Public appointments stakeholder engagement: privacy notice

The Public Appointments Team (PAT) engages with stakeholders to share information, invite participation in events, and seek feedback on public appointments. To support this, we maintain contact lists of individuals and organisations who have an interest in public appointments.

This notice explains how personal data is processed and your rights under Articles 13 and 14 of the UK General Data Protection Regulation (UK GDPR).

We may process the following personal data:

• name
• email address
• organisation
• job title
• details of meetings where actions are required of officials 

We collect personal data:

• directly from you (for example, where you request to be added to a contact list, provide feedback, or contact us)
• from publicly available sources, such as organisational websites or other professional information
• through participation in meetings, events, or stakeholder groups 

We process personal data to:

• communicate policy updates or announcements
• seek feedback to inform policy development
• invite you to meetings, events, or training
• respond to queries and engagement requests
• share information about public appointments opportunities 

Processing is carried out under Article 6(1)(e) UK GDPR (public task), in the exercise of official authority vested in the Welsh Ministers.

This is supported by:

• the Public Appointments (No.2) Order in Council 2023; and
• the Governance Code on Public Appointments, which requires appointments to be made on merit through fair and open competition, drawing from as wide and diverse a pool of candidates as possible, and supports proactive engagement to ensure opportunities are accessible to people from a broad range of backgrounds. 

We do not routinely process special category personal data. Where it is provided voluntarily (for example through feedback or engagement activity), it will only be processed where necessary and in accordance with Article 9 UK GDPR. 

Personal data may be shared within the Public Appointments Team within Welsh Government for the purposes set out above. We do not routinely share this data with other departments.

Personal data is retained in line with the Welsh Government’s Retention and Disposal Schedule.

Stakeholders contact details are typically retained for up to three years. This may be extended where there is ongoing engagement or shortened where you ask for your details to be removed. 

Contact lists are reviewed regularly and data is deleted where it is no longer required.

Your personal data is processed within the UK. 

We do not use your personal data for automated decision-making or profiling. 

Under the UK GDPR, you have the right to:

• access your personal data
• request correction of inaccurate data
• request completion of incomplete data
• request erasure where there is no lawful basis for processing
• request restriction of processing in certain circumstances
• object to processing, including for direct marketing purposes 
• To exercise your rights, please contact the Data Protection Officer using the details below.

If you are unhappy with how your personal data has been handled, you can contact the Information Commissioner’s Office:

You also have the right to seek redress through the courts.