Skip to main content

How we manage your personal information when you deal with us at Welsh Revenue Authority (WRA) about Welsh taxes.

This notice informs you as an individual or an organisation about personal data we collect, use, share or process when you transact with us.

You may give us your personal data and information when you:

  • pay devolved Welsh tax
  • are involved in a transaction where someone pays Welsh tax (for example, buying property subject to Land Transaction Tax)
  • contact us about our guidance and services

Devolved taxes are ones where the tax rules are set in Wales, and the tax collected funds our public services. The WRA collects 2 devolved taxes in Wales. These are: 

  • Land Transaction Tax 
  • Landfill Disposals Tax 

We get information from you when we collect taxes. This often includes your personal information. That information may come directly from you or from an agent, for example, a solicitor acting on your behalf.

A summary version of this privacy notice is also available. Agents should provide a copy of this notice to clients paying a devolved tax to know what personal information is being collected and used.

Data controller

We’ll be the data controller for your personal data gathered as part of the 2 taxes we manage.

A data controller is someone who, on their own or jointly with others, decides what and how your personal data is used.

If other organisations give us information about you, and we add it to information we already hold about you, we’re also the data controller for this.

Personal information we collect

The personal data we collect, store, and use when you deal with us, includes your:

  • title and full name
  • current and previous addresses
  • date of birth
  • email address
  • phone numbers
  • forms of identification, such as National Insurance number, passport, driving licence
  • information related to tax transactions, including any:
    • addresses
    • amounts involved

We’ll also collect information about any business involved, including their:

  • company or trading name
  • contact details
  • addresses
  • company number, if applicable
  • VAT registration number, if applicable

We may also collect further personal data to assist with refunds, enquiries, and investigations.

How we use information about you

We’ll only use your personal information in the following ways to support the Welsh taxes we collect and manage.

To ensure compliance with tax legislation

We’ll use your data to:

  • assess the risk of tax avoidance, error and fraud in returns and payments
  • take risk‑based decisions via automated processing which may lead to further investigation
  • reduce avoidance, error, and fraud by recovering debt and issuing penalties
  • take any lawful action for tax compliance
  • send operational updates to agents

To work with public sector partners

In some cases, where the law allows, we’ll share and link data about you or your agent with:

  • law enforcement agencies
  • other government departments, including:
    • HMRC
    • Revenue Scotland
    • HM Land Registry
    • Welsh Government
  • local authorities
  • Natural Resources Wales

We’ll ensure information about you or your agent is not shared outside the WRA, unless:

  • there’s a lawful reason to do so
  • the processing is fair and necessary

Data shared with us, such as from other government departments, is generally not available to everyone. Sometimes non-personal data may be available, for example, property information provided by HM Land Registry.

For our analysis and research

We’ll use data to help us better understand Welsh taxes and improve our services, such as providing guidance and communication in the way you asked.

We also analyse data and publish statistics on our website. We’ll ensure neither you nor your agent can be identified in analyses or research reports that we publish.

The public can use the information we can publish for their purposes via an Open Government Licence.

Lawful use of your data

We’ll only use your personal information when the law allows us to and most commonly in the following circumstances:

  • due to our statutory function
  • where we need to comply with a legal obligation
  • where we may be obligated to hold data for compliance reasons
  • where we have your informed consent

Specific powers within the Tax Collection and Management (Wales) Act 2016 apply in these cases, under:

Our lawful basis for using your personal information under the UK General Data Protection Regulation (UK GDPR) is usually Article 6(1)(e) – public task, and Article 6(1)(a), where we ask for your consent.

This means we can use your personal information to collect and manage devolved taxes and ensure you pay the correct amount of tax.

Sometimes we’ll need to process special categories of personal data. We may need to do this to provide extra support to you or to store communication preferences which may reveal something about your health, even if you’ve not told us yourself. We’ll rely on your consent to hold this data.

All data we hold is subject to:

Sharing your data

As the data controller, we may decide to share your data with others as described, including:

  • non-government agencies
  • researchers for statistical or research purposes

In every case, disclosures will be approved and controlled by an appropriate data access agreement that will:

  • limit the use of your data to the specific identified purpose
  • not identify you in any published reports
  • allow your data only to be stored for the duration of the research and destroyed afterwards
  • demand that your data is handled and processed and destroyed securely

Wherever possible we will remove any information about you or your agent. We will only pass your data to others where the law allows it, and where the research would not be possible without it.

How long we’ll use your information

We’ll keep your data for as long as we need to carry out our duty.

We may need to keep data for more than 25 years to check avoidance, fraud or error in separate transactions made many years apart by the same person.

Non-identifiable information used in analysis or research may be kept for as long as it’s useful.

Protecting your information

Any personal information we collect about you or your agent will be collected, stored, and transmitted securely.

We’ll only share information about you with others where:

  • it’s lawful to do so
  • required for an identified purpose

Your rights

UK GDPR lists certain rights that you have concerning your data. These rights are about the lawful basis for collecting and using your data.

For most uses made of your data, you have the right to be informed (which this notice covers).

Data about you supplied directly to us for tax collection and management, and to comply with tax law

This will include advice and guidance we provide in respect to our taxes.

You have the right to:

  • be informed (this notice - this may be restricted in certain circumstances)
  • access your information (this may be restricted in certain circumstances)
  • correct errors in your information (this may be restricted in certain circumstances)

See the following for how other rights apply in some circumstances.

Data about you from other organisations shared to comply with tax law or assess the risk of fraud or error, including automatic profiling

In this case, you have the right to:

  • be informed (this notice - this may be restricted in certain circumstances)
  • correct any errors in your information

In some circumstances, where you have a genuine reason to ask us, you have the right to:

  • object to the use of your information
  • restrict us using your information while we assess your objection

Data about you shared for analysis or research

You have the right to be informed (this notice).

Where possible, we’ll remove any information that identifies you from data used for analysis or research. We’ll only pass your identifiable data to others where the law allows it, and where the research would not be possible without it.

Data about you that does not relate to tax activities (such as feedback, complaints or storing preferences)

You have the right to:

  • be informed (this notice)
  • access your information
  • correct any errors in your information
  • have your information removed unless required by law
  • restrict the use of your information
  • to be notified of a correction, removal or restriction applied to your information
  • to receive your information in a format suitable for transmission to another body
  • not be subject to a decision based solely on automated processing, unless you give explicit consent for that

See separate privacy notice about data we manage when you communicate and engage with us.

Contacts

For any questions about this notice or your rights, please contact our Data Protection Officer.

Data Protection Officer

Welsh Revenue Authority
PO Box 108
Merthyr Tydfil
CF47 7DL

Rydym yn croesawu gohebiaeth yn Gymraeg / We welcome correspondence in Welsh.

Send complaints to this contact in the first instance. You can also complain directly to the Information Commissioner’s Office (ICO). The ICO is the UK supervisory authority for data protection issues.

Information Commissioner’s Office Wales

Churchill House
17 Churchill Way
Cardiff
CF10 2HH

Telephone: 029 2067 8400 / 0303 123 1113

Changes to this privacy notice

Any changes to this privacy notice will be updated on this page, for example, any new uses of personal data.

From time to time, we may also contact you through other means about the processing of your personal data.