Privacy notice
This privacy notice explains how we collect and manage your personal data when you use the Report receipt of waste service.
If you are providing information to us about other people, you must make them aware that their information is being shared with us and refer them to this privacy notice.
Who collects your personal data
The 4 UK environmental regulators are joint controllers, under the UK General Data Protection Regulation (UK GDPR) and Data Protection Act 2018 (DPA 2018), for the personal data we process in the Digital Waste Tracking System.
The UK environmental regulators are separate controllers that use personal data:
- to monitor and improve compliance with environmental legislation
- for law enforcement purposes
The environmental regulators are:
- Environment Agency
- Natural Resources Wales
- The Department for Agriculture, Environment and Rural Affairs (DAERA)
- Scottish Environment Protection Agency
Processor
Department for Environment, Food and Rural Affairs (Defra) and their commercial suppliers act as the processor for the personal data collected through the Digital Waste Tracking System.
What personal data we process
We may collect:
- your name
- addresses
- contact details
- vehicle registrations
For individuals, sole traders and unincorporated partnerships, personal data can include information about the movements of waste which involves individuals.
In England we will not collect personal data of individuals who bring household waste to a site provided by a waste disposal authority for the free deposit of household waste by local residents.
In Wales we will not collect personal data of residents of an authority who bring household waste to a site provided by a waste disposal authority or when any other person brings controlled waste to that site.
In Northern Ireland we will not collect personal data for the deposit of controlled waste at an authorised site provided by a District Council.
In Scotland we will not collect personal data for digital waste tracking purposes where waste is brought to a site provided by a waste disposal authority for the deposit of waste prior to transfer to a place provided to dispose of or recycle the waste.
The personal data forms part of the regulatory information requirements so we can understand who has produced, moved, treated or disposed of the waste.
How we obtain your personal data
We obtain your personal data when it is submitted to the Digital Waste Tracking system:
- directly from you
- from permitted waste receivers
Why we may process your personal data
Our purpose for processing your personal data is to support preparations for the establishment of a new digital waste tracking system. This system will enable the digital reporting of waste movements.
The lawful basis we rely on to process your personal data is article 6(1)(e) of the UK GDPR, which allows us to process personal data when this is necessary for the performance of a task set out in law and carried out in the public interest.
The processing has a basis in:
- The Digital Waste Tracking (Wales) Regulations 2026
- The Digital Waste Tracking (Scotland) Regulations 2026
- The Environmental Protection Act 1990 as amended by section 58 of the Environment Act 2021
- The Waste and Contaminated Land (Northern Ireland) Order 1997, as amended by section 59 of the Environment Act 2021
- The Interpretation Act 1978 allowing the Secretary of State for Environment, Food and Rural Affairs and the regulators to exercise anticipatory powers, in relation to legislation that is not yet in force
- The Secretary of State for Environment, Food and Rural Affairs undertakes the development and testing of a voluntary digital service in the exercise of common-law executive powers
It is in the public interest for the UK Environmental Regulators to support preparations of this new system to assist businesses with the upcoming changes to legislation, which will include Digital Waste Tracking regulations for each of England and Northern Ireland, and help facilitate a smooth transition to digital waste reporting.
How we use your personal data
During the public beta voluntary period, we will use data we collect in the Digital Waste Tracking system:
- to provide visibility and insight about what data we will receive and how we might use it
- to provide feedback to Defra and their commercial suppliers, on potential system improvements, quality of the data, its usefulness for regulatory purposes and any improvements that we would like to see
The UK environmental regulators may use the information as separate controllers:
- to monitor and improve compliance with environmental legislation
- for law enforcement purposes
We will not at any time use information we collect during the public beta voluntary period for the purpose of regulation and enforcement of Digital Waste Tracking regulations.
If you hold an environmental licence or permit with a UK environmental regulator, they will provide you with a privacy notice explaining how they will use personal data. This may include personal data held in the Digital Waste Tracking system.
We may use information uploaded to the system to contact you about the information provided.
Who we share your personal data with
We may share your personal data with Defra and their commercial suppliers as Processors and Sub-Processors if this is necessary to:
- identify and implement potential system improvements
- assess quality of the data, and its usefulness for regulatory and regulator policy purposes
- inform Defra of any improvements that we would like to see to the system
- test and develop the system
- report outputs from the system
We may share your name, address and information about waste movement with Defra and their commercial suppliers as separate controllers if this is necessary to:
- enable Defra to assess quality of the data, and its usefulness for their regulatory and policy purposes
- enable Defra to further test and develop the system and its outputs for their regulatory and policy purposes
We supply GOV.UK Notify with your name, address, email address and mobile telephone number so they can send emails, letters and texts to you on our behalf.
We will not share or disclose your personal data with any other party without your consent unless we are required or permitted to do so by law.
We do not use your personal information to make an automated decision or for automated profiling.
How long we keep your personal data
We will keep your personal data in the Digital Waste Tracking system for 7 years from when it is uploaded unless the information:
- is used by a UK environmental regulator as a separate controller
- relates to waste movements ending in Northern Ireland
If information is used by a UK environmental regulator as a separate controller, the regulator will explain in their relevant privacy notice how long they will keep your personal data.
If the information is associated with waste movements ending in Northern Ireland, we will keep it for 15 years from when it is uploaded.
We use Defra Customer Identity for the registration and account management. The Defra Customer Identity privacy notice explains how they will use your personal data when you register.
If you submit records using the alternative submission option (spreadsheet), we will keep a copy of the spreadsheet for 6 months.
Where your personal information is processed and stored
We will only transfer your personal data to another country that is deemed adequate in accordance with data protection law.
Contact Details
Each regulator has a separate personal information charter or privacy notice which explains:
- how to contact our Data Protection Officers
- what we do with your personal information (personal data) in general
- your rights and how to complain to the Information Commissioner's Office
- how we process personal data for law enforcement purposes
Environment Agency
Natural Resources Wales
Natural Resources Wales / Privacy notice
Department of Agriculture, Environment and Rural Affairs
DAERA Privacy Statement | Department of Agriculture, Environment and Rural Affairs
Scottish Environment Protection Agency
Scottish Environment Protection Agency - Privacy Notice
Changes to this notice
We may change this privacy notice. In that case, the 'last updated' date at the bottom of this page will also change. Any changes to this privacy notice will apply to you and your data immediately.
If these changes affect how your personal data is processed, we will take reasonable steps to let you know.