Beta

This is a new service and pages are being tested and improved. Give feedback to help improve it.

Site-wide search

Policy

Privacy notice for AssureAssist

How your personal information is used for the AssureAssist assurance review tool.

From:

HM Treasury
Published: 07 October 2026
Last modified: 07 October 2026

Introduction

This privacy notice should be read alongside HM Treasury’s ‘Personal information charter’. The charter sets out:

  • the standards you can expect from HM Treasury when we use your personal information
  • the contact details for our Data Protection Officer
  • how to exercise your Data Protection Information Rights (including access)
  • how to exercise your right to complain to the Information Commissioner’s Office

This privacy notice supplements the ‘Personal information charter’ and outlines additional information in relation to the use of the digital artificial intelligence (AI) tool – ‘AssureAssist’.

Data controller

A data controller makes decisions about processing activities. They exercise overall control of the personal data being processed and are ultimately in charge of and responsible for the processing.

The joint data controllers for this processing activity are HM Treasury and the Cabinet Office.

Data processors

A data processor is an organisation or company that handles personal information on our behalf, following our instructions. Data processors do not use your information for their own purposes; they only process it as directed by us.

The following organisations are directed to process your personal information on our behalf.

Amazon Web Services (AWS)

Large Language Model to analyse documents, flag potential risks, highlight strengths, and identify conflicting or incomplete evidence.

Cabinet Office (CO)

AssureAssist sits on CO’s AWS infrastructure.

Cognito Authenticator

Secure registration process for users to access AssureAssist.

Who we process personal data about

The table below outlines the categories of individuals whose personal data we will process in this activity, alongside the types of personal data we will use.

Personal data categories
Category of individual Types of personal data Special category data
Members of staff, external non-government contractors, suppliers and vendors of projects – included in project data documents (uploaded by departments) Personal data included in project documents, such as:

  • names
  • email IDs
  • project related role information
 N/A
Users (cross-government employees and non-government contractors) Personal data included in registration for AssureAssist use: email IDs only (no IPs will be recorded/used).

(Cognito Authenticator, the Cabinet Office authentication system, is how you register to use AssureAssist)

 N/A
Chatbot free text Any personal data the user chooses to enter. Chatbot users may input free text that could include personal information. These occurrences of personal data input are not required by the tool and cannot be fully controlled. To mitigate this risk, clear guidance is provided to discourage the inclusion of personal data in chatbot or search inputs. The system does not actively require such information to function, ensuring only the minimum necessary data is used. N/A

Source of your personal data

Personal data of the individuals listed above will be collected:

  • directly – from AssureAssist users
  • indirectly – from existing data sets held by the National Infrastructure and Service Transformation Authority’s (NISTA) assurance team (reviewer pool database)

Purpose and lawful basis

We will process your personal data for the following purposes and using the specified lawful bases.

Purpose, additional information and lawful basis
Purpose Lawful basis Further information

Project documents

AssureAssist requires this to assess it against the assurance criteria and provide a retrieval-augmented generation and insights (AI tool).

 Article 6(1)(e) – processing is necessary for the performance of a task of the controller carried out in the public interest. Personal data not necessary, but unavoidable.

AssureAssist does not require personal data to process queries. Where any personal data is entered, the system anonymises this before any further processing. Personal identifiers are replaced with anonymised labels. Only anonymised data is sent to the LLM, and outputs are also anonymised.

Chatbot

Free text input to allow the tool to respond to unique queries.

 Article 6(1)(e) – processing is necessary for the performance of a task of the controller carried out in the public interest. Personal data not necessary, but unavoidable.

The chatbot uses free-text input to allow users to submit unique queries. Scout does not require personal data to process these queries. Where personal data is entered, such as names, addresses, phone numbers or email addresses, the system anonymises this before any further processing. Personal identifiers are replaced with anonymised labels, such as “Person A”, before the query is sent to the LLM. Only anonymised data is sent to the LLM, and outputs are also anonymised.

Email ID

Email ID used to onboard and access the tool.

 Article 6(1)(e) – processing is necessary for the performance of a task of the controller carried out in the public interest. Necessary to authenticate access and enter the AssureAssist tool securely.

Who we share your personal data with

We will share your personal data with HM Treasury staff within NISTA’s assurance team and AssureAssist administration team to support the access and functioning of the tool.

International transfers

Personal data processed through AssureAssist remains within the United Kingdom. Some non-personal technical data used for application monitoring and error logging may be processed outside the UK; this does not include personal user data.

How long we hold your personal data

We will retain your personal data for as long as necessary to fulfil the purposes for which it was collected.

The specific retention period/s for your personal data will be:

  • Email IDs: for the duration of your time as a AssureAssist user, or until you ask us to delete your data
  • any other personal data: retained for 30 days after entry (this data will have occurred through user self-generated text or document upload, it is not necessary for the function of AssureAssist and occurrences will be immediately anonymised)

Once your data is no longer required, it will be securely deleted or anonymised.

Automated decision-making and profiling

This activity does not involve automated decision making or profiling. This means that decisions which may affect you are not made solely by automated means without human involvement, and your data is not subject to analysis intended to evaluate or predict aspects such as your behaviour, preferences, or interests.

Delete

To request deletion of your personal data, please contact [email protected].  Requests will be assessed and processed in accordance with UK GDPR and organisational retention requirements.

Complaints process

Data subjects can raise concerns or complaints by contacting HMT’s Data Protection Officer (DPO) or the designated data protection team using the contact details published in HMT’s privacy notices. Information on how to do so is available via HMT’s Personal Information Charter, which also explains data subject rights and the complaints process.

Personal information charter – HM Treasury – GOV.UK

HMT also have a formal data protection complaints process in place as of June 2026.

Back to top