How Reform UK collects, uses and protects your personal information.
General Privacy Notice – Transparency in the Processing of Personal Information
Last Updated: 18th July 2026
Version: 2.1
Document Owner: Data Protection Officer
Approved By: Party Secretary
Classification: Public
Data Controller: Reform UK Party Ltd (Company No. 16260766; Electoral Commission Reg. No. PP7931)
Registered Office: Millbank Tower, 21–24 Millbank, London SW1P 4QP
ICO Registration Number: ZB934331
Purpose: To explain, in clear and transparent terms, how Reform UK Party Ltd collects, uses, stores, shares, retains and protects personal information, and the rights available to individuals under UK data protection legislation.
Review: This notice is reviewed 12 months from publication, or earlier where there is a material change to legislation, regulatory guidance or Party processing activities.
Related Documents: Political Campaigning & Democratic Engagement Privacy Notice; Cookie Notice; Data Protection Complaints Procedure.
This Privacy Notice has been prepared having regard to the requirements of, amongst other legislation and regulatory guidance:
Where legislation or regulatory guidance changes, this Privacy Notice will be reviewed and updated where appropriate.
Reform UK Party Ltd
Company No. 16260766
Registered Political Party (Electoral Commission Reg. No. PP7931)
Principal Office: Millbank Tower, 21–24 Millbank, London, SW1P 4QP
ICO Registration Reference: ZB934331
Reform UK Party Ltd ("Reform UK", "we", "our" or "us") is committed to processing personal information lawfully, fairly, transparently and securely.
We recognise that individuals are entitled to understand what personal information we collect, why we collect it, how it is used, who it may be shared with, how long it is retained and the rights available to them under UK data protection legislation.
This General Privacy Notice explains our approach to the processing of personal information across all areas of the Party's activities. It applies to individuals who interact with Reform UK in any capacity, including members, supporters, donors, volunteers, candidates, employees, contractors, suppliers, journalists, website users and members of the public.
We are committed to demonstrating accountability, transparency and good governance in accordance with the principles set out in Article 5 UK GDPR. We regularly review our policies, procedures and technical measures to ensure that personal information remains appropriately protected and that our processing activities continue to comply with applicable legislation and regulatory guidance.
Where particular processing activities require more detailed explanation, such as political campaigning and democratic engagement, separate companion documents are available through our Privacy Centre.
Nothing within this Privacy Notice limits or overrides any statutory rights available to individuals under UK data protection legislation.
Reform UK believes that transparency is fundamental to responsible data protection.
We have therefore prepared this Privacy Notice not simply to comply with legal obligations, but to help individuals understand how and why their personal information is processed.
Where legislation is referred to throughout this document, explanations are provided in plain English. A Legislative Reference Guide is also included at Appendix D to assist readers who wish to understand the legal framework in greater detail.
If, after reading this Privacy Notice, you require further information about any aspect of our processing activities, you are encouraged to contact our Data Protection Officer using the contact details provided at the end of this document.
Reform UK Party Ltd ("Reform UK") is a registered political party operating throughout the United Kingdom.
As part of our activities, we engage with members, supporters, donors, volunteers, prospective candidates, elected representatives (where appropriate), employees, contractors, suppliers, journalists, regulators and members of the public.
To support those activities, we process personal information for purposes including:
For the purposes of UK data protection legislation, Reform UK Party Ltd is the Data Controller for the majority of the personal information described in this Privacy Notice.
Where we process personal information jointly with another organisation, or on behalf of another organisation, we will explain this where appropriate.
This Privacy Notice applies whenever Reform UK processes personal information relating to an identified or identifiable individual.
It applies regardless of whether personal information is collected:
It applies to individuals including, but not limited to:
Where a separate privacy notice applies to a specific activity, such as political campaigning or website cookies, this Privacy Notice should be read alongside that companion document.
The UK General Data Protection Regulation ("UK GDPR") establishes seven principles that govern the processing of personal information (Article 5 UK GDPR).
These principles form the foundation of Reform UK's approach to data protection and apply to every processing activity undertaken by the Party.
Accordingly, we seek to ensure that personal information is:
| Principle | What this means in practice |
|---|---|
| Lawfulness, fairness and transparency | We explain how and why personal information is processed and ensure that a lawful basis exists before processing begins. |
| Purpose limitation | Personal information is collected for specified, explicit and legitimate purposes and is not used in ways that are incompatible with those purposes. |
| Data minimisation | We seek to collect only the personal information reasonably necessary to fulfil the relevant purpose. |
| Accuracy | We take reasonable steps to ensure that personal information remains accurate and up to date. |
| Storage limitation | Personal information is retained only for as long as necessary, taking account of legal, regulatory and operational requirements. |
| Integrity and confidentiality | Appropriate technical and organisational measures are implemented to protect personal information against unauthorised access, loss, misuse, alteration or disclosure. |
| Accountability | We maintain governance arrangements, policies, procedures and records designed to demonstrate compliance with UK data protection legislation. |
Reform UK recognises that effective data protection requires more than compliance with legislation. It requires appropriate governance, clear accountability and a culture of responsible information management.
We maintain organisational and technical measures designed to ensure that personal information is processed responsibly throughout its lifecycle, from collection through to secure deletion or anonymisation.
Our governance framework includes, where appropriate:
Where new processing activities are likely to present a high risk to the rights and freedoms of individuals, Reform UK will assess those risks before processing begins and implement appropriate safeguards to reduce them.
Privacy considerations are incorporated into the design and operation of new systems, services and processes wherever reasonably practicable, reflecting the principles of Privacy by Design and Privacy by Default (Article 25 UK GDPR).
Reform UK has appointed a Data Protection Officer ("DPO") to oversee compliance with UK data protection legislation and to promote a culture of responsible information governance throughout the Party.
The DPO performs their duties independently and reports on matters relating to data protection, privacy and information governance without improper influence.
The DPO's responsibilities include:
The DPO may be supported by appropriately authorised personnel, specialist advisers or external professional advisers where necessary.
The DPO's contact details are provided at the end of this Privacy Notice.
The categories of personal information processed by Reform UK depend upon the nature of an individual's relationship with the Party.
We do not collect every category of personal information about every individual.
The table below summarises the principal categories of personal information that may be processed.
| Category | Examples | Typical Processing Activities |
|---|---|---|
| Identity Information | Name, title, date of birth (where required), membership or candidate reference numbers | Membership administration, candidate management, identity verification |
| Contact Information | Postal address, email address, telephone number, constituency | Communications, membership, campaigning, enquiries |
| Membership Information | Membership status, branch affiliation, renewal history | Membership administration |
| Supporter Information | Campaign interests, communication preferences, petitions, volunteer interests | Democratic engagement |
| Donation Information | Donation history, payment references, Gift Aid (where applicable), statutory reporting information | Donations and regulatory compliance |
| Financial Information | Payment records, invoices, refunds | Financial administration |
| Employment Information | Recruitment, payroll, HR records | Employment |
| Volunteer Information | Volunteer roles, availability, training | Volunteer management |
| Candidate Information | Applications, declarations, vetting information | Candidate selection |
| Communications | Emails, letters, complaints, enquiries, SAR correspondence | Customer service and governance |
| Website Information | IP address, browser data, cookie identifiers | Website administration |
| Event Information | Event registrations, attendance, accessibility requirements | Event management |
| Security Information | Login records, audit logs, access records | Information security |
| Compliance Information | Complaints, SARs, suppression records, legal correspondence | Governance and compliance |
Certain categories of personal information are afforded additional protection under Article 9 UK GDPR because they are considered particularly sensitive.
These include information relating to, amongst other matters:
As a registered political party, Reform UK may process information revealing political opinions where this is lawful and necessary for its legitimate political activities.
Such processing is undertaken in accordance with Article 9(2)(d) UK GDPR and, where applicable, Schedule 1, Part 2, Paragraph 22 of the Data Protection Act 2018, together with appropriate safeguards.
Where Special Category Personal Data is processed for other purposes, such as accessibility requirements, safeguarding or employment, Reform UK will identify and document the relevant legal condition before processing begins.
We seek to minimise the collection of Special Category Personal Data and will only process such information where it is genuinely necessary for the relevant purpose.
Access to Special Category Personal Data is restricted to individuals with an appropriate operational need to know.
Reform UK may, in limited circumstances, process information relating to criminal convictions or alleged offences where such processing is authorised by law and appropriate safeguards have been implemented.
Examples may include:
Such information is processed in accordance with Article 10 UK GDPR, the Data Protection Act 2018 and any applicable statutory conditions.
Access to criminal offence data is strictly controlled and limited to those individuals who require access for the relevant purpose.
Personal information processed by Reform UK may be obtained from a number of different sources depending upon the nature of an individual's relationship with the Party.
These sources include:
Including when you:
For example:
Where lawful and appropriate we may obtain information from publicly available sources including:
We do not routinely monitor or profile individuals through social media beyond what is lawful, proportionate and relevant to our legitimate political activities.
Where appropriate we may receive personal information from:
Whenever personal information is obtained from a third party, Reform UK seeks to ensure that an appropriate legal basis exists for both the disclosure and the subsequent processing.
Reform UK may from time to time organise competitions, prize draws, giveaways or other promotional campaigns in connection with its political activities, membership engagement or fundraising.
Where you choose to participate, we will process the personal information necessary to:
Depending upon the nature of the promotion, we may also process information you voluntarily provide regarding your political interests, opinions or engagement with Reform UK. Where such information constitutes Special Category Personal Data, it will be processed only where permitted under Article 9 UK GDPR and the Data Protection Act 2018, together with appropriate safeguards.
Participation in any competition or promotion is entirely voluntary. Any additional information required for a particular promotion will be explained clearly at the point of collection.
As a registered political party, Reform UK is entitled by law to receive and use electoral register information for specified democratic purposes.
The electoral registration system forms an important part of the democratic process within the United Kingdom. Parliament has therefore made provision for registered political parties to receive electoral register information in order to support democratic engagement, communicate with electors and participate effectively in elections.
The use of electoral register information by political parties is governed principally by the Representation of the People Act 1983, associated electoral regulations and guidance issued by the Electoral Commission. Reform UK processes electoral register information in accordance with those legal requirements and with the principles of the UK General Data Protection Regulation (UK GDPR).
The Electoral Register is maintained by Electoral Registration Officers (EROs) appointed by local authorities throughout the United Kingdom.
It records the names and addresses of individuals who are registered to vote and is maintained for electoral purposes.
Political parties do not create or maintain the Electoral Register. Electoral Registration Officers remain responsible for the accuracy, maintenance and statutory publication of electoral registration information. Reform UK receives electoral register information only where legislation permits it to do so and uses that information only for lawful political purposes.
There are two principal versions of the Electoral Register.
The Full Electoral Register contains information relating to all registered electors.
Access to this register is strictly controlled by legislation.
Registered political parties may receive copies of the Full Electoral Register for purposes connected with democratic engagement, electoral administration and political campaigning where legislation permits.
The information contained within the Full Electoral Register may only be used for those statutory purposes.
The Open Register (sometimes referred to as the Edited Register) is a separate version of the Electoral Register.
Individuals may choose whether their information appears on the Open Register.
Unlike the Full Electoral Register, the Open Register may be purchased by organisations for a wider range of lawful purposes.
Reform UK's principal political campaigning activities are based upon information made available under the statutory provisions governing political parties rather than commercial use of the Open Register.
Electoral registration legislation also provides for certain attainers to be included within the Electoral Register.
Attainers are individuals who are not yet old enough to vote but who will become eligible to vote during the relevant registration period.
The inclusion of attainers helps ensure that eligible young people are able to participate in the democratic process as soon as they reach voting age.
Where attainer information is received by Reform UK, it is processed only in accordance with the restrictions imposed by electoral legislation.
Electoral register information may be used to support activities including:
Reform UK seeks to ensure that electoral register information is used responsibly, proportionately and only for purposes authorised by law.
From time to time, Reform UK may send addressed communications to electors using electoral register information where permitted by electoral legislation.
These communications are intended to support democratic participation by informing electors about political issues, candidates, elections and Party policies.
Where electoral register information is used solely for the purpose of generating addressed campaign communications, Reform UK may not retain a permanent copy of the recipient information once the communication has been produced.
Accordingly, there may be circumstances in which an individual has lawfully received an addressed communication from Reform UK but Reform UK no longer retains personal information relating to that individual after the communication has been completed.
Although Reform UK takes reasonable steps to ensure that personal information is processed accurately, responsibility for maintaining the Electoral Register rests with the relevant Electoral Registration Officer.
If you believe that information contained within the Electoral Register is inaccurate, you should contact your local Electoral Registration Officer, who is responsible for maintaining those records.
Where an individual exercises their right to object to receiving communications from Reform UK, we will take reasonable steps to ensure that future communications are suppressed where appropriate.
In order to honour such requests, Reform UK may retain limited information necessary to ensure that the objection continues to be respected.
These suppression records are retained solely for compliance purposes and not for continued campaigning.
Individuals are entitled to ask Reform UK whether we process their personal information and to exercise their rights under UK data protection legislation.
Where a Subject Access Request is received, Reform UK will carry out reasonable and proportionate searches of the systems likely to contain the individual's personal information.
There may be occasions where those searches identify no current personal information, notwithstanding that an individual has previously received a lawful political communication.
This may occur because:
Where appropriate, we will explain these circumstances when responding to a request.
Reform UK does not sell personal information.
We only disclose personal information where there is a lawful basis to do so and where the disclosure is necessary to fulfil one or more legitimate purposes.
Before sharing personal information, we consider whether the disclosure is necessary, proportionate and consistent with our obligations under UK data protection legislation.
Where another organisation processes personal information on our behalf, we require that organisation to provide appropriate contractual and organisational safeguards to protect that information.
Depending upon the circumstances, personal information may be shared with the following categories of recipient.
| Recipient Category | Typical Purpose | Legal Basis |
|---|---|---|
| Service providers acting on our behalf | Membership administration, communications, website hosting, IT support, document management and operational services | Articles 6(1)(b), 6(1)(c) or 6(1)(f) UK GDPR, depending on the activity |
| Professional advisers | Legal advice, audit, insurance and financial services | Legitimate Interests or Legal Obligation |
| Payment providers | Processing subscriptions, donations and refunds | Contract or Legal Obligation |
| Electoral Commission | Statutory reporting of reportable donations and loans | Legal Obligation |
| Regulators | Compliance with statutory or regulatory requirements | Legal Obligation |
| Law enforcement agencies | Prevention, detection or investigation of crime, or where otherwise required by law | Legal Obligation or Public Task |
| Courts and tribunals | Legal proceedings and administration of justice | Legal Obligation |
| Other organisations | Where you have requested, authorised or otherwise permitted us to do so | Consent or other applicable lawful basis |
Reform UK seeks to ensure that only the minimum personal information necessary is disclosed for the relevant purpose.
Reform UK seeks, wherever reasonably practicable, to ensure that personal information is processed within the United Kingdom.
However, some of the technology providers and service providers that support our activities may process personal information outside the United Kingdom.
Where this occurs, Reform UK will ensure that appropriate safeguards are in place before any international transfer takes place.
Depending upon the circumstances, those safeguards may include:
International transfer arrangements are reviewed periodically to ensure they remain appropriate and legally compliant.
Further information about international transfers may be obtained by contacting the Data Protection Officer.
Reform UK recognises that emerging technologies, including artificial intelligence ("AI"), may provide opportunities to improve administrative efficiency, information management and service delivery.
Where AI or similar technologies are used in connection with personal information, they will be deployed responsibly, transparently and in accordance with UK data protection legislation.
AI systems are intended to support human decision-making rather than replace it. Reform UK does not make decisions producing legal effects, or similarly significant effects, solely by automated means unless authorised by law and accompanied by the safeguards required by Article 22 UK GDPR.
Where the introduction of AI technologies is likely to present a high risk to the rights and freedoms of individuals, Reform UK will undertake an appropriate Data Protection Impact Assessment before implementation.
The use of AI technologies is subject to ongoing governance, review and oversight.
Protecting personal information is fundamental to maintaining trust in Reform UK and safeguarding the rights and freedoms of individuals.
In accordance with Article 32 UK GDPR, Reform UK implements appropriate technical and organisational measures designed to protect personal information against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access.
These measures include, where appropriate:
No method of transmitting or storing information can be guaranteed to be completely secure. However, Reform UK continually reviews and improves its security arrangements to reduce risk and maintain an appropriate level of protection.
Reform UK retains personal information only for as long as necessary to fulfil the purposes for which it was collected, unless a longer retention period is required or permitted by law.
Retention periods are determined by taking account of:
Different categories of personal information are therefore retained for different periods.
A summary of our principal retention arrangements is provided at Appendix B – Public Retention Schedule.
When personal information is no longer required, it is securely deleted, anonymised or otherwise disposed of in accordance with our documented retention and disposal procedures.
Where a legal obligation requires information to be retained, or where continued retention is necessary to establish, exercise or defend legal claims, Reform UK may retain that information notwithstanding a request for its deletion.
Every individual whose personal information is processed by Reform UK has rights under UK data protection legislation.
Those rights are intended to promote transparency, fairness and accountability in the way organisations process personal information.
Some rights apply in all circumstances, whilst others apply only in particular situations or may be subject to statutory exemptions.
Reform UK will consider every request individually and respond in accordance with UK data protection legislation.
A summary of the principal rights is provided below.
| Right | What it means | Legislative Reference |
|---|---|---|
| Right to be informed | To understand how your personal information is collected and used. | Article 13 & 14 UK GDPR |
| Right of access | To request a copy of your personal information. | Article 15 UK GDPR |
| Right to rectification | To correct inaccurate or incomplete information. | Article 16 UK GDPR |
| Right to erasure | To request deletion in certain circumstances. | Article 17 UK GDPR |
| Right to restrict processing | To ask us to temporarily limit the use of your information. | Article 18 UK GDPR |
| Right to data portability | To receive certain personal information in a reusable format. | Article 20 UK GDPR |
| Right to object | To object to certain processing activities. | Article 21 UK GDPR |
| Rights relating to automated decision-making | To obtain safeguards where decisions are made solely by automated means. | Article 22 UK GDPR |
You may exercise your rights at any time by contacting Reform UK's Data Protection Officer using the contact details provided at the end of this Privacy Notice.
Where appropriate, Reform UK may request additional information in order to:
Requests are handled individually and in accordance with UK data protection legislation.
Where a request cannot be fulfilled, or can only be fulfilled in part, Reform UK will explain the reasons for that decision together with details of any applicable rights of review or complaint.
Protecting personal information from unauthorised disclosure is one of Reform UK's most important responsibilities.
Before releasing personal information in response to a request made under UK data protection legislation, Reform UK must be satisfied that the individual making the request is entitled to receive that information.
Accordingly, where Reform UK has reasonable doubts concerning the identity of the requester, we may request additional information necessary to verify identity before responding.
This is permitted by Article 12(6) UK GDPR.
Whether additional verification is required will depend upon the circumstances of each request.
For example, where we already maintain an established relationship with an individual and are satisfied as to their identity, we may not require any additional evidence.
Conversely, additional verification may be appropriate where:
Where additional information is requested, Reform UK will seek only the information reasonably necessary to verify identity.
We will always seek to adopt the least intrusive method of identity verification reasonably available in the circumstances, taking account of the guidance published by the Information Commissioner's Office.
Identity verification protects both the requester and Reform UK by reducing the risk of personal information being disclosed to an unauthorised person.
Where additional information is lawfully requested under Article 12(6) UK GDPR, the statutory period for responding to the request will begin once sufficient information has been received to enable identity to be verified.
Where sufficient information is not provided, Reform UK may be unable to comply with the request.
When exercising your rights, you are not required to explain why you are making your request.
However, it may assist Reform UK to understand the nature of your relationship with the Party.
For example, whether you are or have been:
Providing this information enables Reform UK to identify the systems most likely to contain relevant personal information and helps us conduct searches more efficiently and accurately.
Where such information is not provided, Reform UK will nevertheless carry out reasonable and proportionate searches based upon the information available.
Under Article 15 UK GDPR, individuals have the right to request confirmation as to whether Reform UK processes their personal information and, where applicable, to receive a copy of that information together with certain supplementary information.
This right is commonly known as a Subject Access Request (SAR).
Reform UK welcomes requests from individuals wishing to understand how their personal information is processed and is committed to responding in a transparent, fair and timely manner.
Requests may be submitted at any time using the contact details provided at the end of this Privacy Notice.
Every request received by Reform UK is assessed individually.
The manner in which a request is handled will depend upon its nature, complexity and the information available to identify the requester and the systems likely to contain relevant personal information.
When responding to a request, Reform UK may:
Every request is considered on its own merits.
Sometimes a request may be expressed in very broad or general terms.
Where this occurs, Reform UK may contact the requester to clarify the scope of the request so that searches can be targeted more effectively.
Clarification is intended to assist both the requester and Reform UK by ensuring that searches are proportionate and focused upon the information most relevant to the individual's request.
Individuals are not obliged to narrow or clarify their request.
However, doing so may enable Reform UK to identify relevant information more efficiently and reduce the time required to complete the request.
When responding to a Subject Access Request, Reform UK will carry out reasonable and proportionate searches of the systems likely to contain the requester's personal information.
The systems searched will depend upon the individual's relationship with the Party and the nature of the request.
Searches may include, where appropriate:
Reform UK is not required to search systems that could not reasonably be expected to contain the requester's personal information.
There may be occasions where Reform UK concludes, following reasonable and proportionate searches, that it does not currently hold personal information relating to the requester.
This does not necessarily mean that Reform UK has never processed the individual's personal information.
For example:
Where no personal information is identified, Reform UK will explain the outcome of its searches as clearly as possible.
Reform UK will respond to requests made under UK data protection legislation without undue delay and, where applicable, within one calendar month, in accordance with Article 12 UK GDPR.
Where Reform UK has reasonable doubts concerning the identity of the requester, we may request additional information to verify identity in accordance with Article 12(6) UK GDPR.
The statutory one-month response period does not begin until sufficient information has been provided to enable Reform UK to satisfy itself as to the requester's identity.
Where a request is particularly complex, or where multiple requests have been received from the same individual, Reform UK may extend the response period by up to a further two months where permitted by law.
If an extension is required, we will inform the requester within the initial one-month period, explain the reasons for the extension and provide a revised response date.
Throughout the process, Reform UK will seek to progress requests as efficiently as possible and will keep requesters informed where appropriate.
For further information about identity verification, please see Section 20 – Identity Verification.
In limited circumstances, Reform UK may be unable to provide all of the information requested.
Examples include where:
Where information cannot be disclosed, Reform UK will explain the reasons unless prevented from doing so by law.
Individuals may request that Reform UK erase their personal information under Article 17 UK GDPR.
The right to erasure is sometimes referred to as the "right to be forgotten".
However, this right is not absolute.
Depending upon the circumstances, Reform UK may be required or permitted to retain certain personal information, including where retention is necessary to:
Where information cannot lawfully be erased, Reform UK will explain the reasons.
Reform UK is committed to handling concerns about the processing of personal information fairly, transparently and without undue delay.
If you believe that we have processed your personal information incorrectly, failed to comply with UK data protection legislation or otherwise fallen short of the standards described within this Privacy Notice, we encourage you to raise your concerns with us in the first instance.
We operate a documented internal complaints procedure to ensure that complaints relating to personal information are considered appropriately, investigated where necessary and responded to in accordance with applicable legal requirements.
Where appropriate, we may:
Our aim is not only to resolve individual concerns but also to continually improve the way in which we process and protect personal information.
If you remain dissatisfied after we have considered your complaint, or you believe that we have not complied with UK data protection legislation, you have the right to lodge a complaint with the Information Commissioner's Office (ICO) under Article 77 UK GDPR.
The ICO is the United Kingdom's independent regulator responsible for promoting and enforcing data protection legislation.
You can contact the ICO using the details available on its official website:
Information Commissioner's Office (ICO)
Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF
Telephone: 0303 123 1113
Website: ico.org.uk/make-a-complaint
Making a complaint to Reform UK does not affect your right to complain directly to the ICO at any time.
If you have any questions about this Privacy Notice or about the way Reform UK processes personal information, you may contact our Data Protection Officer.
The Data Protection Officer is responsible for overseeing compliance with UK data protection legislation and is available to assist with enquiries relating to privacy, individual rights and information governance.
Data Protection Officer
Reform UK Party Ltd
Millbank Tower
21–24 Millbank
London
SW1P 4QP
Email: [email protected]
Where possible, we encourage enquiries to be submitted by email as this enables us to respond more efficiently and maintain an appropriate audit trail.
Reform UK periodically reviews this Privacy Notice to ensure that it remains accurate, up to date and reflects changes to legislation, regulatory guidance, technology and our processing activities.
Where material changes are made, the revised version will be published through our Privacy Centre together with the date on which the changes take effect.
Historic versions may be retained for governance and accountability purposes.
Individuals are encouraged to review this Privacy Notice periodically to ensure they remain familiar with the latest version.
Reform UK is committed to making its privacy information accessible to as many people as reasonably practicable.
If you require this Privacy Notice in an alternative format, or require assistance in understanding any part of its contents, please contact the Data Protection Officer.
Where reasonably practicable, we will seek to provide information in an appropriate accessible format.
Reform UK recognises that personal information belongs to the individual, not to the organisation processing it.
We are committed to processing personal information responsibly, lawfully and transparently, respecting the rights of individuals and continually improving our standards of information governance.
This General Privacy Notice forms an important part of that commitment and will continue to evolve as legislation, technology and our processing activities develop and reflects our continuing commitment to openness, accountability and responsible information governance.
The following Reference Guides form part of this General Privacy Notice.
They have been included to help readers better understand Reform UK's approach to privacy, information governance and UK data protection legislation.
They are intended to complement the main Privacy Notice and should be read alongside it where appropriate.
Reform UK works with a number of carefully selected organisations to support the delivery of its activities.
Depending upon the nature of the relationship, those organisations may act as:
Before sharing personal information, Reform UK seeks to ensure that appropriate legal, contractual and organisational safeguards are in place.
| Recipient Category | Typical Purpose | Status |
|---|---|---|
| Membership & CRM Providers | Membership administration and supporter management | Processor |
| Website & Hosting Providers | Website hosting and infrastructure | Processor |
| Cloud Productivity Providers | Email, document management and collaboration | Processor |
| Payment Service Providers | Processing donations, subscriptions and refunds | Controller / Processor |
| Banking Providers | Financial transactions | Independent Controller |
| Print & Mailing Providers | Production and delivery of communications | Processor |
| Event Management Providers | Event registration and administration | Processor |
| IT Support Providers | Technical support and maintenance | Processor |
| Professional Advisers | Legal, audit, insurance and accountancy | Independent Controller |
| Electoral Commission | Statutory reporting | Independent Controller |
| Regulators | Statutory oversight | Independent Controller |
| Law Enforcement Agencies | Prevention or detection of crime | Independent Controller |
Note: Reform UK does not sell personal information to third parties.
Retention periods are determined by legal obligations, regulatory requirements, operational necessity and the principles of UK GDPR.
The following table provides a public summary of Reform UK's retention approach. Detailed operational retention schedules are maintained internally.
| Record Category | Public Retention Approach |
|---|---|
| Membership Records | Retained while membership remains active and thereafter only as long as necessary for legal and operational purposes. |
| Supporter Records | Retained while engagement continues and thereafter reviewed periodically. |
| Donation Records | Retained in accordance with electoral, taxation and accounting legislation. |
| Volunteer Records | Retained while volunteering continues and thereafter only where necessary. |
| Candidate Records | Retained in accordance with candidate governance and legal obligations. |
| Employment Records | Retained in accordance with employment legislation. |
| Supplier Records | Retained in accordance with contractual and accounting requirements. |
| Complaint Records | Retained to demonstrate accountability and good governance. |
| Subject Access Requests | Retained to demonstrate compliance with UK data protection legislation. |
| Suppression Records | Retained solely to ensure objections continue to be respected. |
| Security Logs | Retained only for legitimate information security purposes. |
| Mailing-list signup technical provenance | Form source, submission timestamp and originating IP address are retained for 18 months for fraud and abuse investigation, then automatically deleted from the subscription record. |
This glossary explains common terms used throughout this Privacy Notice.
| Term | Plain English Explanation |
|---|---|
| Personal Data | Information relating to an identified or identifiable living individual. |
| Processing | Anything done with personal information, including collecting, storing, using, sharing or deleting it. |
| Data Controller | The organisation deciding why and how personal information is processed. |
| Data Processor | An organisation processing personal information on behalf of a Data Controller. |
| Special Category Personal Data | Sensitive information receiving additional legal protection, including political opinions. |
| Criminal Offence Data | Information relating to criminal convictions or offences, processed only where permitted by law. |
| Subject Access Request | A request made under Article 15 UK GDPR to obtain access to personal information. |
| Suppression Record | A limited record retained solely to ensure that an individual's objection to communications continues to be respected. |
| Electoral Registration Officer | The statutory officer responsible for maintaining the Electoral Register. |
| Full Electoral Register | The statutory register supplied to political parties for specified lawful purposes. |
| Open Register | A version of the Electoral Register available for wider lawful use where an elector has not opted out. |
| Attainer | A person included on the Electoral Register before becoming eligible to vote, in accordance with electoral legislation. |
| Legitimate Interests | One of the lawful bases under Article 6 UK GDPR allowing processing where it is necessary and balanced against individuals' rights. |
| Data Protection Impact Assessment (DPIA) | A formal assessment undertaken before processing likely to present a high risk to individuals. |
Throughout this Privacy Notice, references are made to UK legislation and regulatory guidance. This Reference Guide explains those provisions in plain English. It is intended to help readers understand the legal framework governing the processing of personal information. It does not replace the legislation itself, which should always be regarded as the authoritative source.
| Reference | Plain English Explanation | Used In |
|---|---|---|
| Article 5 UK GDPR | The seven data protection principles that underpin all processing of personal information. | Sections 1, 5 & 6 |
| Article 6 UK GDPR | The lawful bases permitting organisations to process personal information. | Sections 13–17 |
| Article 9 UK GDPR | Additional protections for Special Category Personal Data, including political opinions. | Sections 9 & 13 |
| Article 10 UK GDPR | Processing of criminal offence data. | Section 10 |
| Article 12 UK GDPR | General rules governing the exercise of individual rights. | Sections 18–29 |
| Article 12(6) UK GDPR | Allows organisations to request additional information where they have reasonable doubts concerning identity. | Sections 20 & 27 |
| Article 15 UK GDPR | Right of access (Subject Access Requests). | Sections 22–28 |
| Article 16 UK GDPR | Right to rectification. | Section 18 |
| Article 17 UK GDPR | Right to erasure. | Section 29 |
| Article 18 UK GDPR | Right to restrict processing. | Section 18 |
| Article 20 UK GDPR | Right to data portability. | Section 18 |
| Article 21 UK GDPR | Right to object. | Section 18 |
| Article 22 UK GDPR | Rights relating to automated decision-making. | Sections 15 & 18 |
| Article 25 UK GDPR | Privacy by Design and Privacy by Default. | Section 6 |
| Article 32 UK GDPR | Security of processing. | Section 16 |
| Article 35 UK GDPR | Data Protection Impact Assessments. | Sections 6 & 15 |
| Article 77 UK GDPR | Right to complain to the Information Commissioner. | Section 31 |
| Article 82 UK GDPR | Right to seek compensation in certain circumstances. | Section 31 |
| Data Protection Act 2018 | Supplements UK GDPR and provides additional conditions and exemptions. | Throughout |
| Data (Use and Access) Act 2025 | Modernises UK data protection law, including complaint handling obligations. | Sections 30–31 |
| PECR | Governs electronic communications, cookies and certain marketing activities. | Cookie Notice & relevant sections |
| Political Parties, Elections and Referendums Act 2000 | Governs political donations, loans and financial reporting. | Donations sections |
| Representation of the People Act 1983 | Governs electoral registration and the lawful use of electoral register information. | Section 12 |
The following questions are based on the enquiries most commonly received by Reform UK's Data Protection Officer. They are intended to provide practical guidance and should be read alongside the relevant sections of this Privacy Notice.
Reform UK has a legal obligation to protect personal information from being disclosed to the wrong person. Before releasing personal information in response to a request made under UK data protection legislation, we must be satisfied that the individual making the request is entitled to receive that information.
Where we have reasonable doubts concerning the identity of the requester, Article 12(6) UK GDPR permits us to request additional information necessary to verify identity before responding.
The type of information requested will depend upon the circumstances of the request. Where possible, we will adopt the least intrusive method of identity verification reasonably available.
Further information is provided in Section 20 – Identity Verification.
Where address information forms part of the personal information requested, or where we need to distinguish between individuals with similar names, proof of address may assist us in verifying identity and locating the correct records.
Address verification also helps reduce the risk of personal information being disclosed to an unauthorised person.
The Information Commissioner's Office recognises that organisations may request additional information where they have reasonable doubts concerning an individual's identity. Reform UK will only request information that is reasonable and proportionate in the circumstances.
You are not required to explain why you are exercising your rights under UK data protection legislation.
However, understanding the nature of your relationship with Reform UK helps us identify the systems most likely to contain your personal information.
For example, membership records, supporter databases, candidate records, volunteer records and donation systems are maintained separately for different operational purposes.
Providing this information enables us to conduct searches more efficiently and reduces the likelihood of unnecessary delays.
If you choose not to provide this information, we will still undertake reasonable and proportionate searches based upon the information available to us.
Further information is provided in Section 21 – Why We May Ask About Your Relationship With Reform UK.
Not necessarily.
The way in which Reform UK communicates with electors depends upon the type of communication and the lawful source of the information used.
Some political communications are delivered to every residential property within a defined geographic area without using the names or addresses of individual residents. These are commonly referred to as unaddressed mailings.
Other communications may be addressed to individual electors using information lawfully supplied under electoral legislation, including electoral register information where permitted. Where electoral register information is used solely for a specific campaigning activity, Reform UK may not retain a permanent copy of the personal information once that activity has concluded.
Accordingly, receiving a political communication from Reform UK does not necessarily mean that we continue to hold your personal information, nor does it necessarily mean that your information exists within a permanent Party database.
If you wish to know whether Reform UK currently processes your personal information, you may exercise your Right of Access under Article 15 UK GDPR by submitting a Subject Access Request. Further information is provided in Section 22 – Accessing Your Personal Information.
For further information about how Reform UK lawfully uses electoral register information for democratic engagement, please see Section 12 – Electoral Register Information and Democratic Engagement.
The right to erasure under Article 17 UK GDPR is an important individual right, but it is not an absolute right.
There are circumstances where Reform UK is legally required, or otherwise permitted, to retain certain personal information. These include compliance with electoral legislation, financial reporting requirements, legal obligations, safeguarding responsibilities and the establishment, exercise or defence of legal claims.
In addition, we may retain limited suppression information to ensure that objections to future communications continue to be respected.
Where information cannot lawfully be erased, we will explain the reasons.
Suppression records are retained to respect your wishes, not to continue processing your information for campaigning purposes.
If you ask Reform UK not to contact you again, we may need to retain a limited amount of identifying information so that your request can continue to be honoured in the future.
Without a suppression record, there is an increased risk that your details could be obtained again from another lawful source, resulting in communications that you have previously asked not to receive.
Suppression records are therefore an important privacy safeguard rather than a marketing tool.
Where Reform UK has reasonable doubts concerning your identity, we may request additional information before releasing personal information.
If sufficient information is not provided to enable us to verify identity, we may be unable to comply with your request because doing so could risk disclosing personal information to an unauthorised person.
This protects both you and Reform UK.
Where possible, we will explain what additional information is required and why.
Yes. However, before releasing personal information to another individual, Reform UK must be satisfied that they have appropriate authority to act on your behalf.
Depending upon the circumstances, we may request written authority signed by you, evidence of a legal appointment (such as a Lasting Power of Attorney), or other documentation demonstrating that the individual is authorised to represent you.
We may also contact you directly where appropriate to confirm that authority has been given.
Reform UK will respond without undue delay and, where applicable, within one calendar month, in accordance with Article 12 UK GDPR.
Where identity verification is required under Article 12(6) UK GDPR, the statutory response period begins once sufficient information has been provided to enable us to verify your identity.
Where a request is particularly complex, or where multiple requests have been submitted, the law permits an extension of up to a further two months. If this is necessary, we will explain the reasons and provide a revised response date.
Some requests are very broad and may cover many years of correspondence or multiple systems.
Clarifying the scope of a request helps us identify the information most relevant to you and ensures that searches remain reasonable, proportionate and focused.
You are not obliged to narrow or clarify your request. However, doing so may enable us to respond more quickly and efficiently.
The Electoral Register is maintained by your local Electoral Registration Officer (ERO), not by Reform UK.
Where Reform UK receives electoral register information, we process it in accordance with electoral legislation. We do not own, maintain or amend those records.
If you believe that your electoral registration details are inaccurate, you should contact your local Electoral Registration Officer, who is responsible for maintaining the register.
Reform UK cannot amend or require amendments to the Electoral Register.
If you are dissatisfied with the way Reform UK has processed your personal information, we encourage you to contact our Data Protection Officer in the first instance.
We operate a documented complaints procedure and will consider your concerns fairly, transparently and without undue delay.
If you remain dissatisfied after we have considered your complaint, you have the right to complain to the Information Commissioner's Office (ICO), the United Kingdom's independent regulator for data protection.
Further information is provided in Sections 30 and 31 of this Privacy Notice.
If you cannot find the answer to your question within this Privacy Notice or the accompanying Reference Guides, please contact Reform UK's Data Protection Officer.
We are committed to explaining our processing activities clearly and transparently and will always seek to assist individuals in understanding their rights and our responsibilities under UK data protection legislation.
This Privacy Notice has been designed to promote openness, accountability and trust. If anything remains unclear, we encourage you to ask.
