Toggle mobile menu visibility

Beta

This is a new service. Help us improve it by giving your feedback (opens in new tab).

Foreign Influence Registration Scheme: privacy information notice

Last updated: 22 April 2026

Introduction

Your personal information, supplied for the purpose of making a registration under the Foreign Influence Registration Scheme (FIRS), will be held, and processed by the following organisations.

  • Home Office at 2 Marsham Street, London, SW1P 4DF. The Home Office acts as the data controller and a data processor for the public online registration portal; the internal government case management system; and the public online register of activities. The Home Office is also the data controller and a data processor for GOV.UK Notify, and a data processor for GOV.UK OneLogin.
  • Government Digital Service (GDS) at The White Chapel Building, 10 Whitechapel High Street, London, E1 8QS. GDS act as the data controller and a data processor for the GOV.UK OneLogin service, and as a data processor for GOV.UK Notify.

We also work with third party providers contracted by the Home Office to provide functions in support of the FIRS service. To do this, they may process personal data on our behalf and under our direction.

Read more about the privacy information relating to GDS on:

Government Digital Service privacy notices - GOV.UK

The Home Office will remain the controller of your information when it is collected or processed by any other third parties on our behalf (not described above).

How we gather and use your personal information

Part 4 of the National Security Act 2023 established FIRS in law (more information is available here: Foreign Influence Registration Scheme - Home Office - GOV.UK). FIRS requires registration of individuals or organisations involved in certain activities directed by foreign powers under two distinct tiers:

  1. Political Influence Tier: You must register if you are instructed by a foreign power to conduct, or arrange for others to conduct, political influence activities in the UK. This includes lobbying, public communications, or other activities intended to influence UK political processes or decision-making.
  2. Enhanced Tier: You must register if you are instructed by a specified foreign power (currently Russia and Iran), or a specified organisation controlled by them, to conduct any activities in the UK. These activities may include broader forms of influence or engagement beyond politics. Specified organisations controlled by specified foreign powers must also register any relevant activities they conduct in the UK.

Registration is mandatory, subject to certain limited exemptions, and failure to comply is a criminal offence.

The Home Office collects and processes personal information to fulfil its statutory functions and complies with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. We will only use personal information when the law allows and where it is necessary and proportionate to do.

Any personal information inputted into registrations, including names, addresses, and phone numbers, will be collected, and stored securely in accordance with Home Office guidance and data policies.

Some personal data related to those in an arrangement with a foreign power under the political influence tier will be publishable on the FIRS public register (unless an exception is applied). This includes:

  • for individual registrants: full names, year of birth, town / city of residential address
  • for corporate body registrants: full names and trading names, public register number, country or territory of incorporation, registered address, or principal address
  • for unincorporated association registrants: names, public register number, country or territory of principal office, principal address

Other personal information that will be publishable under FIRS includes any identities individuals may present themselves under when making misrepresentations; and names of persons conducting activities as part of political influence tier arrangements. You can read more about what will be published here: Foreign Influence Registration Scheme: registration and public register - GOV.UK

The lawful basis for the processing of your data is Article 6(1)(e) of the UK GDPR - that is, that the processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller.

We may process some special categories of personal data where the processing is necessary for reasons of substantial public interest, in line with Article 9(2)(g) of the UK GDPR. This includes the requirement to record nationality when registering on the portal. Registrants may also choose to provide other special category data in free text boxes. If provided, special category data (other than nationality) will not be evaluated in the FIRS case management system.

We have systems and policies in place to limit access to your information and prevent unauthorised disclosure. Staff who access personal information must have appropriate security clearance and a business need for accessing the information. Their activity is subject to audits and reviews.

The Home Office may share your information for law enforcement purposes or to assist other organisations in delivering their statutory functions. An example includes sharing with law enforcement agencies to support the prevention of crime. When data is shared, those organisations will manage data in line with UK GDPR and the Data Protection Act 2018.

We will process your personal information in the following circumstances:

  • you register with FIRS as an individual registrant
  • you register with FIRS on behalf of an entity
  • you are listed as being part of an activity or arrangement that another user has registered under FIRS

For the purposes of FIRS, your information will be used and processed by the Home Office, and third party providers contracted by the Home Office for delivery of the FIRS service. The FIRS service also uses other government tools such as GOV.UK One Login for ID verification purposes (you can view GOV.UK the One Login privacy notice here: Privacy notice - GOV.UK One Login), and GOV.UK Notify to provide notifications to users (you can view the GOV.UK Notify privacy notice here: (Privacy notice - GOV.UK Notify).

Automated processing and profiling

Article 22 of the UK GDPR provides the right not to be subject to a decision made solely based on automated processing, including profiling, which produces legal or other significant effects.

FIRS does not involve such profiling or other automated processing. All processing will be completed by trained staff in the FIRS Case Management Team.

Storing and retaining your information

Your personal information will be held for as long as necessary for the purpose for which it is being processed and in line with departmental retention policy.

The Home Office will retain data for various periods depending on the type of data and its use.

  • FIRS account data is retained for 5 years of inactivity or 10 years if linked to active registrations.
  • Registration data (comprising registrant, arrangement, and activity data) is held for 10 years on the public register or, where not published, by the FIRS Case Management Team starting from the end date of the arrangement and is then archived for a further 10 years. Hard copies of registrant data are retained for up to 20 years.
  • Correspondence is kept for 7 years unless linked to a registration, in which case it follows the retention period of the registration.
  • Freedom of Information (FOI) requests and Subject Access Requests (SARs), and their responses, are retained for 5 and 2 years, respectively.
  • Abandoned or incomplete registrations are accessible to users for 30 days after your last interaction with the FIRS service. After 30 days of inactivity, users who have created a registrant and arrangement, but have not submitted their activity information, will lose their incomplete activity information. Users will not be able to access these activities and will have to restart the registration process for those activities only. The registrant and arrangement information will remain as per the retention periods detailed above.
  • The Home Office will retain access to this data in an archived form for a further 30 days.

All data is automatically deleted at the end of its retention period, except for offline or email data, which is manually destroyed by the FIRS Case Management Team.

Google Analytics

The Home Office uses Google Analytics to collect certain data about how you use the FIRS website. We do this to ensure the site is offering the best user experience, and to help us make improvements. We collect:

  • the pages you visit on the FIRS website
  • how long you spend on each FIRS page
  • how you arrived at the site
  • what you click on while you are visiting the site
  • your Internet Protocol (IP) address
  • details of which version of web browser you used

The information we collect is anonymised and cannot be used to identify who you are.

Sources and categories of information

Some FIRS registrations may divulge personal information pertaining to other individual(s) who may be unaware that their personal information has been provided to the Home Office. An example of this would be if a registrant provides personal data about a target of political influence. When personal data about a target of influence is provided, in line with Article 14 UK GDPR obligations, the FIRS Case Management Team will endeavour (as far as is possible) to notify the individual(s) in question that their data has been provided.

Any personal information provided will comprise some or all the following fields:

  • full name
  • former names
  • date of birth
  • nationality
  • residential or correspondence address
  • telephone number
  • email address

Requesting access to your personal data

You have the right to:

  • ask for a copy of your personal data.
  • ask us to correct mistakes in your data.
  • ask us to delete your data in certain circumstances.
  • object to how we use your data.
  • ask us to limit how we use your data.

You can request a copy of your personal data by making a Subject Access Request (SAR) to the Home Office Information Rights Team. You can get in touch by emailing [email protected], or by writing to the below address:

Information Rights Team
Home Office
2 Marsham Street
London
SW1 4DF

When making a request, you must provide proof of identity, such as a copy of your:

  • passport
  • driving licence
  • birth certificate

You must also provide proof of address, such as a copy of your:

  • driving licence
  • recent utility bill
  • bank or credit card statement

You should also include:

  • all addresses you have used when contacting us
  • any information that might help us find your data (like previous names or contact dates)

We have one month to respond to your request. For complex requests, this may be extended to two months.

In some cases, we cannot provide all the information requested. For example, if it would:

  • affect criminal investigations
  • prejudice law enforcement activities
  • affect someone else's rights

For more details about making requests please visit: How to ask for your personal information - Personal information charter - Home Office - GOV.UK.

Contact us

If you wish to get in touch about how the Home Office manages your personal data in relation to FIRS, you can email [email protected]. The FIRS General Enquiries mailbox can assist with queries relating to the scheme and processing detailed within this privacy notice.

If you are not satisfied with your response from FIRS General Enquiries, or your query relates to personal information, then the Home Office also has a Data Protection Officer (DPO). You can contact the DPO via email at [email protected] or write to the address below:

Office of the DPO
Home Office
2 Marsham Street
London
SW1P 4DF

If you consider that your personal data has been misused or mishandled, you have the right to make a complaint to the Information Commissioner, who is an independent regulator.

You can contact the Information Commissioner using the details below:

The Office of the Information Commissioner
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF

Telephone: 0303 123 1113

More information can be found on the Information Commissioners Office website: Make a complaint | ICO.

Changes to this notice

We may change or update this privacy information notice. In that case, the 'last updated' date at the top of this page will also change. Any changes to this privacy information notice will apply to you and your data immediately. If these changes materially change how your personal data is processed, the Home Office will take reasonable steps to let you know.

Share this page