Quick Exit

IICSA is a data controller

The Independent Inquiry into Child Sexual Abuse is the data controller for your personal information.  The scope and terms of reference of the Inquiry are set out on our website.

Where we keep your personal information

We keep your information secure and only share it with those who have a need to see it. All personal information we receive is handled fairly and lawfully in line with data protection legislation.  For our investigations, personal information is included as part of the evidence received.

All personal data is held in digital format in IT systems which meet government security standards.  We ask you to help us to keep the information about you accurate and up to date and to advise us of any change, including contact details.  If you would like to know more about how we manage your data, please read the Information Management Policy on our website.

Who we share data with

In accordance with our Terms of Reference, the Inquiry has a duty to pass on to the police any allegations about child abuse. These are shared with Operation Hydrant, a national policing team, which was set up in 2014 to coordinate the investigation of non-recent child sexual abuse.  Operation Hydrant is independent of the Inquiry and does not have any direct access to Inquiry data or information. It acts as the conduit between the Inquiry and local police forces in England and Wales and does not investigate any allegations itself.

The Inquiry will pass your name and contact details to the police if you agree for us to do so. However, we will have to pass on your name and contact details without your agreement to the police or other relevant authorities if we believe there is a child protection concern or someone is at risk of serious harm.

The Inquiry might receive a request to disclose the information we hold relating to what you share with us, if you are involved in criminal proceedings. For example, information might be requested by either the prosecution or defence teams where an individual is being prosecuted for child sexual abuse. We will only pass this information on with your consent, or if we are ordered by a court to do so.

We share documents received as part of the Inquiry's investigation with core participants and redactions are applied in accordance with the Inquiry's Protocol on the Redaction of Documents. Material that is adduced during the Inquiry's public hearing and relied upon by the Panel in their reports is also published on the Inquiry's website.

Personal data may also need to be shared securely with other organisations, as data processors, which provide support services. The data will be securely deleted by them at the end of the contract.

How to gain access to your data

If we hold data about you, you are entitled to ask for a copy of it as a Subject Access Request (SAR). If you wish to know what data is held on you, or to make a Subject Access Request please contact the Data Protection Officer at dpo@iicsa.org.uk or call 020 3789 2136.  We do not charge for providing you with this data. You may also request that we amend or delete your data.  If you are dissatisfied with how IICSA is handling your data, please use our complaints procedure.

If you wish to raise a concern about the use of your personal information by IICSA, you may contact the Information Commissioner’s Office

How long we keep your personal data

Where you use the submit information form on the Independent Inquiry into Child Sexual Abuse website, we will record your email address and other information, if you have chosen to provide this, for the purpose of entering into correspondence with you about the matters raised in your form but there is no obligation to share any personal information with IICSA.

All personal details and accounts of child sexual abuse provided to us by those wishing to share their experience through the Truth Project, either in writing or in person, will be securely destroyed at the close of the inquiry.  

Anonymised versions of accounts of child sexual abuse will be published, with permission of those who provide them, on our website. Otherwise, the records of the work of the inquiry will be permanently preserved at The National Archives, in accordance with their guidance, including the evidence used in our hearings and reports, anonymised data used by our Research team, and the website.  

Personal data on our website

This privacy statement only covers the Independent Inquiry into Child Sexual Abuse website at https://www.iicsa.org.uk and the Independent Inquiry's Truth Project microsite at https://www.truthproject.org.uk. This statement does not cover links within these sites to other websites.

The Independent Inquiry into Child Sexual Abuse website does not store or capture personal information of anyone browsing the website, but it does log the user's IP address that is automatically recognised by the web server.

The legal basis for processing personal data

In accordance with the General Data Protection Regulation, they are:

Article 6 (1) (e) processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller;  and

Schedule 1

Statutory etc and government purposes

6 (1) This condition is met if the processing -

  1. Is necessary for a purpose listed in a sub-paragraph (2), and

  2. Is necessary for reasons of substantial public interest

(2) Those purposes are -

  1. The exercise of a function conferred on a person by an enactment or rule of law


Your privacy

Everything you tell us is confidential. There are very limited circumstances where we tell anyone your name without your consent, for example if a child is currently at risk and we need to tell the police.