Audit and Assurance Privacy Notice

Our core data protection obligations and commitments are set out in the organisation’s primary privacy notice.

This notice provides additional privacy information for: individuals for whom we share data with the Cabinet Office under the National Fraud Initiative; and also for persons who may become party to a fraud investigations.

---

Purposes

We hold your personal information for the following purpose(s):

• Fraud prevention and detection

---

Categories of personal data

In order to carry out these purposes we collect and obtain:

• Personal details;
• Financial details;
• Goods and services provided;
• Case file information;
• business activities of individuals;
• Employment and education details;
• Visual images, personal appearance and behaviour;
• Details of complaints;
• Family details;
• Incident and accident details; and
• Licenses, permits or certificates held;

We may also collect, store and use the following special category personal information:

• Race or ethnic origin;
• Political opinions;
• Religious or philosophical beliefs;
• Trade union membership;
• Health;
• Sex life;
• Sexual orientation;
• Criminal Offence data.

---

Legal basis for processing

The legal basis we rely on for processing your personal information is:

• The processing is necessary to meet our legal obligations in the Accounts and Audit Regulations 2015; and/or
• The processing is necessary for the performance of a task carried out in the public interest.

The legal basis we rely on for processing your special category personal information is:

• The processing is necessary for the purpose of protecting the public against dishonesty;
• The processing is necessary for the purpose of regulatory requirements relating to unlawful acts and dishonesty; and/or
• The processing is necessary for the purpose of preventing fraud.

---

Information sharing recipients

We may share personal information about you with the following types of organisations:

• Cabinet Office – for the purpose of data matching under the National Fraud Initiative

---

Sources of personal data other than the data subject

As well as information directly collected directly from you, we also collect or receive information from:

• Other departments in TfGM e.g. payroll, finance
• For fraud investigations a number of external sources may be used dependent on the investigation, for example liaison with the police or interviewing third parties.

---

Automated decisions

For this processing, all the decisions we make about you involve human intervention

---

Data retention criteria

Our Retention Schedule outlines how long we retain certain types of information for.

---

Rights of individuals

You have a right to be informed about how and why your personal information is being processed. This notice fulfils that obligation. You also have a number of other rights.

Information about the following rights is available in our Guide to Exercising Your Rights:

• Contacting our Data Protection Officer;
• Raising a concern with us; and/or
• Making a compliant to the Information Commissioner

---

Updates

We may update or revise this Privacy Notice from time to time and provide supplementary privacy information as is necessary to TfGM’s current workforce.

---