Taxation (Wales) Bill: data protection impact assessment

Overview of the proposal

1. Over time, the Welsh Revenue Authority (WRA) and Welsh Treasury, supported by input from tax experts, have identified a number of prospective legislative changes to the Welsh Tax Acts - namely the Tax Collection and Management (Wales) Act 2016 (‘TCMA’), the Land Transaction Tax and Anti-avoidance of Devolved Taxes (Wales) Act 2017 (‘LTTA’), and the Landfill Disposals Tax (Wales) Act 2017 (‘LDTA’).

2. The proposed changes relate to areas where, in practice, the WRA has encountered difficulties in operating the legislation effectively or in giving full effect to what is considered to be the original intention of the Senedd.

3. The proposed changes are primarily technical measures intended to clarify, enhance and future-proof devolved tax legislation and support wider public service delivery in Wales. The proposals also reflect the maturity of Wales’ devolved tax system, drawing on WRA’s operational experience since 2018 and feedback from stakeholders and public service partners.

4. This DPIA considers the Bill’s proposed amendments to WRA’s information sharing powers. The proposals would amend section 18 of TCMA to introduce 2 new legislative gateways permitting the WRA to disclose Protected Information (as defined in Section 17 of TCMA):

1. where information is disclosed to Welsh local authorities relating to the collection and management of council tax and non-domestic rates, and
2. where information relating to visitor levy is disclosed to local authorities for the purposes of the WRA’s own visitor levy functions.

5. The proposals are about disclosure and use of information the WRA already holds. They will not create new ways for collecting information from taxpayers or accommodation providers.

Existing legal framework

6. Alongside the WRA’s broader obligations as a public body in accordance with UK GDPR and the Data Protection Act 2018, TCMA contains a strict framework for WRA tax information management and sharing. Section 16 allows information acquired in connection with a function of WRA by the WRA, or by a person to whom WRA functions have been delegated, to be used by those persons in relation to any WRA function. However, section 17 prohibits disclosure of ‘Protected Information’ by a relevant official unless the disclosure is permitted explicitly in TCMA section 18.

7.    Protected Information is defined as information relating to a person (the “affected person”):

1. which was acquired by the WRA or which was acquired by a person to whom any of the functions of WRA have been delegated in connection with those functions, and
2. by which the affected person may be identified (whether by reason of the affected person's identity being specified in the information or being capable of being deduced from it)

8. Protected Information is a broad term in TCMA. Protected Information may include property-level information and, in some circumstances, aggregate figures where disclosure could enable an affected person to be identified. For disclosure purposes, the WRA adopts a cautious approach to assessing whether information is protected. In practice, information may be treated as protected where there is a risk that an individual's identity could be deduced, including where other information may be available to the recipient.

9. Section 18 TCMA sets out the existing permitted disclosures. Examples include disclosures for certain WRA functions, disclosures with consent, disclosures for criminal investigations or proceedings, disclosures required or permitted by another enactment and disclosures to HMRC or Revenue Scotland in connection with relevant functions. The gap identified by officials is that these existing routes do not provide a suitable basis for all of the proposed sharing with local authorities.

10. The Visitor Accommodation (Register and Levy) Etc. (Wales) Act 2025 (VARL Act) creates another gateway for the WRA to share PI. Schedule 2 paragraph 4 (once commenced) will amend TCMA section 18 to add an additional information sharing permitted disclosure:

(k) the disclosure is of information acquired in connection with the functions of WRA under Part 2 of the Visitor Accommodation (Register and Levy) Etc. (Wales) Act 2025 (VARL Act) and it is made -

1. to a local authority in connection with a function of the local authority, or
2. to the Welsh Ministers in connection with their functions under section 2 of the Development of Tourism Act 1969 (c. 51).

11. In accordance with the Visitor Accommodation (Register and Levy) Etc. (Wales) Act 2025 (Commencement) Order 2025, the above provision came into force on 1st October 2026. WRA may now share National Registration scheme data in the manner described above. It was recognised during the VARL Act’s passage through the Senedd that non-aggregate details (such as the addresses of registered accommodation providers) would be of use to local authorities for matters such as council tax and non-domestic rates compliance as well as research given the lack of current available data in that area.

12. It should also be noted that Schedule 2 Paragraph 3 of the VARL Act amends section 17 of the TCMA 2016 to remove “taxpayer” from the phrase “protected taxpayer information.” This was to reflect the fact that information collected and managed by the WRA, in the exercise of its functions in connection with the register of visitor accommodation, will not always be information about a person paying a tax collected by the WRA. There are similar amendments in consequence of this to section 18 and 20 of TCMA.

Current draft bill proposals

13. The Bill proposes 2 information-sharing changes through amendments to TCMA. For the visitor levy issue, it would add a new subsection (1A) to section 18 to provide that despite the restrictions in section 18(1)(za), a disclosure of protected information is permitted if it is made to a principal council for the purposes of WRA’s functions relating to the assessment and collection of the visitor levy.  "Principal council" means a council for a county or a county borough in Wales under section 192(2) of TCMA.

14. For local taxation, the Bill would insert a new section 18(1)(l). This would permit disclosure where it is made to a qualifying person in connection with a function of a principal council relating to council tax and non-domestic rates.

15. The Bill defines qualifying person to include a principal council, a person authorised to exercise any function of such a council relating to council tax and non-domestic rates, and a person providing services to such a council relating to council tax and non-domestic rates. This is important for the DPIA because the possible recipients may be wider than council employees alone.

16. Where Protected Information is disclosed to a principal council for the purposes of WRA’s functions relating to the assessment and collection of the visitor levy or to a qualifying person  in connection with a function of a principal council relating to council tax and non-domestic rates, the Bill will also introduce a new criminal offence for any person who further discloses that information  unless the further disclosure is permitted by paragraphs (a), (c), (e), (f), (g), (h) and (l) of section 18(1) of TCMA, or it is made with WRA’s written consent.

17. During development of the proposals, it was noted that comparable tax authority information-sharing powers (Data Usage Agreement - local authority Digital Economy Act debt recovery data share pilot) are often supported by criminal offences and restrictions on onward disclosure. HMRC may share protected information under sections 48 and 56 of the Digital Economy Act 2017 (DEA) for public sector debt and fraud purposes. Sections 51 and 59 prohibit further disclosure of personal information received under these powers without HMRC’s consent and make unauthorised disclosure an offence, subject to specified defences i.e. where a person reasonably believed the disclosure to be lawful or that the information had already lawfully been made public.

18. Introducing a criminal offence for onward disclosure of protected information strikes a balance between protecting personal data and enabling public bodies to use relevant information to support the effective administration of their taxation functions.

Why a DPIA is needed

19. A DPIA is needed because the proposals would create new statutory gateways for sharing protected information, including personal data. Tax information is inherently sensitive in context, even when it is not special category data under UK GDPR. It can reveal property use, business activity, ownership patterns, liability decisions, compliance risk and financial circumstances.

20. The Article 36(4) ICO consultation recognised that the proposal creates a new power or obligation for the processing of personal data and involves sharing personal data with public bodies that the WRA could not previously share with under a suitable TCMA gateway.

21. The proposals may also engage Article 8 of the European Convention on Human Rights, because disclosure of tax and property-related information can interfere with a person’s private life, home and correspondence. Any interference must therefore be lawful, necessary and proportionate.

Controllers and parties involved

22. The WRA would decide whether a disclosure can be made under the proposed gateways and would remain responsible for its own processing. Where a principal council receives the information and determines how it will be used for council tax or non-domestic rates purposes, the council would be a controller for that processing.

23. The Bill also allows disclosure to persons authorised to exercise a council’s functions relating to the collection and management of council tax and non-domestic rates and providers of services relating to the collection and management of council tax and non-domestic rates. Each operational arrangement will need to map recipients carefully and identify whether a recipient is acting as controller, processor or in another capacity. This will be particularly important for contracted service providers.

24. Before operational sharing begins, the WRA and each participating local authority will have the appropriate data sharing governance in place. This should include information sharing agreements, memoranda of understanding, agreed routes for secure transfer, access controls, retention arrangements, breach reporting arrangements and audit mechanisms (documentation shall be developed in accordance with the Information Commissioner’s Office Data Sharing Code of Practice). Furthermore, appropriate privacy notices under Article 14 of the UK GDPR shall be developed. This will outline how WRA information is used, for example to produce non-identifiable statistics and who the data can be shared with.

Proposal 1: Sharing information with Welsh local authorities for local taxation purposes

25. The WRA holds information that may help Welsh local authorities administer local taxes more effectively and support the accurate collection of council tax and non-domestic rates. In practice, this may help councils maintain accurate tax bases, identify second homes, apply council tax premiums correctly, decide whether properties should be treated as domestic or non-domestic, and support compliance activity where reliefs or exemptions may have been claimed incorrectly.

26. The Bill provision would create a new permitted disclosure in section 18(1)(l) TCMA. This provides that protected information may be disclosed to a qualifying person in connection with a function of a local authority relating to the collection and management of council tax and non-domestic rates. This drafting is broader than disclosure only to named officers in a council team, because qualifying person may include the council itself, authorised persons and service providers.

27. At present, the WRA can share information with HMRC and Revenue Scotland for certain tax administration purposes, and information sharing already supports cross-government tax compliance at national level. The proposed gateway would extend the same general policy logic to local authorities, but only for their council tax and non-domestic rates functions.

28. The proposed gateway would be permissive rather than mandatory. The WRA would not be required to share information simply because a council asks for it. The WRA would retain control over whether disclosure is lawful, necessary and proportionate in the circumstances.

Wider policy context and legislative precedents

29. As identified in paragraphs 10 to 11 and 17, the proposal is not without precedent. Officials have identified existing or developing information sharing routes in related areas, including Local Government Finance Act 1988 provisions amended by the Enterprise Act 2016, the Non-Domestic Rating Act 2023, the Digital Economy Act 2017 and the Data (Use and Access) Act 2025. These examples show that information sharing for rating, verification, debt and fraud purposes has been recognised as part of wider public revenue administration and criminal offences also apply where information is disclosed without consent of the originating department.

Practical use cases identified by Welsh local authorities

30. Engagement with local authority revenues and benefits officers, as well as the Welsh Government local authority Data Protection Officers’ Network, identified several practical examples where WRA information could make local tax administration more accurate and less resource intensive. These examples are relevant to the necessity and proportionality of the proposed gateway:

• Council tax premiums: LTT higher rates and second home information may help councils check whether a council tax premium is being charged correctly.
• Ownership checks: LTT information may help where a council cannot establish property ownership or where liable parties avoid listing themselves as owners through Land Registry data used by councils.
• Refunds and changes of ownership: information about higher rate refunds may assist where a second home has been sold and councils need to manage council tax premium refunds.
• Property classification: visitor levy letting information, including the number of days a property is let, may help determine whether a property should sit within council tax or non-domestic rates.
• Empty property relief: visitor levy activity may show business use of a property at a time when empty property relief is being claimed.
• Small business rates relief: more timely leasehold or transaction data may help councils identify cases where multiple tenants in one premises claim relief in circumstances not captured by current VOA information.

Why the gateway is limited to council tax and non-domestic rates

31. The Bill clause limits the new local taxation gateway to functions of a local authority relating to the collection and management of council tax and non-domestic rates. This narrower approach supports data minimisation principles. If future local taxes are created and there is a policy need for WRA information to be shared for those new taxes, TCMA could be amended at that point. This avoids creating a broader gateway now for taxes or functions that have not yet been identified.

Why the gateway is narrower than the VARL Act gateway

32. The proposed local taxation gateway is deliberately narrower than the VARL Act section 18(k) gateway. Section 18(k) permits disclosure of information acquired in connection with WRA’s functions under Part 2 of the VARL Act to a local authority in connection with a function of that council, or to Welsh Ministers in connection with tourism functions.

33. The policy reason for a narrower gateway here is that visitor levy, LTT and LDT information is not public information. By contrast, some information connected with visitor accommodation registration may already be public-facing because providers advertise accommodation to visitors. Limiting the new gateway to council tax and non-domestic rates functions reduces the risk of function creep and supports proportionality.

Proposal 2: Sharing visitor levy information for WRA’s functions

34. The VARL Act amended TCMA to create additional information sharing routes for the WRA. However, the way the changes interact with WRA’s visitor levy functions leaves a practical gap. The WRA may be able to disclose information to a local authority during an LTT enquiry if that is needed for WRA’s LTT functions, but it may not be able to ask the same sort of question in support of a visitor levy enquiry.

35. The rationale behind the change is both practical and legal. There is a potential limitation in the existing information-sharing framework which could constrain the exchange of information needed to support the administration and compliance of the visitor levy in some circumstances. This may make visitor levy cases more difficult to resolve in a timely and efficient way.

36. The Bill addresses this by adding a new subsection (1A) to section 18 to provide that despite the restrictions in section 18(1)(za), a disclosure of protected information is permitted if it is made to a principal council for the purposes of WRA’s functions relating to the assessment and collection of the visitor levy. The policy intention is to put visitor levy taxpayers on the same footing as devolved taxpayers and to allow the WRA to administer visitor levy properly. This is not intended to create routine bulk sharing for visitor levy enquiries; use is expected to be infrequent and case-specific.

Does the proposal involve new collection of personal data?

37. The proposal does not create a new route for collection of personal data. It concerns disclosure and onward use of information already acquired by the WRA in the exercise of its functions.

Categories of personal data likely to be shared

Visitor levy information

• Number of visitors who stayed overnight at a property
• Amount of levy collected
• Location of the property
• Information or representations provided to the WRA by or on behalf of a liable person in connection with a review or appeal, and
• Other visitor levy information the WRA considers necessary to allow the recipient to carry out its functions.

Landfill Disposals Tax information

• New Landfill site registrations
• Higher risk transaction data which may impact non-domestic rates.

Land Transaction Tax information

• Higher rates transaction figures
• Non-residential transaction data
• Higher risk transaction details
• Information relevant to property ownership or changes of ownership, and
• Information that may help councils decide whether council tax premiums or non-domestic rating treatment is correct.

Small-cell and aggregate data

Small-cell or property-level aggregate information should be treated with caution. Even where information is presented in aggregate form, it may still be protected information if it relates to such a small number of persons, transactions or properties that a person’s identity can be deduced. This is particularly relevant to property and local taxation data, where a small number of transactions in a local area may make people or businesses identifiable, and therefore may still constitute protected information.
For disclosure purposes, the WRA adopts a cautious approach to small-cell and property-level aggregate data. Information may be treated as protected information where there is a risk that an individual's identity could be deduced, including through combination with other information available to the recipient.

Recipients of information

38. The Bill would allow the WRA as the data controller to disclose Protected Information to a qualifying person. This means the DPIA should not assume that the only recipients are council employees. Potential recipients may include:

• the local authority itself
• individual officers or other persons authorised to exercise relevant council tax or non-domestic rates functions, and
• persons providing services to a local authority relating to council tax and non-domestic rates.

39. It is envisaged that service providers remain within scope of the Bill; in which case, the operational arrangements will need to deal with contractual controls, onward disclosure, staff access, sub-contracting, audit, deletion and breach notifications. The criminal offence for wrongful onward disclosure of Protected Information will apply to these arrangements also. The WRA and subsequently local authorities where Protected Information is subsequently shared in accordance with the provisions of the Bill will also be responsible for complying with data protection law as data controllers.

Special category and criminal offence data

40. The proposals are not intended to involve sharing special category data as described in UK GDPR Article 9 or criminal convictions and offences data as described in Article 10. The information to be shared should be limited to what is necessary for local taxation administration and WRA’s visitor levy functions.

Data subjects affected

41. The DPIA identifies the following groups of people impacted by the Bill’s provisions:

• individuals liable to LTT, LDT or visitor levy
• visitor accommodation providers, including sole traders and individuals operating accommodation businesses
• property owners and occupiers whose information is relevant to council tax or non-domestic rates, and
• individuals who may be identifiable from property-level information or small datasets.

42. The proposal is not aimed at any specific group such as children, older people or vulnerable people. Any impact on such groups would be incidental, for example because a person is a taxpayer, property owner, liable person or accommodation provider.

Frequency of sharing

43. For local taxation purposes, requests may be made in relation to particular individuals or properties, or sharing may take place periodically, for example quarterly or annually, where that is justified and covered by an agreed data sharing arrangement. Arrangements will be supported by supplementary information-sharing governance work to be undertaken with local authorities.

44. For visitor levy disclosures made for WRA’s own functions, the expectation is different. Those disclosures are expected to be infrequent and case-specific, rather than routine bulk sharing.

Public consultation

45. The proposals sit within the Welsh Government and WRA consultation on legislative proposals relating to the Welsh Tax Acts. The consultation ran from 3 November 2025 to 26 January 2026 and covered proposed amendments to TCMA, LTTA and LDTA. The stated purpose was to clarify, enhance and future-proof the Welsh Tax Acts so the WRA can continue to manage Welsh taxes effectively.

46. The consultation invited views from the public, lawyers, tax advisers and representative bodies. It covered discrete, largely technical changes identified through WRA’s operational experience, feedback from taxpayers and advisers, engagement with Welsh public service partners and developments in relevant UK legislation.

Summary of responses

47. The summary of responses was published in March 2026. The majority of consultation responses were supportive of the proposals overall, and the consultation affirmed the Welsh Government’s view that the changes would help the WRA continue to manage Welsh taxes effectively.

Engagement with local authorities

48. Officials also engaged with local authority Revenues and Benefits Officers and the Data Protection Officer Network on possible uses of WRA data. Local authority officials have been very supportive of the proposal, noting similar information sharing pilots ongoing with HMRC.[2] The use cases discussed included checking the council tax base, identifying second homes, supporting correct application of council tax premiums, considering whether properties should be listed for council tax or non-domestic rates, and supporting compliance activity.

49. Local authority officers were also engaged on restrictions on onward disclosure. They were understanding of the rationale for restricting dissemination of WRA information and for extending the criminal offence for wrongful disclosure to persons receiving protected information under the new gateway.

50. During engagement, one authority gave examples of existing internal controls, noting that access to council tax and non-domestic rates customer data is restricted to operational revenues staff, that systems are ring-fenced for UK GDPR purposes, and that information is not released to councillors unless the taxpayer has given permission. This suggests that comparable controls can be built into the proposed WRA-local authority sharing model, whilst recognising that controls will need to be verified for each participating council.

ICO consultation

51. An Article 36(4) enquiry form has been prepared for consultation with the Information Commissioner’s Office. The form identifies that the proposals relate to personal data and include new information sharing powers. The Information Commissioner’s Office has provided their comments on the document and confirmed confirmed that the information provided adequately addressed the issues raised through the consultation process and as such closed the consultation.

Lawful basis

52. The proposed disclosures would be made under statutory gateways in TCMA, as amended by the Bill. For UK GDPR purposes, the lawful basis for both the WRA and local authorities is that processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority, in accordance with UK GDPR Article 6(1)(e). Each controller will still need to satisfy itself that the processing complies with UK GDPR and the Data Protection Act 2018.

Necessity

53. The local taxation gateway is needed because the WRA holds information that may materially assist local authorities in administering council tax and non-domestic rates, but the current TCMA legislative disclosure framework does not provide a suitable route for all relevant disclosures.

54. The visitor levy proposal is needed because the WRA may otherwise be unable to make practical enquiries of local authorities in support of visitor levy administration. Without the change, visitor levy taxpayers would be treated differently from devolved taxpayers in comparable situations.

Proportionality

55. The proposals are proportionate because the gateways are intended to be targeted, permissive and subject to safeguards. The WRA would decide whether disclosure is appropriate. Local authorities and qualifying persons would only receive information in connection with council tax and non-domestic rates collection and management functions, not for general council business. Visitor levy disclosures for WRA’s own functions are expected to be case-specific and infrequent.

56. The Bill uses the words “in connection with” the collection and management of council tax and non-domestic rates. That is a broad statutory test. To maintain proportionality in practice, the operational scheme should apply a narrower practical filter, for example requiring a clear link to collection, management, compliance or enforcement, and requiring the WRA to consider necessity and data minimisation before disclosure.

Onward disclosure and legal safeguards

57. The Bill includes a proposed restriction on onward disclosure. Unless an exception applies, Protected Information disclosed under the new local taxation gateway could not be further disclosed without consent, which may be general or specific. A breach of that restriction would be a criminal offence. This is an important safeguard, particularly because the proposed class of qualifying persons may include service providers as well as local authorities and authorised officers.

58. The proposed offence differs from the existing section 20 TCMA offence because the new section 20A model would allow further disclosure with WRA’s consent. The offence applies to “a person”, which includes individuals, bodies corporate and unincorporated bodies. This is broader than an offence limited to individual council officers and is relevant where information may be received by service providers or other bodies.

Operational governance

59. As outlined at paragraph 24, operational sharing will not begin until a practical governance model is in place. At minimum, this should cover who may request information, who within the WRA may authorise disclosure, the route for transferring information, permitted recipients, service provider controls, onward disclosure restrictions, data retention, accuracy checks, breach reporting and review arrangements.

Human rights and legislative competence

60. The proposals may engage Article 8 ECHR. The policy justification is that accurate administration of council tax, non-domestic rates and visitor levy supports the integrity of the tax system and the economic wellbeing of local authorities and Wales more broadly. The interference is therefore intended to be in accordance with law, for a legitimate aim, and no more than is necessary.

61. The proposed new onward disclosure offence may also engage Article 6 and Article 7 ECHR. The proposal creates a restriction and offence model similar to safeguards used in other data sharing legislation.

62. The Bill’s provisions relate to Wales and to devolved taxes and local taxes. Although protection of personal data is a reserved matter, the purpose of the provisions is not to regulate data protection law. The purpose is to enable local authorities to improve local taxation management and to assist the WRA in carrying out tax collection and management functions.

Risks, likelihood, impact and mitigation

More information is shared by WRA than is necessary for the relevant purpose

• Likelihood: Low
• Impact: High
• Mitigation: Limit the statutory gateway by purpose; require WRA approval; use template request forms; apply data minimisation in information sharing agreements.

Disclosure to service providers expands the recipient pool beyond council staff, and thus the risk of unauthorised onward disclosure without appropriate controls

• Likelihood: Medium
• Impact: High
• Mitigation: Require service provider due diligence, contractual confidentiality terms, role-based access, audit rights, sub-contracting controls and breach notification duties. Ensure the criminal offence for onward wrongful disclosure also applies in these instances.

Information is used by a local authority or qualifying person for wider purposes beyond council tax or non-domestic rates

• Likelihood: Low
• Impact: High
• Mitigation: Limit use through the statutory gateway and operational documents; prohibit secondary use unless authorised by law and agreed by the WRA; audit use. Ensure the criminal offence for onward wrongful disclosure also applies in these instances.

Onward disclosure without consent

• Likelihood: Medium
• Impact: High
• Mitigation: Rely on new section 20A offence; specify consent route and criteria; restrict access to named roles; require training and record keeping.

Onward disclosure consent is not clearly controlled

• Likelihood: Medium
• Impact: High
• Mitigation: Decide whether consent is given by the WRA, a relevant official, or the original disclosing official.

Incorrect matching or inaccurate data leads to incorrect local tax decisions

• Likelihood: Low
• Impact: High
• Mitigation: Require verification before enforcement action; record data provenance; create correction and challenge routes; review data quality regularly.

Insufficient transparency for taxpayers and accommodation providers

• Likelihood: Low
• Impact: Medium
• Mitigation: Update privacy notices; publish clear information about the gateway, purposes and safeguards; explain rights and relevant exemptions.

Security breach during transfer or storage

• Likelihood: Low
• Impact: High
• Mitigation: Use secure transfer routes, encryption, access logging, retention limits, breach reporting and regular assurance checks.

Strict onward disclosure offence is not understood by recipient organisations

• Likelihood: Low
• Impact: Medium/High
• Mitigation: Mandatory training, clear handling instructions, sign-off by recipient teams and annual refresher material before access to information is permitted.

Inconsistent implementation across local authorities

• Likelihood: Low
• Impact: Medium
• Mitigation: Use standard ISA and MOU templates; provide implementation guidance; require training and periodic review. Utilise Data Protection Officer Network with local authorities to ensure consistency of approach relating to WRA data sharing.

Measures to reduce risks

63. The residual risk is assessed as low. The impact of misuse or unauthorised disclosure of tax information could be high, but the likelihood should be reduced if the gateways are tightly drafted and supported by operational safeguards before any sharing begins. Furthermore, the criminal offence relating to the wrongful onward disclosure of protected information places responsibility directly on recipients to ensure that information is appropriately safeguarded and protected.

Lawfulness, fairness and transparency

64. Processing must be grounded in the statutory gateways and explained through clear privacy information. Taxpayers and accommodation providers should be able to understand why their information may be shared, with whom, and for what purposes.

Purpose limitation

65. Information shared under the local taxation gateway should be used only in connection with council tax and non-domestic rates functions. Visitor levy information shared with councils for WRA’s functions should be limited to what the WRA needs to administer the visitor levy.

Data minimisation

66. Only the information necessary for specific purposes should be shared. The WRA should consider each disclosure and avoid routine or bulk sharing unless it is justified and covered by an agreed arrangement.

Accuracy

67. The WRA and local authorities should take reasonable steps to ensure information is accurate and up to date. Councils should verify information before taking enforcement action where appropriate.

Storage limitation

68. Retention periods should be agreed in information sharing agreements. Data should not be retained for longer than necessary for the relevant council tax, non-domestic rates or visitor levy purposes.

Integrity and confidentiality

69. Information should be transferred and stored securely. Access should be restricted to authorised persons. Onward disclosure should be prohibited unless consent is given in accordance with the final statutory model or another legal basis applies.

Accountability

70. The WRA, local authorities and any qualifying persons receiving information should document decisions, maintain audit trails, monitor compliance, record disclosures, review effectiveness and update the DPIA as the policy and operational model develops.

71. The proposed information sharing provisions address identified gaps in WRA’s statutory disclosure powers. They are intended to support accurate and effective council tax and non-domestic rates administration and allow the WRA to administer visitor levy in a practical and consistent way.

72. The proposals involve protected information and therefore require strong safeguards. The gateways are intended to be narrowly drafted, disclosure should remain under WRA control, onward disclosure should be restricted, and operational sharing should not begin until information sharing agreements, memoranda of understanding, access controls, retention rules, breach processes and audit arrangements are in place.

73. This DPIA should be treated as a live document. It should be revisited as the Bill is drafted, introduced, amended and commenced, and again when specific operational sharing arrangements are agreed with local authorities and any service providers.