Privacy notice

Who we are

The National Archives is a non-ministerial government department, and the official archive and publisher for the UK Government, and for England and Wales. We are the guardians of over 1,000 years of iconic national documents.

We make our archives and our building available to the widest possible audience. To do this we need to acquire and process some personal information from you.

This privacy notice tells you what to expect when The National Archives collects personal information. This can be anything that identifies a living individual. It applies to information we collect about people who engage with us through

Our websites:

  • people who access our online content
  • people who contact us, or respond to surveys through our websites
  • people who upload material to our websites in a professional capacity
  • people who contribute to our websites by way of tagging, or comments on our blogs

Find more information on cookies, information we collect online, and user participation.

Our premises:

  • visitors to our building and grounds, (referred to in some legislation as the Public Record Office), including our car park, cafés, shop, events and educational spaces and people who sign up for our public wi-fi

Our services and activities:

  • people who register for a reader’s ticket
  • people who book for our events, talks and exhibitions, training courses (find more information on booking events)
  • people who make a purchase from us – from our shop, by downloading archival records, or buying images
  • people who contact us with an enquiry or a complaint, or to ask for information we have about them (a subject access request), or to make a freedom of information request
  • people who have signed up to our mailing list and to receive information from The National Archives
  • people who engage with us professionally, for example from government departments and from the wider archival sectors
  • people involved in collaborative academic partnerships
  • people who undertake tasks for The National Archives: staff, contractors, consultants, and volunteers (information about how we process their personal information can be found on The National Archives’ intranet)

If you are applying for a job with us, please see the privacy notice for civil service job applicants on the Civil Service Jobs website.

Our archival collections:

A very small percentage of government records containing personal information are selected for permanent preservation in our collection. They are made available in accordance with the Freedom of Information Act 2000, as amended by the Data Protection Act 2018. This includes records created by The National Archives itself.

Legal basis for processing your information

In order to collect, create or otherwise process your personal information for all these activities, The National Archives (as data controller) must have a legal basis for doing so under data protection legislation.

Under the direction of the Secretary of State for Digital, Culture, Media and Sport, the Keeper of Public Records (the Chief Executive of The National Archives) has official authority in the form of a statutory obligation under the Public Records Act 1958 to process personal information, in order to secure and to make accessible The National Archives’ records of the nation’s memory, and to deliver its services  as widely as possible.

Depending on the circumstances, we may also process your personal information because you, or your legal representative, have given us your consent (which you  can withdraw at any time). By giving us your consent you are agreeing to The National Archives processing your information in accordance with this privacy notice.

Consent is not the only legal basis under which we can acquire and process your personal information. We do not require your consent to process your personal information if

    • you have entered into a contract with us
    • you have made this information publicly available yourself
    • it is required by law
    • it is necessary for legal cases
    • it is necessary to protect someone in an emergency
  • it is to the benefit of the public in general
  • it is necessary for employment purposes
  • it is necessary for archiving, research, or statistical purposes – so long as certain conditions are met.

Circumstances under which we might process your information

Processing your personal information is required in order to: The  information that is necessary  for this  purpose is: The National Archives’ lawful basis for using your information
  • give you access via a reader’s ticket  to original archival documents in our reading rooms and to safeguard the integrity of our collection
  • your name and address
  • your reader’s ticket number
  • a record of the documents you have  ordered
 This is necessary for the exercise of our official authority by regulating the conditions under which members of the public may inspect public and other records.
  • send you marketing information we think you might find useful or which you have requested from us – including our regular email updates, and information about events and products – and to occasionally inform you of new services we will be providing or we consider will be of interest to you
  • your contact details
  • your marketing preferences
 Consent freely given by you when opting in to receive our regular email updates or other communications from us. You may withdraw your consent at any time by clicking on ‘unsubscribe’ in the emails that we send, or by contacting us directly at the address below.
  • conduct research and data analysis and develop statistics to better understand the use made of our building, our car park, and our archival collection, including event attendance and trends
  • records of your attendance at any events hosted by us, singly or jointly with another organisation
 This is necessary to perform our legitimate interest with you to ensure that our audience is targeted and relevant. Any research undertaken will done in accordance with safeguards in data protection legislation.
  • promote The National Archives, our courses and events, and for inclusion in educational/training material
  • images in video and/or photographic form
 Where you (including our staff) have given us your explicit consent to do so.
  • administer your attendance at any workshops, programmes or events you sign up to
  • contact details
  • transaction and payment information (we do not generally hold bank account or credit card details)
 This is necessary under your contract with us to enable us to register you and properly manage and administer your attendance. If you are signing up via a separate organisation, you will also have a contract with them.
  • administer your use of our car park
  • Vehicle Registration Mark
  • (VRM) as captured by Automated Number Plate Recognition (ANPR) camera
  • transaction and payment information (we do not hold bank account or credit card details)
 This is necessary under your contract with us to enable us to collect the correct charge for your use of our car park.
  • arrange and manage any contracts for the provision of any services or products: for example, downloading records from Discovery, purchases  from our shop.
  • contact details
  • transaction and payment information
  • records of your interactions with us
 This is necessary to enable us to properly administer and perform any contract for the provision of any services and products you have purchased from us.
  • manage the  security of our building
  • CCTV footage and any other records of your presence and conduct on our premises
 This is necessary for the exercise of our official authority by regulating the conditions under which members of the public may use the facilities of the Public Record Office.
  • manage the security of our IT systems
  • records of your usage of our IT systems and online portals
 This is necessary for the exercise of our official authority by regulating the conditions under which members of the public may use the facilities of the Public Record Office.
  • manage your interactions with our website or our public wi-fi
  • email address
  • username
 This is necessary for the exercise of our official authority to  regulate the conditions under which members of the public may use the facilities of the Public Record Office.
  • comply with health and safety requirements
  • records of attendance
  • CCTV footage
  • other information obtained through electronic means such as swipe card records, medical information about your health
 We have a legal obligation to provide you and everyone who visits or works at our premises with a safe environment.
  • use information about your physical or mental health (including any injuries) or disability status to ensure your health and safety when partaking in any of our events or activities
  • health and medical information, provided by you when signing up for  events and activities
 You have consented to provide us with this information, for your health and safety.
  • answer your queries or complaints
  • contact details
  • records of your interactions with us
 We have a legitimate interest to provide complaint handling services to you, and official authority to process your requests under the Data Protection and Freedom of Information Acts.
  • gather evidence for possible grievance or disciplinary hearings
  • all the personal information we collect
 We have a legitimate interest in doing so to provide a safe and fair environment for all staff and members of the public, and to ensure the effective management of any disciplinary hearings, appeals and adjudications.
  • investigate possible fraudulent use of public money
  • payroll data including details of salary, bank account and National Insurance Number
 We have a legitimate interest in identifying and investigating potentially fraudulent claims and payments.

Sharing your personal information outside The National Archives

Third parties will not have access to your personal information unless the law allows them to do so.

Use of data processors

Data processors are third parties who provide elements of our services for us. We have contracts in place with our data processors. This means that they cannot do anything with your personal information unless we have instructed them to do it. They will hold it securely and retain it for the period we instruct.

Sharing with third parties outside of a contract

We sometimes need to share your information with third parties. We will do this securely and with a data sharing agreement in place.  As a government department, we have a duty to abide by the terms of His Majesty’s Government’s Security Policy Framework, and to cooperate with any law-enforcement bodies, including the police, who have a requirement to see what personal information we may have about you.

We do not sell your information to any other organisations.

Acquiring information from third parties

We sometimes buy in lists of information from other organisations. We do this as part of our remit to make our services available to as wide an audience as possible. If we have acquired your information from a third party we will have ensured that the organisation obtained your freely-given consent for this.

If we invite you to an event or to take part in a survey, we may use a separate organisation to administer the booking or the survey. You will be giving your information directly to them and they will process it, and pass the necessary details to us. We recommend that you read their Privacy Notice.

Retention of your personal information

We keep your personal information for no longer than is necessary to fulfil the purposes for which it was collected, as described above or in another privacy notice provided to you, taking into account the requirements from the following criteria:

  • any laws or regulations that we are required to follow
  • whether we are in a legal or other type of dispute with each other or any third party
  • the type of information that we hold about you
  • whether you are still signed up to our services
  • retention in case of queries: we will retain it for a reasonable period in case of further queries from you
  • retention in case of claims: we will retain it for the period in which you might legally bring claims against us (in the UK this means we will retain it for six years)

If you unsubscribe from our newsletter, we will keep a record of the fact that you have unsubscribed.

If you would like further information about our information retention practices, please contact us.

Your rights over your personal information

Data protection legislation gives you various rights over your information.  These may include (as relevant) the right to:

  • Access information held about you: you must provide us with valid ID, and with enough information to enable us to identify your personal information. In certain circumstances, under data protection legislation, we may not be required to provide all the details of personal information held. . You are only entitled to your own personal data, and not to information relating to other people. If your request is manifestly unfounded or excessive, we can request a “reasonable fee” to deal with the request; or refuse to deal with it. We will provide you with an explanation of this decision.
  • Amend and rectify personal information that is inaccurate and notify any third party recipients of the necessary changes. If your information is in our archival collection we will not alter the record. It may be to your advantage to have this documentary proof that a government record was incorrect. We will, however, consider adding the correct information to the archival record.
  • Request restriction of information processing concerning you or to object to processing of your personal information.
  • Request the erasure of your personal information where it is no longer necessary for us to retain it. If your information is in our archival collection, we will consider withdrawing public access to it: please see our takedown and reclosure policy.
  • Data portability, including to obtain personal information in a commonly-used, machine-readable format in certain circumstances, such as where our processing of it is based on a consent. This is to assist you if you wish to transfer your information to another organisation. This does not apply to information in our archival collections.
  • Object to automated decision-making, including profiling (if any) that has a legal or significant effect on you as an individual and the right to object to marketing.
  • Withdraw your consent to any processing for which you have previously given that consent, without affecting the lawfulness of any processing based on your consent prior to its withdrawal.

Please see the details in the contact us section below if you wish to exercise any rights. We endeavour to acknowledge requests within three working days and to supply the appropriate response and information promptly and within the relevant statutory timescale (usually one month).

Processing your personal information outside of the EU

All EU countries, including the UK, process personal information according to the General Data Protection regulations, which requires them to have a legal basis for processing it, and gives you rights over your information. Countries outside the EU, although they may have their own Data Protection legislation, will not be subject to the same EU regulations.

Accordingly, we exercise particular care if we need to send your information outside the EU. This ranges from arranging secure methods of transferring it to ensuring that we have a robust contract in place with any third party. If necessary we may send specialist IT staff abroad to inspect and approve the conditions under which your information would be processed.

We comply with the government’s current policy for off-shoring (processing outside the UK).

We will take all practical steps to make sure your personal information is not sent to a country that is not seen as ‘safe’ either by the UK or EU governments.

If you are accessing our services from outside the EU then any information you send or receive from us will, of necessity, be transferred via a non-EU country.

Keeping personal information secure

The National Archives takes the technical and organisational security of all the information it holds very seriously. All our staff receive training in how to handle personal data when they join us and have to take an annual refresher course. We protect your information using varying levels of encryption. We also make sure that any third parties with which we deal have an obligation to keep all personal information they process on our behalf secure.

People in our archival collections

The National Archives has a statutory obligation to permanently preserve the archives of the government and certain other public and private historic records, as detailed in our public catalogue, and to make them available for use. These are documents (including files, maps, pictures, posters, films and sound recordings in analogue and digital form) that have been produced by central offices of the state and the law courts dating back to medieval times. The National Archives provides advice and guidance to transferring government departments and agencies as to whether these documents are worthy of archival preservation – that is, whether they have lasting value for the research and understanding of history and the present, or for the protection of legitimate interests of citizens or for purposes of legislation, administration and jurisdiction.

We guarantee access to this archival material while observing the protection of private or public interests. In principle, every person has the right to access the documents in The National Archives upon request. We provide information about the archive material on our Discovery research platform.

Some of the more recent archives we hold contain information about living people: personal information that has been acquired by the organisations – usually government departments that have transferred their records to The National Archives. Your information will be handled according to the safeguards in data protection legislation for archiving in the public interest. This means that we apply the same standards to handling this information, except that some of your rights have a limited application – see the Your rights over your personal information section above. The National Archives has co-produced detailed guidance about data protection legislation as applied to archives in the UK.

We allow third party publishers to digitise some of our records for online use.  We and our publishers make every effort, taking into account the content and condition of the material, to avoid putting personal information online that may cause damage or distress to living individuals. As data processors, our publishers must comply with data protection legislation; in particular, they have a duty to assist you in exercising your rights over your personal information.

We, or our publishers, may use automated profiling to calculate when personal information that is closed for a person’s lifetime can be made open. To do this we assume a lifespan of 100 years. This may result in information on people who are aged over 100 being made public. If this is the case, please contact The National Archives and we will remove your information from public access.

People who use information about living people from the archives have a duty, under data protection legislation, not to use that information in a way which may cause distress or damage to them. You should also be aware that, just because information is in the public domain, it does not necessarily make it lawful for you to make it public. Personal information is not covered by the Open Government Licence and may also be subject to copyright. Find more information about copyright.

Where to find out more

Contact us

We welcome comments or queries about this privacy notice and our information handling practices.

If you wish to provide comments, update any of your preferences or exercise any of your rights you can use our form. We will respond to you within ten days of receiving your enquiry.

Telephone: +44 (0) 20 8876 3444.

Postal address: The National Archives, Kew, Richmond, Surrey TW9 4DU.

For more information please contact our Data Protection Officer, Linda Stewart, at the above address. Email addresses follow the format firstname.lastname@nationalarchives.gov.uk.

View our complaints procedure.

For independent advice about data protection, privacy and data-sharing issues you can contact the Information Commissioner:

Postal address: Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF

Telephone: 0303 123 1113.

Website: https://ico.org.uk/global/contact-us/helpline

Information on data protection

Data protection policy (PDF, 0.28 MB)