Rules and ethics
Part of Small business grants rules and ethics: compliance checks
Data protection for a grant application or funded project, from purpose to retention
Plan data protection for an England business grant application or funded project by defining purpose, lawful basis, access, sharing and retention.
A grant application may use personal data about directors, employees, customers, research participants or delivery partners. Start by listing the information, purpose and organisations involved. Do not collect extra data merely because a form or funder might ask for it later.
This is general guidance. The UK GDPR and Data Protection Act require case-specific decisions, and a qualified adviser or data-protection officer should review higher-risk processing.
What to take away
- List the personal data, purpose and organisations involved before you collect anything.
- Decide controller, joint controller or processor roles for each activity, not by contract labels.
- Choose and document a lawful basis before processing, and do not assume consent is correct.
- Give access only to people who need the data for an authorised task.
- Set a retention period based on the agreement, legal need and project purpose.
Map the data
Create a record containing the data field, person concerned, source, purpose, lawful basis, recipient, storage location, access, retention and deletion method. Separate company information from personal data about identifiable people.
Data map fields
- Data field
- Person concerned
- Source
- Purpose
- Lawful basis
- Recipient
- Storage location
- Access
The ICO's UK GDPR guidance and resources provide the primary framework for organisational compliance. A grant agreement may add security or reporting duties but does not remove statutory responsibilities.
Define roles
Decide whether the funder, applicant, adviser and delivery supplier act as controllers, joint controllers or processors for each activity. The answer depends on who decides the purpose and means of processing. A label in a template contract does not settle it.
Controller or processor?
Who decides purpose and means of processing?
controller or joint controller
processor
Put necessary terms in contracts and explain responsibility to staff. Do not send an applicant list to a supplier until the role and permitted use are clear.
Choose and document a lawful basis
Identify a lawful basis before processing. Consent is not automatically the right choice. The basis depends on the purpose, organisation and relationship. Special-category or criminal-offence data needs further conditions and controls.
The six bases, each with a grant example:
- Consentusing a participant's photograph in a case study, with a right to withdraw.
- Contractpaying a supplier, which needs its contact and bank details.
- Legal obligationkeeping tax and payroll records the law requires.
- Vital interestscalling an ambulance if a participant falls ill at a funded event.
- Public taska council processing data to deliver a funded public service.
- Legitimate interestsemailing a partner business contact to arrange a meeting, after a balancing test.
Record the basis and the reasoning before processing starts.
Choose a lawful basis
- Identify purpose
- Check organisation and relationship
- Select lawful basis
- Document before processing
- Add special-category conditions if needed
Where research is involved, the ICO's research-processing guidance distinguishes ethical participation consent from UK GDPR consent as a lawful basis.
Tell people what happens
Provide a clear privacy notice covering identity, purposes, lawful basis, recipients, retention, rights and complaint route. Give it when the information is collected, or as required when data comes from another source.
Adapt this wording: 'We are [organisation]. We use your personal data to assess and administer your application under [lawful basis]. We share it with [recipients] and keep it for [period]. You can ask for a copy, correction or deletion, or object, by contacting [details]. You can complain to the ICO.'
Privacy notice contents
- Identity
- Purposes
- Lawful basis
- Recipients
- Retention
- Rights
- Complaint route
Avoid vague wording that permits unrelated future marketing. If an adviser plans to contact applicants for commercial purposes, explain that purpose and assess the marketing rules separately.
Limit access and sharing
Give access only to people who need the data for an authorised task. Use approved systems, strong account controls and secure transfer. Check whether a funder genuinely needs raw personal data or can accept an aggregate report.
Set a retention period based on the agreement, legal need and project purpose. Preserve required grant evidence, but do not keep every interview recording or contact list indefinitely.
An example schedule, to be replaced by the periods in your agreement:
| Record | Example retention period |
|---|---|
| Grant evidence and award papers | Seven years from the final claim, or the funder's stated period |
| Financial records | Six years from the end of the accounting period |
| Interview recordings and transcripts | Delete after transcription, typically within 12 months of project end |
| Contact lists for administration | Keep while the application is live, then delete, typically within 12 months |
The grant agreement, tax rules and the limitation period for claims set the real figures.
Assess suppliers
Before using an application portal, consultant, survey tool or cloud service, record what personal data it receives and under whose instructions. Review security, subprocessors, international transfers, deletion and support for individual rights. Put required terms in a signed contract before sharing data.
Do not assume that a well-known supplier settles the assessment. The relevant question is how the chosen service, plan and configuration handle this project's information.
Consider a DPIA
Screen the project for high-risk processing before launch. New technology, large-scale monitoring, sensitive information or vulnerable people may require a data-protection impact assessment. Record the decision even when the full assessment is not required.
The ICO names three cases that always need a DPIA: systematic and extensive profiling with significant effects, large-scale special category or criminal offence data, and large-scale monitoring of a publicly accessible area. Other triggers include children's data, vulnerable people, dataset matching and innovative technology.
A worked example shows the test in practice. A funded employability project that scores applicants' health disclosures with an automated tool and shares the scores with a council uses special category data at scale, automates decisions and involves vulnerable people.
Separate grant administration and marketing
Contact needed to administer an application does not automatically permit later promotion of advisory services. Define each purpose, assess the relevant data and electronic-marketing rules, and make objection or withdrawal routes work in practice.
Respond to change and incidents
Review the data map when the project adds a supplier, new reporting field or different use. Complete a data-protection impact assessment where required. Maintain an incident route so staff can report loss, misdirection or unauthorised access quickly.
Report a personal data breach to the ICO within 72 hours of becoming aware of it, where it is likely to risk people's rights and freedoms. Tell affected individuals without undue delay if the risk is high. A processor must tell the controller without undue delay. Log every breach, including those you do not report.
Publication checks
Remove personal details from public case studies unless the intended use is properly authorised. A publicity clause in a grant agreement does not automatically provide consent to publish an employee's story or photograph.
Before you act
- List data fields, purposes and organisations involved.
- Decide controller, joint controller or processor roles for each activity.
- Choose and document a lawful basis before processing.
- Provide a clear privacy notice when collecting data.
- Limit access to people who need the data.
- Assess suppliers before sharing any personal data.
Common questions
How do I decide whether the funder, applicant, adviser or supplier is a controller or processor?
Work through the test in Define roles for each activity. It turns on who decides the purpose and means, not on a contract label.
When do I need a data-protection impact assessment for a grant project?
Screening looks at the scale, the sensitivity of the data, the technology used and the people affected. The Consider a DPIA section lists the triggers and a worked example.
Can I use contact details from a grant application to market advisory services later?
No. Contact needed to administer an application does not automatically permit later promotion of advisory services. Define each purpose, assess the relevant data and electronic-marketing rules, and make objection or withdrawal routes work in practice. Avoid vague wording that permits unrelated future marketing.
