© Crown copyright, 2024

This website is licensed under the Open Government Licence 3.0. The material featured on this site is subject to Crown copyright protection and licensed for use under the Open Government Licence unless otherwise indicated.



You may use and re-use information free of charge from this website (not including the Royal Arms and departmental or Agency logos) under the terms of the Open Government Licence http://www.nationalarchives.gov.uk/doc/open-government-licence/version/3/.

Any enquiries regarding the use and re-use of this information resource should be sent to: ppocomms@ppo.gov.uk. When you use this information under the Open Government Licence, you should include the source, title, date and publication.


We use small files called ‘cookies’ to give you the best experience on our site. Click the cookie settings in the corner of the website to find out more and choose which cookies you are happy for us to use.

Data protection policy and privacy notice


The Prisons and Probation Ombudsman (PPO) has three main duties:

  • to investigate complaints made by prisoners, young people in detention (prisons and secure training centres), offenders under probation supervision and individuals detained under immigration powers (detained individuals)
  • to investigate deaths of prisoners, young people in detention, approved premises’ residents and detained individuals due to any cause, including any apparent suicides and natural causes
  • to investigate deaths of recently released prisonersusing the PPO’s discretionary powers

The purpose of these investigations is to understand what happenedto correct injustices and to identify learning for the organisations whose actions we oversee so that the PPO makes a significant contribution to safer, fairer custody and offender supervision.


Policy document

The PPO is a “public authority” as defined by the Freedom of Information Act 2000. The PPO carries out specific tasks in the public interest. The PPO’s lawful basis for processing personal data is Article 6(1)(e) (public task) of the GDPR: processing is necessary for the performance of a task carried out in the public interest. Our processing is necessary for the performance of a task carried out in the public interest as it is necessary for the administration of justice and the exercise of a function of the Crown, a Minister of the Crown or a government department.

The processing of “special categories of data” (which includes criminal convictions) is prohibited under GDPR unless an exception applies. “Substantial public interest” is an exception and for the PPO this includes the exercise of a function of the Crown, a Minister of the Crown or a government department and for the administration of justice.

This policy document explains the PPO’s procedures for securing compliance with the principles in Article 5 of the GDPR (principles relating to processing of personal data) and explains the PPO’s policies as regards the retention and erasure of personal data.


Data and information

The PPO is registered as a Data Controller with the Information Commissioner’s Office, to process personal information for the purposes of:

  • Investigating complaints made against prison, secure training centre, probation and immigration detention service provider
  • Investigating deaths of those held in prison, secure training centre, secure children’s homes or immigration detention and those held in probation approved premises
  • Promoting lessons learned from investigations, including publishing an annual report.

PPO investigations are conducted according to the Terms of Reference agreed with the Secretary of State for Justice. The purpose of any PPO investigation is to:

  • find out what happened
  • to try to find out why
  • to see whether there are any lessons to be learned and
  • to make recommendations for future practice, if appropriate.

The PPO collects personal information for the performance of its task, carried out in the public interest. We collect information from multiple sources and, at any one time, can be processing personal information about various individuals including:

  • witnesses
  • bereaved families
  • complainants or their representatives
  • the subject of a complaint or their representatives
  • individuals who we may contact when carrying out a complaint or fatal incident investigation
  • service providers and their employees or employees of their contractors
  • prisoners, offenders and suspected offenders
  • individuals captured by CCTV images
  • survey respondents
  • professionals with an interest in our publications.

Personal and sensitive information is collected by the PPO for the purpose of a complaint investigation or a fatal incident investigation. The type of personal and/or sensitive information we collect about any one of the individuals listed above can include:

  • personal details
  • family details
  • lifestyle and social circumstances
  • financial details
  • employment and education details
  • details of complaints, incidents and grievances
  • visual images, personal appearance and behaviour
  • physical or mental health details
  • racial or ethnic origin
  • religious or other beliefs
  • political opinions
  • sexual life
  • offences (including alleged offences)
  • details of security categorisation and assessments of risk of harm
  • criminal and legal proceedings, outcomes and sentences.


There may be occasions when the PPO is obliged to disclose personal data shared during the interview and wider investigation process. For example, evidence provided to the PPO may be shared with specialist advisers and with other investigatory bodies including the police, where that is necessary for the purposes of the PPO investigation, for a criminal investigation or for the inquest in the case of a fatal incident investigation.

Personal and sensitive information may be shared with others including the family, associates and representatives of the person whose personal data we are processing; with those making an enquiry or complaint; with organisations subject to a complaint or investigation; with prosecuting authorities or courts; and with other central government bodies.

In order to share the lessons from individual investigations, and to prevent further complaints and the risk of more deaths in custody, illustrative case studies are published as part of the Ombudsman’s annual report and within their Learning Lessons publications.  All case studies are drafted in such a way as to exclude all personal data and so to protect the identification of the subject. Themes from investigations will also be identified and published in order to improve future practice.

The PPO investigates the deaths of children and young people in young offender institutions, secure training centres, secure children’s homes etc. We also investigate complaints from children and young people in young offender institutions and secure training centres. This means that there will be occasions when, in the performance of our public task, we are obliged to process data on children and young people.


All personal data held by the PPO will be:

  • Processed lawfully, fairly and in a transparent manner
  • Collected for the purposes of the public interest and in order that the PPO can:
    • Independently investigate complaints and fatal incidents as set out in its terms of reference
    • Provide information about our independent investigations and the work of the PPO
    • Assess our independent investigations and provide management information on our work
  • Adequate and limited to what is necessary
  • Accurate and kept up to date
  • Kept for no longer than is necessary
  • Processed securely


Data and information for marketing purposes

We may collect personal data to send updates about our work, including invitations to events, the issuing of press releases, the publication of reports. We maintain separate contact lists for our promotional communications. Data provided for marketing purposes will be held securely and will not be available to other organisations.

Everyone can ask not to receive such communication at any time. Information on how to do this will be included in every communication.



Investigation evidence is retained only for as long as is necessary in order to satisfy the Ombudsman’s remit, as described in the Terms of Reference.