What is this privacy notice for?
The UK Covid-19 Inquiry (the “Inquiry”) ‘Every Story Matters’ service is an online form allowing individuals (over 18) to provide their experiences of the pandemic and share how the pandemic has impacted their lives, without the formality of giving evidence or attending a public hearing. We are a data controller for this work.
As part of gathering different experiences we conduct face to face research through a company called Ipsos. Ipsos conducted this research on our behalf under contract. We are joint controllers for this work. View the Ipsos privacy notice.
In this privacy notice, we will explain:
- what information we collect
- when we collect it
- how we use this in relation to the Inquiry
- what happens to the information after the Inquiry ends
- Your data protection rights and how to contact us if you need more information.
Who we are
We are an independent Inquiry team, sponsored by the Cabinet Office.
What personal data will be collected and processed?
We will process any personal data that you may provide to us via the web form, including special category personal data, criminal conviction data, and opinions. Specific optional demographics questions, such as ethnicity, religion, gender identity, postcode and others are asked to help us understand how experiences of the pandemic varied among people from different groups and different geographic areas, including as an assessment of socioeconomic status.
We also use website analytics to gather information on how our site is used.
Ipsos conducted face to face research and analysed this data alongside webform data. They then constructed anonymised, thematic Every Story Matters records. These records have been entered into evidence for the relevant Inquiry module.
What do we use your data for?
We process your responses from ‘Every Story Matters’ to build evidence for the Inquiry.
After the Inquiry ends, your data will be loaned to a trusted research environment called the UK Data Service for research purposes. The Cabinet Office, as our sponsor department, will be data controller for this loan.
Prior to this loan, the Inquiry will ‘cleanse’ the data to ensure personal information is removed and stories are not identifiable. This will include the removal of the unique code attached to each story.
What is our legal basis to use your information?
Our legal basis for collecting and processing your personal data to build evidence for the Inquiry is that it is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the data controller (Article 6(1)(e) UK GDPR). In this case that is the Inquiry’s work to fulfil its Terms of Reference.
The legal basis for processing any sensitive personal data, or data about criminal convictions, where we receive it, is that it is necessary for reasons of substantial public interest (Article 9 (2)(g) UK GDPR) and archiving purposes in the public interest (Article 9(2)(j) UK GDPR) for the exercise of a function conferred on a person by an enactment, or the exercise of a function of a Minister of the Crown (para 6, schedule 1, Data Protection Act 2018). The function is the Inquiry’s work to fulfil its Terms of Reference.
Our legal basis for further processing your personal data to prepare it for transfer to the UKDS is that it is necessary for the legitimate interests of the data controller (Article 6(1)(f) UK GDPR). This processing activity is exclusively to cleanse Every Story Matters stories of personal data prior to closure of the Inquiry to ensure a minimal impact on privacy, and satisfy the interests of the Inquiry in making Every Story Matters data available for research.
Who do we share your information with?
Our research and analysis provider Ipsos have analysed the responses we received via the online form to inform the Inquiry and help us fulfil our Terms of Reference. They are our data processor acting under contract for this work.
Ipsos also analysed the responses from the face to face research and provided us with an anonymised dataset. We are joint controllers for this work.
We have published some of the individuals’ responses we receive. We will endeavour to remove any information that may lead to an individual being identified.
Anonymised responses may also be shared with other Covid-19 inquiries held under statute (to inform that Inquiry), government departments, public sector organisations and relevant third parties within other public bodies across the United Kingdom in order to help develop policy.
We may also share data with the appropriate agencies/authorities if we have any safeguarding concerns.
How long do we keep your data?
Personal data collected as part of Every Story Matters will be held by the Inquiry until the conclusion of the Inquiry. At the end of the Inquiry, all data collected as part of Every Story Matters will be transferred for the purposes of indefinite retention to form part of the historic record to The National Archives in accordance with the Public Records Act 1958. Personal data that is not required for archiving purposes will be destroyed.
Every Story Matters data, anonymised by the Inquiry, will be loaned to a trusted research environment called the UK Data Service, for a period of 15 years.
We will retain website analytics data for 2 years, which auto-renews on re-acceptance of cookies.
What are my rights?
- You have the right to request information about how your personal data are processed.
- You have the right to request a copy of that personal data. For data provided as part of the face to face research, please see further information about face to face research.
- You have the right to request that any inaccuracies in your personal data are rectified without delay.
- You have the right to request that any incomplete personal data are completed, including by means of a supplementary statement.
- You have the right to request that your personal data are erased if you no longer wish for it to be held or processed by the Inquiry (please see below link to withdrawal form).
- You have the right in certain circumstances (for example, where accuracy is contested) to request that the processing of your personal data is restricted.
- You have the right to object to the processing of your personal data
How to contact us
To contact the UK Covid-19 Inquiry Office: contact@covid19.public-inquiry.uk
To erase your data from Every Story Matters, please complete the Every Story Matters withdrawal form.
You can raise any privacy and data protection concerns with the UK Covid-19 Inquiry Data Protection Officer. The Data Protection Officer provides independent advice and monitoring of the Inquiry’s use of personal information: DPO@covid19.public-inquiry.uk
Complaints and appeals
If you have already made a complaint to us and are not happy with the outcome, you have the right to lodge a complaint with the Information Commissioner’s Office (ICO). The ICO is the supervisory authority responsible for data protection in the UK.
The ICO can be contacted at: Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF or 0303 123 1113 or icocasework@ico.org.uk
Any complaint to the Information Commissioner is without prejudice to your right to seek redress through the courts.
Review
This privacy notice was last reviewed March 2026.