The registered data controllers encompassed by the Royal Household are as
follows:
• The Keeper of the Privy Purse is the Data Controller for the
Household of TMs The King and Queen;
• The Private Secretary is the Data
Controller for the Household of TRH The Prince and Princess of Wales;
• The
Private Secretary is the Data Controller for the Household of Mr
Mountbatten-Windsor;
• The Principal Private Secretary is the Data
Controller for the Household of TRH The Duke and Duchess of Edinburgh;
• The
Private Secretary is the Data Controller for the Household of HRH The Princess
Royal;
• The Private Secretary is the Data Controller for the Household of
HRH Princess Alexandra;
• The Private Secretary is the Data Controller for
the Household of TRH The Duke and Duchess of Gloucester;
• The Private
Secretary is the Data Controller for the Household of HRH The Duke of Kent.
What personal data do we collect?
When you contact us:
• Personal data you provide about yourself
(for example, your name and contact details).
When a third party contacts us on your
behalf:
• Personal data provided by a third party such as your name, contact
details and specific circumstances. This could be from friends, family, employers or government
agencies
When you are invited to attend a Royal event or visit a Royal site either by us or a third
party:
• Your name and contact details;
• On some
occasions, we may also collect your date of birth and place of birth, and whether or not you have a
criminal record (for security accreditation purposes), dietary requirements, details of any required
special access arrangements, and details of your vehicle if applicable;
• If
you are eligible to bring a companion, we may also collect their
information;
• Your image may appear in footage from CCTV security cameras
around the Royal residences, galleries and shops.
If you have an accident whilst visiting, we will
ask you to complete an accident form on which we ask for your name, contact details, and nature of
your injury.
When you meet a Member of The Royal Family, or their representative during a visit, reception or
other event:
• Information about you is usually provided to us by the
organisation or body you are connected with or affiliated to.
When you supply goods or
services to a Member of The Royal Family or their Household:
• Your
name, address, telephone number(s), email address, bank details and unique taxpayer reference (UTR) if
applicable.
When you visit our website, or interact with us via social
media:
• Your IP address and browsing preferences and
choices;
• Your name and username and any comments that you make.
How do we collect it?
We may collect information about you from a number of sources.
These include:
• From you when you contact us or interact with us by
telephone, email or post, or when you communicate with us through social
media;
• From forms we may ask you to
complete;
• From public sources;
• From
organisations/bodies you are connect to or affiliated with, when they provide your information to us
for events/meetings or if you are meeting a Member of The Royal Family or their representative.
Why do we collect it?
In some cases, we collect the data out of a contractual necessity e.g. so both the Royal Household
and you are fulfilling the obligations set out in our supplier terms and conditions or any contract
that may be in place.
Other times we collect the data because it is a legitimate interest of
the organisation to process the information, for example, to log any correspondence you send us and
respond accordingly. We process visitor and guest information to be able to send out invitations for
meetings or events, and to know who will be in our buildings for security and health and safety
purposes. We use CCTV cameras at Royal sites for security reasons. We provide information to Members
of The Royal Family, or their representative(s) so that they know who they will be meeting and
why.
In other cases, we hold the information because you have given us your consent. If the
basis for collecting and processing your data is based on your active consent, you also have the right
to withdraw that consent at any time.
How do we use your personal data?
We process your data in order to:
• Record any correspondence or gifts we
receive and respond accordingly;
• Send out invitations to meetings and
events held on Royal sites;
• Know who will be visiting Royal sites for
security, and health and safety purposes;
• Provide Members of The Royal
Family, or their representative(s) with information about who they will be meeting and
why;
• Enter into contracts with suppliers and to pay them for goods and
services received;
• Maintain relationships with individuals and
organisations with Royal affiliations such as those with Royal patronage or who hold a Royal
warrant;
• Send Royal messages and
greetings;
• Prevent and detect crime through use of CCTV
footage;
• Send press releases, operational notes and media
advisories;
• Assist with pre-employment checks.
How is it stored?
Your personal data is stored in a number of ways:
• In paper files stored
securely;
• In software systems which are managed on the Royal Household
network or by a third party supplier.
Who do we share your personal data with?
We may share your data with and/or obtain information from some third parties:
Service
providers
We work with selected service providers that carry out certain functions on our
behalf, for example:
• Contractors for the provision of events management
services;
• Stationery providers and other companies who produce event
invitations for us;
• Third party providers for the management of cookies on
our website;
• Social media providers e.g. Facebook, Twitter, Instagram – to
deliver our social media presence;
• The Royal Warrant Holders Association
and Business in the Community in relation to managing applications for Royal Warrants of
Appointment;
• The Metropolitan Police Service and the respective County
Constabularies who provide protection across the Royal Estate and to Members of the Royal Family.
Other organisations
We may share personal data with other organisations in the
following circumstances:
• Lord Lieutenants, where a Member of The Royal
Family is visiting a particular county and the Lord Lieutenant is involved in the visit
arrangements;
• Our legal representatives e.g. solicitors, in order to
establish, exercise or defend our legal rights;
• Government departments or
Independent Parliamentary Bodies, where we are required to by law or by a public authority or when
such organisations are better placed to facilitate a response or to help resolve a query contained
within a letter;
• Police services in the provision of security services to
the Royal Household;
• The Diocese of London in relation to Safeguarding
concerns.
How do we protect your personal data?
We take the security of your data very seriously. We have internal policies and controls in place to
ensure that your data is retained appropriately, and is not accessed except by our employees or
authorised third parties in the proper performance of their duties.
Where we engage or work
with third parties to process personal data on our behalf, they do so, on the basis of written
instructions, are under a duty of confidentiality, and are obliged to implement appropriate technical
and organisational measures to ensure the security of data in line with the relevant legislation.
How long do we keep it for?
We retain your data in line with our retention schedules as agreed with the Information Assurance
team of The Royal Household. Some personal data may be kept indefinitely as it is stored in the Royal
Archives for reasons of historic interest.
The Royal Family website
The Royal
Family web site, with the exception of the subscription system, does not store or capture personal
information; it logs the user's IP address which is automatically recognised by the web
server.
We do not use cookies for collecting user information and will not collect any
information about you except that required for system administration of our web
server.
Google Analytics Cookies
The Royal Family website uses the Google Analytics
tool to track overall browsing patterns on the website. For instance, it helps us identify the most
popular pages on the website, find out which links are being clicked on, and to give us broad
demographics about from where, in the Commonwealth for example, users are accessing the site. We
cannot personally identify any user with these cookies.
The five Google Analytics cookies are
called utma, utmb, utmc, utmv and utmz. They track how often the website is visited, when you enter
and leave the site, and which site you visited that lead you to royal.uk. utmz also tracks any
keywords you entered into a search engine that lead you to royal.uk if appropriate.
What are my rights?
As a data subject, you have a number of rights. You can:
• access and
obtain a copy of your data on request;
• ask us to change incorrect or
incomplete data;
• ask us to delete or stop processing your data, for
example where the data is no longer necessary for the purposes of
processing;
• object to the processing of your data where we are relying on
our legitimate interests as the legal ground for processing;
• request a
copy of the data you have provided to us in an agreed format, so that you can reuse it or transfer it
to another data controller if you wish;
• ask us if we use automated
decision making or profiling when processing your data.
Please note that none of these rights
are absolute and we reserve the right to refuse your request where exceptions apply.
Contact information and further advice
The Data Protection team based at Buckingham Palace is responsible for ensuring compliance with data
protection legislation across the Royal Household. If you have any queries or concerns about how we
have handled your personal data, please email our Data Protection Manager at: [email protected], or write to:
The Data Protection Manager, Digital Services, The Royal Household, Buckingham Palace, London, SW1A
1AA.
If you have concerns about the handling of your personal data that we cannot resolve with
you, the Information Commissioner’s Office (ICO) is an independent body set up to uphold information
rights in the UK. They can be contacted through their website (Make a complaint about how an
organisation has used your personal information | ICO) or via their helpline on 0303 123 1113.
Changes to this privacy notice
This privacy notice is kept under review and updated from time to time to ensure it continues to
accurately reflect how and why we process your personal data. It was last updated on 12 December
2025.
