HMRC privacy notice
How HMRC uses personal information.
OPEN HELPAbout this guide
A Subject Access Request (SAR) allows individuals to request information held about them.
Useful help now
Direct routes to official or established information relevant to this guide.
HMRC Data Protection, Subject Access Requests (SARs), Personal Tax Records, Correcting Information, Identity Verification and Online Tax Accounts Purpose: This guide provides factual information based on UK legislation, official HMRC guidance, the Information Commissioner's Office (ICO), and other recognised public authorities. It explains how HMRC handles personal information, what rights individuals have, how to access tax records, and how to challenge inaccurate information. Important: HMRC must follow UK data protection law, human rights obligations, public law duties and statutory requirements when collecting, storing, sharing and using personal information.
Contents
- Your Privacy Rights
- HMRC Data Protection
- Subject Access Requests (SARs)
- Personal Tax Records
- Correcting Information
- Identity Verification
- Online Tax Accounts
- HMRC Data Sharing
- Automated Decision-Making
- Complaints About HMRC Data Handling
- Information Commissioner's Office (ICO)
- Independent Support and Advice
1. Your Privacy Rights
What Laws Protect Your Information?
Personal information held by HMRC is protected by:
- UK General Data Protection Regulation (UK GDPR)
- Data Protection Act 2018
- Human Rights Act 1998
Official guidance:
Key Rights
Individuals generally have rights to:
Know What Information Is Held
Request Access to Information
Correct Inaccurate Information
Challenge Unlawful Processing
Make Complaints
Request Explanations About Data Use
Official guidance:
2. HMRC Data Protection
What Information Does HMRC Hold?
HMRC may hold information relating to:
- Tax records
- National Insurance records
- PAYE information
- Self Assessment returns
- Benefits and tax credits information
- Employer information
- Pension records
- Compliance checks
- Correspondence
Official guidance:
HMRC Responsibilities
HMRC should:
- Process information lawfully
- Keep information secure
- Use information for authorised purposes
- Comply with data protection legislation
Official guidance:
3. Subject Access Requests (SARs)
What Is a Subject Access Request?
A Subject Access Request (SAR) allows individuals to request information held about them.
This may include:
- Personal tax records
- Correspondence
- Notes held by HMRC
- Information used in decisions
Official guidance:
What Can Be Requested?
Depending on the circumstances, individuals may request:
Copies of Personal Information
Information About How Data Is Used
Information About Data Sharing
Records Connected to HMRC Decisions
Time Limits
Organisations generally have legal obligations to respond to valid requests within statutory timeframes.
Official guidance:
- Subject Access Requests (ICO)
4. Personal Tax Records
Accessing Tax Records
Many records can be accessed through HMRC services.
Examples include:
- PAYE information
- National Insurance records
- Tax codes
- Employment history
- Self Assessment information
Official guidance:
National Insurance Records
Official guidance:
State Pension Records
Official guidance:
5. Correcting Information
What If HMRC Information Is Wrong?
Individuals may request corrections where information is inaccurate.
Examples may include:
- Incorrect income figures
- Wrong addresses
- Incorrect National Insurance records
- Errors in tax records
Official guidance:
If HMRC Disagrees
Depending on the issue, individuals may:
Provide Evidence
Request Review
Use Complaint Procedures
Appeal Certain Decisions
Official guidance:
6. Identity Verification
Why Does HMRC Verify Identity?
HMRC may verify identity to:
- Protect accounts
- Prevent fraud
- Protect taxpayer information
Official guidance:
Acceptable Evidence
Requirements may vary depending on the service being used.
Official guidance:
- Government Identity Verification
Your Rights
Identity checks should be:
- Lawful
- Proportionate
- Relevant to the service provided
7. Online Tax Accounts
Personal Tax Account
The Personal Tax Account allows access to information such as:
Income Tax Records
National Insurance Contributions
Tax Codes
State Pension Information
Official guidance:
Business Tax Accounts
Official guidance:
8. HMRC Data Sharing
Can HMRC Share Information?
HMRC may share information where permitted by law.
Examples can include sharing with:
- Other government departments
- Law enforcement bodies
- Courts and tribunals
- Public authorities
Such sharing must generally have a lawful basis.
Official guidance:
Rights Concerning Data Sharing
Individuals may be able to request information about:
- What information is held
- How information is used
- Who information has been shared with
Official guidance:
9. Automated Decision-Making
What Is Automated Decision-Making?
Some systems may assist in processing information, identifying risks, or supporting decisions.
Where applicable, individuals may have rights relating to automated processing under data protection legislation.
Official guidance:
10. Complaints About HMRC Data Handling
Step 1 – Contact HMRC
Raise concerns directly with HMRC.
Official guidance:
Step 2 – Escalation
If unresolved, additional review options may be available.
Official guidance:
11. Information Commissioner's Office (ICO)
What Is the ICO?
Information Commissioner's Office
The ICO is the UK's independent authority for data protection and information rights.
Official website:
When Can You Contact the ICO?
Examples include concerns about:
- Access to information
- Incorrect personal data
- Data misuse
- Data breaches
- Privacy rights
Official guidance:
Human Rights and Fair Treatment
Relevant legislation includes:
- Human Rights Act 1998
Public authorities, including HMRC, should act:
Lawfully
Fairly
Proportionately
Within Their Legal Powers
Official guidance:
Independent Advice and Support
HMRC
Data Protection
Tax Support
Low Incomes Tax Reform Group
TaxAid
Citizens Advice
Additional Rights People Often Miss
Right to Access Information
Right to Correct Inaccurate Information
Right to Complain
Right to Appeal Certain Tax Decisions
Key Legal Principles
Under UK law, HMRC must process personal information in accordance with the UK GDPR, the Data Protection Act 2018, and other applicable legislation. Individuals generally have rights to know what information is held about them, access that information, request corrections, challenge unlawful processing, make complaints, and seek independent oversight through the Information Commissioner's Office. HMRC must act fairly, lawfully, proportionately and within powers granted by Parliament, while taxpayers have rights to privacy, transparency, review and appeal where provided by law.