Privacy policy

Note: this section was updated on 3 February 2022 to change the period of time we hold your data from 6 months to 3 years. We also updated who we may share information with to include selected translation companies where responses are in languages other than English.

We conduct a range of research projects as part of our role to support the Victims’ Commissioner in reviewing the services that criminal justice agencies provide to victims of crime. This includes research with victims of crime, as well as professionals and practitioners who work with victims. The information we collect will depend on the nature of the study you are participating in. We will only collect the minimum amount of information needed for each research review we conduct.

Examples of personal data that we may collect are listed here. Please note that this information will only be collected when it is relevant to the research review you are taking part in:

• your name and contact details (email, address, phone number)
• information relating to a crime committed against you
• information about your family or personal circumstances
• information concerning your health and medical conditions
• information relating to your occupation
• other information relevant to the research study you are participating in

Using your data

We collate the information you provide, with the information provided by other participants in each research review project. We use this information to review the services provided by criminal justice agencies in line with the Victims’ Commissioner’s role.

Any published research review outputs will be at a summary level and your personal data will be anonymised. The exception to this is where we use in-depth case studies, whereby your personal data will be anonymised as far as possible. We will work with you in these circumstances to ensure that as far as possible you will not be identifiable from these outputs.

SmartSurvey

The OVC uses a SmartSurvey account to collect survey responses for some of our research reviews. SmartSurvey collects and stores your response on our behalf in a highly secured environment. The OVC uses specific settings on our account so that your IP address is not recorded and linked to your survey response. Your response is therefore anonymised as far as possible.

SmartSurvey do not use your data other than to collect and store your survey response on our behalf. This may be processed and stored by SmartSurvey within the European Economic Area (EEA). Your response is owned and managed by the OVC in line with the rest of this privacy notice. The OVC will delete your response from SmartSurvey once the survey has closed and the data has been securely saved by the OVC. If you have any queries about the handling of your data by SmartSurvey then please contact the OVC.

Who information may be shared with

We sometimes need to share the personal data we collect from you with trusted third parties. We will always notify you if we will be sharing your personal data. We will notify you when we gain consent from you to take part in the research study.

Please note that we only share your personal data with a third party when it is relevant and needed for a specific purpose. Examples of third parties we may work with include:

• other government department, agencies or arm’s-length bodies, such as the Ministry of Justice, when we require staff from these organisations to support us in our work;
• selected translation companies where responses are in languages other than English;
• transcription companies who we may work with to type up recorded interviews.

The OVC does not transfer personal information overseas other than where SmartSurvey may process and store survey responses within the EEA.

How long we keep your data

Your personal data will be destroyed or anonymised within 3 years of the publication of the research.

An exception to this is that OVC, alongside other government departments, agencies and public sector bodies, has been instructed by the Independent Inquiry into Child Sexual Abuse (IICSA) to retain any and all documents, correspondence, notes, emails and all other information which contain or may contain content pertaining directly or indirectly to the sexual abuse of children or to child protection and care. For the purposes of this instruction, the word ‘children’ relates to any person under the age of 18.

More information

Contact us if you need more information about:

• agreements we have with other organisations for sharing information
• circumstances where we can pass on personal information without telling you, for example to help with the prevention or detection of crime or to produce anonymised statistics
• our instructions to staff on how to collect, use or delete your personal information
• how we check that the information we hold is accurate and up-to-date
• how to contact the Office of the Victims’ Commissioner’s Data Protection Officer

The OVC collects personal data to answer correspondence queries you ask of us.

Using your data

We only process personal data that is relevant for the services we are providing to you. This may include information relating to the crime committed against you, or someone you are corresponding with the OVC on behalf of or, from a criminal justice agency that you have highlighted to us as being involved in your case. We will safeguard your personal data and will only disclose it where it is lawful to do so, or with your consent.

Who information may be shared with

We sometimes need to share the personal information we process with the individual themselves and also with other organisations. Where this is necessary we will comply with all aspects of the data protection laws. We only share your information with the organisation, or organisations relevant to your query.

These organisations are:

• Organisations that provide services under the Code of Practice for Victims of Crime (in accordance with the Code’s introduction and chapters 1 to 4):
  • The Criminal Cases Review Commission (CCRC)
  • The Criminal Injuries Compensation Authority (CICA)
  • The Crown Prosecution Service (CPS)
  • The First-tier Tribunal (Criminal Injuries Compensation)
  • Her Majesty’s Court and Tribunals Service (HMCTS)
  • Her Majesty’s Prison and Probation Service (HMPPS)
  • The Parole Board
  • Police and Crime Commissioners (PCCs)
  • All police forces in England and Wales, the British Transport Police and the Ministry of Defence Police
  • The UK Supreme Court
  • Witness Care Units
  • Youth Offending Teams
• Organisations that provide services under the Code of Practice for Victims of Crime (in accordance with chapter 5 of the Code only):
  • The Competition and Markets Authority (CMA)
  • The Department for Business, Energy and Industrial Strategy (BEIS)
  • The Environment Agency
  • The Financial Conduct Authority (FCA)
  • The Gambling Commission
  • The Health and Safety Executive (HSE)
  • Her Majesty’s Revenue and Customs (HMRC)
  • Home Office (Immigration Enforcement)
  • The Information Commissioner’s Office
  • The Independent Police Complaints Commission
  • The National Crime Agency
  • Natural Resources Wales
  • The Office of Rail and Road
  • The Serious Fraud Office
• Other organisations:
  • The Department for Health and Social Care

The OVC does not transfer personal information overseas.

How long we keep your data

Information collected through correspondence is destroyed by the OVC 5 years after the correspondence is closed.

An exception to this is that OVC, alongside other government departments, agencies and public sector bodies, has been instructed by the Independent Inquiry into Child Sexual Abuse (IICSA) to retain any and all documents, correspondence, notes, emails and all other information which contain or may contain content pertaining directly or indirectly to the sexual abuse of children or to child protection and care. For the purposes of this instruction, the word ‘children’ relates to any person under the age of 18.

More information

Contact us if you need more information about:

• agreements we have with other organisations for sharing information.
• circumstances where we can pass on personal information without telling you, for example to help with the prevention or detection of crime
• our instructions to staff on how to collect, use or delete your personal information
• how we check that the information we hold is accurate and up-to-date
• how to make a complaint
• how to contact the Office of the Victims’ Commissioner’s Data Protection Officer

The Office of the Victims’ Commissioner (OVC) is an independent arms-length body of the Ministry of Justice (MoJ). The Ministry of Justice is committed to protecting the privacy and security of your personal information. This privacy notice explains how your personal information will be collected, used, stored and shared in connection with the Victim and Survivor Child Sexual Abuse and Exploitation Advisory Panel. It applies to information collected during the recruitment and selection of Panel members and, where relevant, through participation in the Panel and wider engagement activities.

You will be provided with this privacy information as part of the recruitment process and before your personal information is used for the purposes described in this notice. The Office of the Victims’ Commissioner for England and Wales forms part of the Ministry of Justice. The Ministry of Justice is the data controller for personal data processed by the Office of the Victims’ Commissioner for the purposes of the Panel.

This notice should be read alongside the Office of the Victims’ Commissioner’s general privacy notice, which provides further information about how personal information is handled by the Office.

The type of personal data we process

Personal data is information that relates to an identified or identifiable individual. As part of the recruitment and selection process for Panel members, and through participation in the Panel or wider engagement activities, we may collect and use information including:

• your name;
• address and broad geographic location;
• contact details;
• information about your personal circumstances;
• information about your experiences as a victim or survivor of child sexual abuse or exploitation;
• information relating to criminal offences committed or alleged to have been committed against you; and
• other information that you choose to provide which is relevant to your application or participation in the Panel.

We may also process special category personal data where this is relevant to recruitment, equality monitoring or your participation in Panel activities. This may include information about:

• racial or ethnic origin;
• religious or philosophical beliefs;
• health or disability;
• sexual orientation; and
• sex life.

We may also collect other sensitive personal information, including:

• age;
• sex, gender or gender identity; and
• information relating to criminal convictions, offences or allegations.

How we get your personal data and why we have it

Most of the personal information we process is provided directly by you. We may collect information from you:

• when you correspond with us;
• when you apply to join the Panel or take part in the recruitment and selection process;
• when you participate in Panel meetings, interviews, focus groups or other engagement activities; and
• when you take part in wider engagement opportunities connected with the Panel.

As part of the recruitment and selection process, we may also obtain information about you from other sources. This may include:

• information obtained through a Basic Disclosure and Barring Service (DBS) check; and
• information that is publicly available online, including publicly accessible social media profiles and other public websites, where proportionate and relevant to the recruitment process.

Any online checks will be limited to information that is publicly available and relevant to assessing an applicant’s suitability for participation in the Panel.

We use the personal data we receive in order to

• manage and conduct the recruitment and selection process;
• carry out proportionate due diligence checks in relation to prospective Panel members;
• respond to correspondence and communicate with applicants and Panel members;
• administer and support participation in the Panel;
• undertake lived experience engagement and understand the views and experiences of victims and survivors;
• analyse themes and insights arising from Panel and wider engagement activities;
• support the work of the Victims’ Commissioner and inform relevant government policy and practice; and
• provide information about relevant Panel activities and wider engagement opportunities.

We ask only for the personal information that we need for the purposes described in this privacy notice and will not collect information that is irrelevant or excessive.

Who we may share your personal information with

Where necessary and proportionate, we may share your personal information with:

• the Home Office, for the purposes of supporting oversight of the Panel and informing the development, evaluation and improvement of government policy and practice relating to child sexual abuse and exploitation;
• other government departments where this is necessary to support relevant policy development or engagement with the Panel;
• statutory organisations or services where sharing is necessary to meet legal or safeguarding responsibilities; and
• other organisations where we are required or permitted to do so by law.
• As part of the recruitment and selection process, we may share relevant information from your application with external sector practitioners who are supporting the Office of the Victims’ Commissioner with application sifting and interviews. They will only be given access to the information necessary for their role and will be required to keep it secure and confidential and use it only for the recruitment process.

Wherever possible, information shared with the Home Office or other government departments will be anonymised or aggregated. Where personal information needs to be shared, we will limit this to the minimum information necessary and take steps to remove direct identifiers and reduce the risk of identification.

The Home Office will act as a separate controller for any personal information it receives and processes for its own purposes. Further information about how the Home Office processes personal information will be provided through its own privacy information.

Our lawful basis for using your personal information

Under the UK General Data Protection Regulation (UK GDPR), we rely on Article 6(1)(e) – public task. This means that the processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority.

The processing supports the statutory functions of the Victims’ Commissioner under the Domestic Violence, Crime and Victims Act 2004, including promoting the interests of victims and witnesses, encouraging good practice in their treatment, and consulting individuals in connection with those functions.

Where we process special category personal data, we rely on Article 9(2)(g) UK GDPR – processing that is necessary for reasons of substantial public interest – together with the relevant condition under Schedule 1 of the Data Protection Act 2018.

We will only process special category personal data where it is necessary and proportionate for the purposes of recruiting, administering and operating the Panel and supporting the statutory functions of the Victims’ Commissioner.

Where we process information relating to criminal convictions or offences, we will do so only where there are an appropriate lawful basis and condition under data protection law.

Your decision to take part in the Panel is voluntary. Where we ask for your agreement to participate in Panel activities, this relates to your participation in the Panel and is separate from the lawful basis we rely upon under data protection law.

International Data Transfers

There are no international transfers

How we store your personal data

Your personal information will be stored securely within approved Ministry of Justice systems, with access restricted to authorised staff who require it for the purposes described in this privacy notice.

We will retain your personal information only for as long as it is necessary for the purposes for which it was collected and in accordance with applicable records management and retention requirements.

Information collected as part of the recruitment and selection process will be retained only for as long as necessary to complete the recruitment process, manage participation in the Panel and meet any relevant audit, assurance or records management requirements.

Personal information relating to your participation in the Panel will be retained for the duration of the Panel and, where necessary, for a limited period following its conclusion.

Aggregated or fully anonymised information, including thematic findings and policy insights, may be retained for longer where there is an ongoing need to support policy development, evaluation, accountability or organisational learning.

When personal information is no longer required, it will be securely deleted or disposed of in accordance with the relevant records management and information security requirements.

Your rights

• Your right of access – You have the right to ask us for copies of your personal information.
• Your right to rectification – You have the right to ask us to rectify personal information you think is inaccurate. You also have the right to ask us to complete information you think is incomplete.
• Your right to erasure – You have the right to ask us to erase your personal information in certain circumstances.
• Your right to restriction of processing – You have the right to ask us to restrict the processing of your personal information in certain circumstances.
• Your right to object to processing – You have the right to object to the processing of your personal information in certain circumstances.

Depending on the lawful basis on which your personal data is being processed, not all rights will apply.

You are not required to pay any charge for exercising your rights. For more information about your information rights and how to exercise them, please see the Ministry of Justice Information Charter: Personal information charter – Ministry of Justice – GOV.UK

Freedom of information requests

You have the right to ask us what information we hold about you. This is sometimes known as a ‘freedom of information (FOI) request’ or a ‘subject access request’.

Find out more making a request and contact us if you if you want to make one.

How to complain

If you have any concerns about our use of your personal data, you can contact the MoJ data protection officer;

Data Protection Officer

Ministry of Justice

5^th Floor, Post Point 11.52

102 Petty France

London

SW1H 9AJ

dpo@justice.gov.uk

You can also complain to the ICO if you are unhappy with how we have used your data.

Information Commissioner’s Office

Wycliffe House

Water Lane

Wilmslow

Cheshire

SK9 5AF

Helpline number: 0303 123 1113

ICO website: https://www.ico.org.uk

Date of last review: October 2026

We only process personal data that is relevant to sending you our newsletter – VC Bulletin – such as your name and email address, and where appropriate, the organisation you work for and your role within that organisation.

Using your data

We collect the information you provide and store it securely within our own organisation. It will only be processed by members of the OVC for the purposes of sending out the newsletter.

Who information may be shared with

We will not share your information with third parties, and the OVC does not transfer personal information overseas.

How long we keep your data

You can unsubscribe from our newsletter mailing list at any time. If you request to be removed from the mailing list, the personal data we hold for you will be deleted within 1 month from receiving your email. If the newsletter stops circulation, your personal data will be deleted within 6 months after the circulation ends.