DSIT Privacy Notice

DSIT Cyber Professional Titles Fund Privacy Notice

This notice is provided to meet our legal obligations as set out in Articles 13 and 14 of UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018 (DPA). This Privacy Notice sets out:

who is collecting your personal data
why we need to collect your personal data
the categories of personal data that we may process
the legal bases of the processing
who has access to your data and with whom the data may be shared
how long we will retain your data
how we will protect your data
where we will store your data
consequences of failure to provide personal data
your rights as a data subject.

Who is collecting your personal data

EMB Limited (company number 05478619) has been commissioned by the Department for Science, Innovation and Technology to administer the Cyber Professional Titles Fund.

DSIT and EMB are separate Data Controllers for the personal information collected as part of this Scheme.

More information about EMB can be found at: www.embltd.co.uk/aboutus

Contact Details

EMB’s Data Protection Officer can be contacted at: dataprotectionenquiries@embltd.co.uk

EMB is committed to being transparent about how we collect and use personal data and to meeting our data protection obligations.

Why we need to collect your personal data

We collect your personal data as part of the application process for the Cyber Professional Titles Fund in order to:

Check that you are eligible to apply for the Fund and to check that you are eligible to be assessed for the specialism and level for which you have applied.
Notify and check your employment with your line manager and employing department
Maintain records of the applicants to the Fund.
Notify the licensing body that you have chosen to use that you have been awarded funding for an assessment and the specialism and level that you have selected.

The personal data that we may process

The personal data that we are required to collect and process for the Cyber Professional Titles Fund includes:

name of the applicant including email address
your job title, department and Civil Service grade of your post
the name, e-mail address and job title of your line manager
details of your experience and qualifications
details of your gender
details of your ethnicity
details of any disability
details of any neurodivergent conditions with which you have been diagnosed.

The legal bases of the processing

In accordance with UK GDPR, our legal basis for collecting or processing your personal data is:

Article 6(1) “processing is necessary for compliance with a legal obligation to which the controller is subject.” EMB is required under the terms of its contract with the Department for Science, Innovation and Technology to collect the personal data set out above for the purposes of monitoring applicants to the Cyber Professional Titles Fund.

Personal data concerning health and ethnicity are classified as ‘special category data’ under the UK GDPR. In order to lawfully process special category data, we are required to identify both a lawful basis under Article 6 of the UK GDPR and a separate condition for processing under Article 9. The Article 9 condition for processing special category data in this instance is “Reasons of substantial public interest - Equality of opportunity or treatment”. This special category personal data is collected to help DSIT monitor equality of opportunity or treatment.

Who has access to your data and who might we share your information with

Your information may be shared internally, including with project staff and managers and IT staff if access to the data is necessary for performance of their roles.

EMB may also share your data with third parties that process data on our behalf, and which provide services to the Government and applicants as part of the Cyber Professional Titles Fund scheme.

Information may also be shared with other government bodies and funding organisations in order to detect and prevent fraud.

How long we retain your information

EMB will retain the data pertaining to the Cyber Professional Titles Fund applicants until at least seven years after your last application or claim is closed.

How we protect your information

EMB takes security of your data seriously. The organisations have internal policies and controls in place to try to ensure that your data is not lost, accidentally destroyed, misused or disclosed, and is not accessed except by employees in the performance of their duties. EMB holds Cyber Essentials Plus and ISO27001 accreditation.

Where EMB engages third parties to process personal data on their behalf, they do so on the basis of written instructions, and under a duty of confidentiality and are obliged to implement appropriate technical and organisational measures to ensure the security of data.

Where we will store your data

Data processed by EMB Limited is stored on encrypted systems on-premises and on hosted cloud services such as Microsoft 365 and Salesforce. As such, some data will either be in UK and EEA data centres provided by selected third parties. We may also process your data in countries outside the UK or European Union.

If your data is transferred or processed outside of the UK or EEA where adequacy decisions are not in place, we ensure the safeguards of International Data Transfer Agreements (IDTAs) or Addendums are enforced. Where this is not possible, we ensure that appropriate UK or European Standard Contractual Clauses are entered into.

Consequences of failure to provide personal data

If you do not provide the personal data requested in the application form, we will be unable to process your application to the Cyber Professional Titles Fund.

Your information rights

You have several rights in relation to the information that we hold about you:

Access – you have the right to ask us for copies of your personal information

Rectification – you have the right to ask us to rectify information which you believe to be inaccurate. You also have the right to ask us to complete information which you think is incomplete

Erasure – you have the right to ask us to erase your personal information in certain circumstances

Restriction of Processing – you have the right to ask us to restrict the processing of your information in certain circumstances

Object to Processing – you have the right to object to the processing of your personal data in certain circumstances

Data portability – you have the right to ask that we transfer the information you gave us to another organisation, or to you, in certain circumstances

Automated decisions and profiling – you have the right to prevent your information being processed and decisions made about your solely by automated means (without any human involvement).

EMB does not use automated decision-making in the delivery of the administration of the Cyber Professional Titles Fund.

Information Commissioner’s Office

You have the right to complain to the Information Commissioner’s Office (ICO) if you are not satisfied with the way that EMB has handled your information.

The ICO is an independent body set up to upload information rights in the United Kingdom. They can also provide advice and guidance and can be contacted through the Information Commissioner’s website (www.ico.org.uk), via the helpline on 0303 123 1113, or in writing to:

Information Commissioner’s Office

Wycliffe House

Water Lane

Wilmslow

Cheshire

SK9 5A

This notice sets out how we will process your personal data, and your rights. It is made under Articles 13 and/or 14 of the UK General Data Protection Regulation (UK GDPR).

1. Your Data

We will process the following personal data:

Names, Email addresses, Contact details, Job titles, Teams within the department, Government departments and Government grades, Names of line managers, the job titles of line managers, and the email addresses of line managers.

Where personal data has not been obtained from the data subject

Your personal data were obtained by DSIT from EMB Ltd. as the Fund Administrator contracted by DSIT to manage and deliver the Cyber Professional Titles Fund. You can also find EMB’s Privacy Notice on the scheme’s registration form.
DSIT and EMB are separate Data Controllers for the personal information collected as part of this Scheme.
More information about EMB can be found at: www.embltd.co.uk/aboutus

2. Purpose

The purpose(s) for which we are processing your personal data is:

The purpose of assessment of eligibility for the Professional Titles Fund scheme,
The purpose of verification of eligibility for the Professional Titles Fund scheme,
Counter-fraud measures,
Maintain records of the applicants to the Fund for audit reasons.

3. Legal basis of processing

The legal basis for processing your personal data under Article 6 of the UK GDPR is:

Public task: Processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the data controller. DSIT is processing data to assess and verify eligibility of applicants to the scheme in line with its counter-fraud measures and the purpose of keeping records for the scheme.

4. Recipients

As part of our IT infrastructure, your personal data will be stored on systems provided by our data processors - Microsoft and Amazon Web Services. This does not mean we actively share your personal data with these entities; rather, they are technical service providers who host infrastructure supporting our IT systems.

5. Retention

Your personal data will be kept by us until the end of DSIT’s Cyber Professional Titles Fund scheme which is a fund to finance application costs to the professional titles of the UK Cyber Security Council. The estimated date of closure will be 31 March 2025 with an optional extension to 31 March 2026.

6. International Transfers (include the relevant paras))

Due to the departments IT Infrastructure, your personal data may be processed at data centres outside of the UK but will remain within the European Economic Area (EEA). Your data will receive the same level of protection in the EEA as it does in the UK, through the safeguard of Adequacy Decisions.

7. Your Rights

You have the right to request information about how your personal data are processed, and to request a copy of that personal data.

You have the right to request that any inaccuracies in your personal data are rectified without delay.

You have the right to request that any incomplete personal data are completed, including by means of a supplementary statement.

You have the right to request that your personal data are erased if there is no longer a justification for them to be processed.

You have the right in certain circumstances (for example, where accuracy is contested) to request that the processing of your personal data is restricted.

You have the right to object to the processing of your personal data.

To exercise your rights please contact the Data Protection Officer using the contact details below.

8. Contact Details

The data controller for your personal data is the Department for Science. Innovation and Technology (DSIT). You can contact the DSIT Data Protection Officer at:

DSIT Data Protection Officer

Department for Science, Innovation &Technology

22-26 Whitehall

London

SW1A 2EG

Email: dataprotection@dsit.gov.uk

If you are unhappy with the way we have handled your personal data, please write to the department’s Data Protection Officer in the first instance using the contact details above.

EMB’s Data Protection Officer can be contacted at:

dataprotectionenquiries@embltd.co.uk

9. Complaints

If you consider that your personal data has been misused or mishandled, you may make a complaint to the Information Commissioner, who is an UK independent regulator. The Information Commissioner can be contacted at:

Information Commissioner's Office

Wycliffe House

Water Lane

Wilmslow

Cheshire

SK9 5AF

Telephone: 0303 123 1113
https://ico.org.uk/make-a-complaint/

Any complaint to the Information Commissioner is without prejudice to your right to seek redress through the courts.

10. Updates to this notice

If this privacy notice changes in any way, we will place an updated version on this page. Regularly reviewing this page ensures you are always aware of what information we collect, how we use it, and under what circumstances we will share it with other parties. The ‘last updated’ date at the bottom of this page will also change.

If these changes affect how your personal data is processed, we will take reasonable steps to let you know.

DSIT Cyber Professional Titles Fund Privacy Notice

Menu

Contact us

Address