Skip to main content

How we’ll use your personal information at the Welsh Revenue Authority for the National Fraud Initiative (NFI).

We take part in the NFI, a data matching exercise that aims to highlight possible cases of error and fraud within the public sector.

In Wales, the NFI is coordinated by Audit Wales and nationally by the Cabinet Office (the Data Controller).

How it works

The NFI works by organisations supplying various sets of data from different information systems, in areas such as:

  • payroll
  • pensions
  • social housing
  • housing benefit
  • other state benefits
  • student awards
  • payments to suppliers
  • NHS exemptions
  • record of death

The data supplied is input to a secure database, designed to cross-match data items and identify:

  • potential fraud
  • inappropriate activity
  • erroneous payments

Data we submit

We submit datasets about our employees via a secure IT portal.

See Annex A for data fields we submit.

Lawful basis for processing

We’re required by law to protect the public funds we administer. We may share information provided with others responsible for auditing or administering public funds to prevent and detect fraud.

The UK GDPR lawful basis for processing is Article 6(1)(e) - processing is necessary for the performance of a task carried out in the public interest.

Our public task is set out in sections s12(4) and s33 of the Tax Collection and Management (Wales) Act 2016, which describe our functions and the responsibility for public funds of the Accounting Officer.

Sharing data

The data we submit will be shared with the Cabinet Office for the data matching to take place. Cabinet Office shares the data as necessary to prevent and detect fraud with the Auditor General for Wales.

If data submitted by one participant matches with another, we'll share summary information with them.

The data matches are returned to participants in a series of reports. Matches are reviewed to determine if they’re significant and, if so, allow further investigations to be undertaken. Returned reports include:

  • individuals claiming benefits at more than one authority
  • individuals who are on payroll and also claiming benefit
  • individuals recorded on more than one payroll
  • failed asylum seekers or those not entitled to work in the UK
  • duplicate payments to suppliers

The report highlighting staff who are employed by more than one participant will also be used to demonstrate our duty of care to employees, to confirm that working hour limits contained within the Working Time Directive are not exceeded.

Data retention

When it's confirmed data submission to Cabinet Office is successful, we'll destroy the data extracts from our systems.

Cabinet Office will keep data in line with their Data Deletion Schedule. This is currently being revised following consultation and will be made available, via this document, when it’s published.

Your rights

When we process your personal data, you have the right to:

  • request information about how it’s processed
  • request a copy
  • request us to correct any inaccuracies without delay
  • request that any incomplete data is completed
  • request that your data is erased if we no longer need it

Sometimes, you also have the right to request that the processing of your personal data is restricted. For example, where accuracy is queried


If you have any questions or concerns about how we process personal data, contact us:

Data Protection Officer

Welsh Revenue Authority
PO Box 108
Merthyr Tydfil
CF47 7DL

Rydym yn croesawu gohebiaeth yn Gymraeg / We welcome correspondence in Welsh.

You can also directly complain to the Information Commissioners Office (ICO). The ICO is the UK supervisory authority for data protection issues.

Information Commissioner’s Office Wales

Churchill House
17 Churchill Way
CF10 2HH

Telephone: 029 2067 8400 / 0303 123 1113

Rydym yn croesawu galwadau a gohebiaeth yn Gymraeg / We welcome calls and correspondence in Welsh.

Annex A: NFI Data Specifications

Payroll requirements

  • Data submitted should meet this data specification and include all field names listed.
  • Data should only be submitted via the Data File Upload (DFU) facility. This is now the only acceptable method to supply data. If another submission method is used our policy is to inform the Senior Responsible Officer/Director of Finance that data has been put at risk unnecessarily.
  • All payrolls (for example, monthly, weekly, and quarterly, members/councillors, schools, and teachers) should be provided. However, data should not be provided in respect of payrolls processed for other organisations on an agency basis unless:
    • this has been authorised by the organisation; and
    • the organisation has confirmed that a Privacy Notice has been issued.
  • Ensure a single file for each organisation is uploaded, for example, do not submit one file that merges Police, Fire and County Council employees.
  • Ensure that there’s only a single record for each employee, such as details for individual employees with more than one post should be merged into one record. For example, for employees with multiple posts ‘Gross pay to date’ and ‘Standard hours per week’ for each post should be added together to give aggregated totals for those 2 fields. Other fields such as ‘Date started’, ‘Sort code’ and ‘Bank account’ should be provided from the main (highest earnings) post.
  • Include current employees only.
Field nameData formatSupporting notes
Employee reference numberCharacter 
Employee post numberCharacterLeave blank if not applicable.
DepartmentCharacterProvide the Department where the employee works, for example, Social Services, Education. If this field contains a code, please provide a lookup table.
Forename(s)CharacterPlease ensure you capture any middle name(s) or initial(s). You can provide this in a separate Middle name(s) or middle initial(s) field or in the ‘Forename(s)’ cell if preferred.
Middle name(s) or middle initial(s)Character 
Address line 1Character 
Address line 2Character 
Address line 3Character 
Address line 4Character 
Unique Property Reference Number (UPRN)CharacterThis new field should significantly improve address matching.
Date of birthDate 
Home telephone number Character 
Mobile telephone numberCharacter 
Email addressCharacter 
Passport numberCharacter 
Date startedDate 
Date leftDateIncluded as an independent check that only current employees are included.
Leaver indicatorCharacterIncluded as an independent check that only current employees are included.
National Insurance NumberCharacter 
Full-time/part-time flagCharacterInsert ‘F’ for full time (employed for 30 or more hours per week), ‘P’ for part time (less than 30 hours a week) or ‘C’ for Casual/As and when employees.
Gross pay to dateNumericThis should be gross pay to date NOT taxable pay to date for the 2018/2019 financial year up to date of extract. Do not submit a record if this field is zero.
Standard hours per weekNumericFor example, 16 hours as 1600.
Date last paidDate 
Teacher flagCharacterInsert ‘T’ for a teacher.
Sort codeCharacter6 numeric characters in groups of 2 which may be separated by hyphens, for example, 20-4523.
Bank accountCharacterUsually 8 numeric characters.
Building society roll numberCharacterBuilding societies have a roll number where payments are disbursed to after being paid into a single account.