How we manage your personal information when you deal with us at Welsh Revenue Authority (WRA) about Welsh taxes.
This notice informs you as an individual or an organisation about personal data we collect, use, share or process when you transact with us.
You may give us your personal data and information when you:
- pay devolved Welsh tax
- are involved in a transaction where someone pays Welsh tax (for example, buying property subject to Land Transaction Tax)
- contact us about our guidance and services
Devolved taxes are ones where the tax rules are set in Wales, and the tax collected funds our public services. The WRA collects 2 devolved taxes in Wales. These are:
- Land Transaction Tax
- Landfill Disposals Tax
We get information from you when we collect taxes. This often includes your personal information. That information may come directly from you or from an agent, for example, a solicitor acting on your behalf.
We’ll be the data controller for your personal data gathered as part of the 2 taxes we manage.
A data controller is someone who, on their own or jointly with others, decides what and how your personal data is used.
If other organisations give us information about you, and we add it to information we already hold about you, we’re also the data controller for this.
Personal information we collect
The personal data we collect, store, and use when you deal with us, includes your:
- title and full name
- current and previous addresses
- date of birth
- email address
- phone numbers
- forms of identification, such as National Insurance number, passport, driving licence
- information related to tax transactions, including any:
- amounts involved
We’ll also collect information about any business involved, including their:
- company or trading name
- contact details
- company number, if applicable
- VAT registration number, if applicable
We may also collect further personal data to assist with refunds, enquiries, and investigations.
How we use information about you
We’ll only use your personal information in the following ways to support the Welsh taxes we collect and manage.
To ensure compliance with tax legislation
We’ll use your data to:
- assess the risk of tax avoidance, error and fraud in returns and payments
- take risk‑based decisions via automated processing which may lead to further investigation
- reduce avoidance, error, and fraud by recovering debt and issuing penalties
- take any lawful action for tax compliance
- send operational updates to agents
To work with public sector partners
In some cases, where the law allows, we’ll share and link data about you or your agent with:
- law enforcement agencies
- other government departments, including:
- Revenue Scotland
- HM Land Registry
- Welsh Government
- local authorities
- Natural Resources Wales
We’ll ensure information about you or your agent is not shared outside the WRA, unless:
- there’s a lawful reason to do so
- the processing is fair and necessary
Data shared with us, such as from other government departments, is generally not available to everyone. Sometimes non-personal data may be available, for example, property information provided by HM Land Registry.
For our analysis and research
We’ll use data to help us better understand Welsh taxes and improve our services, such as providing guidance and communication in the way you asked.
We also analyse data and publish statistics on our website. We’ll ensure neither you nor your agent can be identified in analyses or research reports that we publish.
The public can use the information we can publish for their purposes via an Open Government Licence.
Lawful use of your data
We’ll only use your personal information when the law allows us to and most commonly in the following circumstances:
- due to our statutory function
- where we need to comply with a legal obligation
- where we may be obligated to hold data for compliance reasons
- where we have your informed consent
Specific powers within the Tax Collection and Management (Wales) Act 2016 apply in these cases, under:
- Section 12 Main functions
- Section 13 Internal authorisation to carry out functions
- Section 14 Delegation of functions
- Section 16 Use of information by the WRA and delegates
Our lawful basis for using your personal information under the UK General Data Protection Regulation (UK GDPR) is usually Article 6(1)(e) – public task, and Article 6(1)(a), where we ask for your consent.
This means we can use your personal information to collect and manage devolved taxes and ensure you pay the correct amount of tax.
Sometimes we’ll need to process special categories of personal data. We may need to do this to provide extra support to you or to store communication preferences which may reveal something about your health, even if you’ve not told us yourself. We’ll rely on your consent to hold this data.
All data we hold is subject to:
- UK General Data Protection Regulation (UK GDPR)
- Data Protection Act 2018
- any other applicable domestic and EU law
Sharing your data
As the data controller, we may decide to share your data with others as described, including:
- non-government agencies
- researchers for statistical or research purposes
In every case, disclosures will be approved and controlled by an appropriate data access agreement that will:
- limit the use of your data to the specific identified purpose
- not identify you in any published reports
- allow your data only to be stored for the duration of the research and destroyed afterwards
- demand that your data is handled and processed and destroyed securely
Wherever possible we will remove any information about you or your agent. We will only pass your data to others where the law allows it, and where the research would not be possible without it.
How long we’ll use your information
We’ll keep your data for as long as we need to carry out our duty.
We may need to keep data for more than 25 years to check avoidance, fraud or error in separate transactions made many years apart by the same person.
Non-identifiable information used in analysis or research may be kept for as long as it’s useful.
Protecting your information
Any personal information we collect about you or your agent will be collected, stored, and transmitted securely.
We’ll only share information about you with others where:
- it’s lawful to do so
- required for an identified purpose
UK GDPR lists certain rights that you have concerning your data. These rights are about the lawful basis for collecting and using your data.
For most uses made of your data, you have the right to be informed (which this notice covers).
Data about you supplied directly to us for tax collection and management, and to comply with tax law
This will include advice and guidance we provide in respect to our taxes.
You have the right to:
- be informed (this notice - this may be restricted in certain circumstances)
- access your information (this may be restricted in certain circumstances)
- correct errors in your information (this may be restricted in certain circumstances)
See the following for how other rights apply in some circumstances.
For any questions about this notice or your rights, please contact our Data Protection Officer.
Data Protection Officer
Welsh Revenue Authority
PO Box 108
Rydym yn croesawu gohebiaeth yn Gymraeg / We welcome correspondence in Welsh.
Send complaints to this contact in the first instance. You can also complain directly to the Information Commissioner’s Office (ICO). The ICO is the UK supervisory authority for data protection issues.
Information Commissioner’s Office Wales
17 Churchill Way
Telephone: 029 2067 8400 / 0303 123 1113
Changes to this privacy notice
Any changes to this privacy notice will be updated on this page, for example, any new uses of personal data.
From time to time, we may also contact you through other means about the processing of your personal data.