Skip to main content

Submit a form to Defra

We use some essential cookies to make this service work.

We’d like to set analytics cookies so we can understand how people use the service and make improvements.

View cookies
Submit a form to Defra

Beta This is a new service. Help us improve it and give your feedback (opens in new tab) .

Controller and Data Protection Officer contact details

The Environment Agency is the controller for the personal data we process under the UK General Data Protection Regulation (UK GDPR) and Data Protection Act 2018 (DPA 2018).

Our personal information charter explains: 

  • how to contact our Data Protection Officer 
  • what we do with your personal information (personal data) in general 
  • your rights and how to complain to the Information Commissioner’s Office

Why we may process your personal data

We need the information we request to ensure you are complying with environmental regulations. We may process your information during any potential enforcement action.

The lawful basis we rely on to process your personal data is article 6(1)(e) of the UK General Data Protection Regulation (GDPR), which allows us to process personal data when this is necessary to exercise our official authority. The processing has a basis in the Regulation 52(1) of the Transfrontier Shipment of Waste Regulations 2007.

What personal data we process and how we use it

The personal data we collect may include names, addresses and contact details (including email addresses), and signatures.

We may use your email address to contact you about the information you have submitted.

We may compare the information you provide with other datasets we hold and apply a risk‑based categorisation (such as a red‑amber‑green status) to help us prioritise and review relevant data.

We do not use your personal information to make an automated decision or for automated profiling.

We may share your personal information with:

  • the Scottish Environmental Protection Agency (SEPA)
  • Natural Resources Wales
  • the Department for Agriculture, Environment and Rural Affairs (Northern Ireland)
  • the Department for Environment, Food and Rural Affairs (Defra)
  • Shared Services Connected Ltd (SSCL) – they process your personal information to send invoices on our behalf
  • other relevant bodies in the UK for our regulatory activities, for example His Majesty Revenue and Customs (HMRC)
  • international stakeholders – for example, if you are exporting waste to China, then we may send your data to the Chinese competent authority in order to carry out the regulatory requirements and gain their consent

We will not share or disclose your personal information to any other party without your consent unless we are lawfully able to do so.

Where your personal information is stored and processed

We store and process your personal data in the UK.

We may share your personal data with other parties, including overseas competent authorities, without your consent as permitted to do so by law.

How long we keep personal data

We keep your personal data for 3 years from the end of calendar year in which the information was received.

Your responsibility

If you have included personal data about any other individuals in your submissions, you must inform them of this. You must provide them with a copy of this privacy notice so that they are aware of how their personal data will be used.

Changes to this notice

We may change this privacy notice. In that case, the ‘last updated’ date at the bottom of this page will also change. Any changes to this privacy notice will apply to you and your data immediately.

If these changes affect how your personal data is processed, we will take reasonable steps to let you know.

Last updated: 28 May 2026