How and why we share your data

Disclosure of your personal information to third parties

In order to process your complaint we will ordinarily need to disclose the personal information you send us to the company you have complained about.

We may also need to disclose it to a third party, for example an independent expert or interpreters, that help us with our investigation. We are obliged by law to disclose some information to the regulatory bodies, and will sometimes need to pass details of complaints to industry regulators, for example Ofcom and Ofgem. 

If we receive a request from a regulatory body or law enforcement agency, and if permitted under GDPR and other laws, we may disclose certain personal information to such bodies or agencies.

To help us process our work we have contracts with companies who provide us with services such as IT support or translation services (if English is not your first language).

We only provide third parties with the information they need to know to perform their specific services. We work closely with all the third parties to ensure that your personal data is secure and protected at all times. Our contract with them makes it clear that they must hold it securely, abide by the principles and provisions of Data Protection, and only use it as we instruct them to. If we stop using their services, any of your data held by them will either be deleted or rendered anonymous.

Where your personal data may be processed:

Sometimes we will need to share your personal data with third parties and suppliers outside the European Economic Area (EEA), such as the USA.

If we do this, we have procedures in place to ensure your data receives the same protection as if it were being processed inside the EEA. For example, our contracts with third parties stipulate the standards they must follow at all times. If you wish for more information about these contracts please contact our Data Protection Officer.

Any transfer of your personal data will follow applicable laws and we will treat the information under the guiding principles of this Privacy Notice.

Profiling/ Automated Decision Making

When complaints are accepted by OS the investigation will be undertaken by a designated Investigation Officer, however, the complaint can be progressed via an automated procedure, for example reminder emails at significant points within the investigation process.

Some decision are wholly automated decisions, for example, the acceptance of a complaint when registered via the website/web form. 

If your case is progressed using an automated process it is only done so using an appropriate mathematical and statistical procedure, for the purposes of considering your complaint and progressing it through our process.

OS has implemented the technical and operational measure appropriate to ensure that factors which result in inaccuracies in personal data are corrected and the risk of errors is minimised.

OS will advise you if your complaint is to be dealt with wholly by automated means. In instances where your complaint is wholly undertaken by automated means you have the right to ask that an employee reviews any decisions made.


OS uses a third party called ‘BMG Research’ to conduct satisfaction questionnaires about your experience using our services. You can read BMG Research’s privacy policy here: OS will ask you whether you wish to partake in satisfaction surveys, should you wish complete any surveys you must opt in. 

You have the right to stop the use of your personal data for direct marketing activity through all channels, or selected channels. We must always comply with your request.

Job applicants

When individuals apply to work at OS, the information they supply is used to process their application and to monitor recruitment statistics. Where we want to disclose information to a third party, for example where we want to take up a reference or obtain a ‘disclosure’ from the Disclosure and Barring Service  we will not do so without informing the candidate beforehand unless the disclosure is required by law.

Personal information about unsuccessful candidates will be held for 12 months after the recruitment exercise has been completed, it will then be destroyed or deleted. We do retain de-personalised statistical information about applicants to help inform our recruitment activities, but no individuals are identifiable from that data.

Once a person has taken up employment with OS, we will compile a file relating to their employment. The information contained in this will be kept secure and will only be used for purposes directly relevant to that person’s employment. Once their employment with OS has ended, we will retain the file in accordance with the requirements of our retention schedule and then delete it after a period of 7 years.