51²è¹Ý

This notice sets out how we will process your personal data, and your information rights. It is made under Articles 13 and/or 14 of the UK General Data Protection Regulation (UK GDPR).

The Offshore Petroleum Regulator for Environment and Decommissioning (OPRED) based in Aberdeen is part of the Department for Energy Security and Net Zero (DESNZ). OPRED respects your privacy and is committed to protecting your personal information.

This privacy notice tells you how we look after your personal information and your rights in relation to your personal information and how the law protects you, regarding the Energy Portal.

When you create an account and use the Energy Portal to carry out activities, we may collect certain personal information from you.

Your data

We will process the following personal data:

• identity data which includes your first name, and surname.
• contact data which includes your email address and telephone number
• profile data which includes your password, user privileges/system access data, audit data is stored linking users with activities/services usage data when users login, information relating to that user’s session is stored in a session audit log

Purpose

We will only use your personal information when the law allows us to.   The purposes for which we are processing your personal data are:

• for the purposes of discharging our statutory functions including environmental regulatory activities such as granting of permits, consents and authorisations
• undertaking regulatory investigations where we need to:
  • establish whether there has been a breach of a regulatory obligation
  • establish, exercise or defend legal rights
  • improve our services
• to send communications about OPRED which you have subscribed to
• to send communications about the UK Energy Portal which you are a user of

Legal basis of processing

The legal basis for processing your personal data under the UK GDPR is Article 6 1(e) processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the data controller as the Offshore Petroleum Regulator for Environment and Decommissioning:

• To discharge of our statutory functions
• In the exercise of our lawful authority

Recipients

Your personal data will be shared by us with;

North Sea Transition Authority (NSTA) and their IT service provider Fivium to provide the IT infrastructure, contracted support and maintenance for the Energy Portal

Health and Safety Executive for functions delivered by the Competent Authority (CA).  The CA functions are delivered by the Offshore Petroleum Regulator for Environment and Decommissioning (OPRED) and the Health and Safety Executive (HSE) working in partnership. The partnership formed for this purpose by OPRED and HSE is formally known as the Offshore Major Accident Regulator (OMAR).

As part of our IT infrastructure, your personal data will be stored in the UK on data centres provided by our data processors - Microsoft and Amazon Web Services. This does not mean we actively share your personal data with these entities; rather, they are technical service providers who host infrastructure supporting our IT systems

Retention

Your personal data may be kept by the Energy Portal indefinitely. Legally, we are required to identify who applied for consents/permits and/or who received/acknowledged them on behalf of the company.  We also need to identify who within the regulator reviewed/approved these consents.

Our work spans decades in some instances the notices impose liabilities in the millions of pounds.  We would not be able to say that after a specific period that the information would no longer be necessary so this needs to remain indefinite.

User accounts are cancelled after an inactivity period of 18 months but that only prevents logins by that user; the user account record still exists in the Energy Portal for transitional audit purposes as explained above.

International Transfers

Your personal data will only be processed in the UK.

Cookies

As you interact with the UK Energy Portal, we may automatically collect technical data about your equipment, browsing actions and patterns. This data is collected by using cookies. Further information on our cookie policy can be found here .

Your Rights

You have the right to request information about how your personal data are processed, and to request a copy of that personal data.  

You have the right to request that any inaccuracies in your personal data are rectified without delay.  

You have the right to request that any incomplete personal data are completed, including by means of a supplementary statement.  

You have the right in to request that your personal data are erased if there is no longer a justification for them to be processed.  

You have the right in certain circumstances (for example, where accuracy is contested) to request that the processing of your personal data is restricted.  

You have the right to object to the processing of your personal data where it is processed for direct marketing purposes.  

You have the right to object to the processing of your personal data

Contact Details

The data controller for your personal data is the Department for Energy Security and Net Zero (DESNZ). You can contact the DESNZ Data Protection Officer at:  

DESNZ Data Protection Officer
Department for Energy Security and Net Zero
3-8 Whitehall Place
London
SW1A 2EG

Email: dataprotection@energysecurity.gov.uk

If you are unhappy with the way we have handled your personal data, please write to the department’s Data Protection Officer in the first instance using the contact details above.

Complaints

If you consider that your personal data has been misused or mishandled, you may make a complaint to the Information Commissioner, who is an UK independent regulator.  The Information Commissioner can be contacted at:

Information Commissioner’s Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF

Telephone: 0303 123 1113

https://ico.org.uk/make-a-complaint/

Any complaint to the Information Commissioner is without prejudice to your right to seek redress through the courts.

Updates to this notice

If this privacy notice changes in any way, we will place an updated version on this page. Regularly reviewing this page ensures you are always aware of what information we collect, how we use it, and under what circumstances we will share it with other parties. The ‘last updated’ date at the bottom of this page will also change.

If these changes affect how your personal data is processed, we will take reasonable steps to let you know.

Last updated: 02/07/2025