide to share your data with others as described, including:

• non-government agencies
• researchers for statistical or research purposes

In every case, disclosures will be approved and controlled by an appropriate data access agreement that will:

• limit the use of your data to the specific identified purpose
• not identify you in any published reports
• allow your data only to be stored for the duration of the research and destroyed afterwards
• demand that your data is handled and processed and destroyed securely

Wherever possible we will remove any information about you or your agent. We will only pass your data to others where the law allows it, and where the research would not be possible without it.

We’ll keep your data for as long as we need to carry out our duty.

We may need to keep data for more than 25 years to check avoidance, fraud or error in separate transactions made many years apart by the same person.

Non-identifiable information used in analysis or research may be kept for as long as it’s useful.

Any personal information we collect about you or your agent will be collected, stored, and transmitted securely.

We’ll only share information about you with others where:

• it’s lawful to do so
• required for an identified purpose

UK GDPR lists certain rights that you have concerning your data. These rights are about the lawful basis for collecting and using your data.

For most uses made of your data, you have the right to be informed (which this notice covers).

Data about you supplied directly to us for tax collection and management, and to comply with tax law

This will include advice and guidance we provide in respect to our taxes.

You have the right to:

• be informed (this notice - this may be restricted in certain circumstances)
• access your information (this may be restricted in certain circumstances)
• correct errors in your information (this may be restricted in certain circumstances)

See the following for how other rights apply in some circumstances.

For any questions about this notice or your rights, please contact our Data Protection Officer.

Send complaints to this contact in the first instance. You can also complain directly to the Information Commissioner’s Office (ICO). The ICO is the UK supervisory authority for data protection issues.

Any changes to this privacy notice will be updated on this page, for example, any new uses of personal data.

From time to time, we may also contact you through other means about the processing of your personal data.