Non-domestic Renewable Heat Incentive privacy notice

Publication date
13th September 2019
Information types
Policy areas

This privacy notice tells you what to expect when we collect and process your personal information under the Non-Domestic Renewable Heat Incentive scheme in Great Britain (NDRHI). It applies to information we process concerning:

  • Scheme applicants and participants, registered users of the NDRHI Register, and installations of renewable heating systems
  • People who contact Ofgem with a query or information request (e.g. a right of access or freedom of information request) regarding the NDRHI scheme
  • People who sign up to receive our newsletters

This privacy notice only covers the processing of information relating to Ofgem’s administration of the NDRHI scheme.

To find out how we use data we collect outside of the NDRHI scheme, and for more information on how Ofgem processes personal data, refer to the Ofgem Privacy Policy.


The controller for the processing of any personal information as outlined in this privacy notice is the Gas and Electricity Markets Authority, (GEMA). For ease of reference, this privacy notice refers to the administrative office of GEMA, "Ofgem" throughout.

What personal information do we collect?

We collect information about you, including:

  • Any information you provide us in the application form for the NDRHI scheme, including (but not limited to): your name, date of birth, address, e-mail address, telephone number and bank account details
  • Your unique RHI number and details of RHI payments made in respect of the installation
  • Details of your installation, including: information relating to meters installed, the technology type, commissioning date, installed capacity, the renewable heat generated, and the address of the installed renewable heating system
  • Import and export data relating to electricity supply and distribution, including your information relating to metering and grid reference
  • Documentary evidence in support of your application and ongoing obligations, including (but not limited to): Microgeneration Certificate Scheme (MCS) and Energy Performance (EPC) certificates and other relevant certificates, installation and testing records (including declarations, documents and information about and from the installer), funding agreements, planning permission, property rating and building control statements, schematic diagrams, and fuel, emission, or other records for the installation, if applicable

We also collect any other information required for the purpose of administering the NDRHI scheme.

Why we need to collect and process your information

We only collect and process information that we need in order to carry out our functions in relation to the NDRHI scheme, and for purposes arising from Ofgem’s regulatory functions. More detail about the legal basis for collecting and processing your information is detailed below.

In relation to the NDRHI scheme, we collect and process your information (including disclosing it to our agents, representatives or successors, or to other public bodies or third parties) in order to:

  • Effectively administer the NDRHI scheme
  • Verify the eligibility of installations applying for accreditation or registration under the NDRHI scheme
  • Verify the volumes of renewable energy generated by any accredited installation
  • Assign the correct tariff rate applicable to the installation for which support is claimed
  • Ensure any RHI support payments are timely and accurate
  • Monitor compliance with the scheme regulations
  • Carry out site inspections and audits for the purposes of the NDRHI scheme
  • Assist us in the identification of fraud, misuse and misreporting
  • Enable us to inform you about, or provide literature about, our services, renewable heat and / or the NDRHI scheme
  • To carry out statistical analysis or research and development in relation to the NDRHI scheme
  • To assist in enforcement and / or debt recovery where non-compliance, and / or overpayment has occurred

We use data analytics software to:

  • Validate claims made in respect of renewable heat generated
  • Improve the services we provide
  • Ensure compliance with the NDRHI and DRHI scheme requirements
  • To identify fraud

Your information is not used for:

  • Profiling (i.e. automated processing of personal data to evaluate certain things about an individual such as for direct marketing)
  • To make automatic decisions (i.e. decisions made solely by automated means without any human involvement)

How we collect your information

Information collected directly from you

We will collect information directly from you when you:

  • Visit our website to allow you to make repeat visits. You can find out how we do this through the use of cookies by clicking on the link here
  • Engage with us when we carry out our statutory and administrative functions
  • Contact us with an enquiry relating to the NDRHI scheme, or in relation to information requests, complaints and general enquiries
  • Register as a user or participant on the NDRHI Register
  • Apply for accreditation or registration under the NDRHI scheme
  • Email, fax, or telephone us, or send information related to the NDRHI scheme in paper format
  • Submit information and data to us (including via an online portal, e.g. the NDRHI Register) such as periodic data or declarations as part of your ongoing obligations under this scheme
  • Use our services e.g., subscribe to our RSS feeds, social media sites, email alerts or request a publication from us

We also collect information during any subsequent audit of an accredited or registered installation.

Newsletters: We will collect information directly from you when you sign up to our newsletter(s). You can request your information to be removed from the newsletter distribution list at any time by emailing:

Information collected indirectly

We receive information about you or others indirectly via:

  • Credit-checking agencies [Experian] who verify the information you have provided
  • Gemserv: we receive data to validate the sustainability information provided for your installation, if applicable
  • The Department for Business, Energy and Industrial Strategy (BEIS), and other third parties in relation to your scheme application, accreditation or registration, including (but not limited to): public grants funding and audit information
  • The MCS Service Company Limited and the MCS Charitable Foundation: we receive information relating to MCS certificates that are relevant to your application and / or accreditation
  • We contact local authorities to view planning applications and building usage
  • A third party whom we have contracted to undertake auditing work on our behalf – in some cases the information provided will include further documentary evidence relating to the installation, including photographs
  • Third party public bodies or organisations involved in the prevention and detection of crime
  • Third party IT systems which provide support for the RHI Registers where applicant / participant information is submitted to us
  • Third parties you may have nominated to provide us with information 
  • Third parties we believe may be able to independently verify information provided to us on your application, or as part of your accreditation or registration

How and when we will process and disclose information

We only collect information that we need in order to effectively administer the government’s NDRHI scheme in line with the requirements under legislation and licence conditions, as detailed above. Any data you provide will not be transferred outside the European Community. We will only disclose your personal information in the following circumstances:

  • Where the disclosure is required by law, statutory direction, court orders, or is necessary for the purposes of the administration or development of the Domestic Renewable Heat Incentive (DRHI), Non-domestic Renewable Heat Incentive (NDRHI), Northern Ireland Non-domestic Renewable Heat Incentive (NI NDRHI), Energy Company Obligation (ECO), Warm Home Discount (WHD), RO, FIT, REGO, the SEG, CCL, NFFO or OLR schemes where you give us explicit permission to disclose it
  • Where you give us explicit permission to disclose it
  • For the processing and sharing of relevant information during audits

We will only process (including sharing and receiving) your information with the following organisations or official bodies:

  • Third-party auditors who audit the information provided to us by you (we process and share relevant information during audits and will require such third parties to agree to treat the information in accordance with this privacy notice)
  • Action Fraud in England or Wales or the police (and other public bodies or organisations involved in the prevention and detection of crime) when we or they have found instances of suspected fraud
  • BEIS, who are responsible for the RHI policy and legislation in Great Britain, for the purposes of its functions in relation to the NDRHI scheme, including for (but not limited to):
    • surveys and statistical purposes (e.g. to publish official statistics and to fully monitor the rollout and progress of the scheme)
    • quality assurance
    • forecasting expenditure for degressions
    • wider purposes connected with analysis, research, monitoring, evaluation, development and understanding of the RHI schemes and BEIS policies.

(BEIS may share your data with its contractors or sub-contractors for these purposes)

  • Power companies, UK Government departments and their agencies, Non-ministerial UK Government departments, environment agencies, local authorities and licensed electricity distributors as part of a Data Sharing Agreement
  • Third-party IT organisations who provide IT and development support for the scheme Registers / Customer Relationship Management (CRM) and other systems used for scheme management. For the CRM: this is a two-way exchange of information between the Ofgem owned register and the Cantata housed CRM. In addition, data is also shared with a third-party organisation who house a copy of the Cantata CRM data (taken as a snapshot-in-time) to mitigate against loss of CRM capability or Cantata going out of business
  • Experian, a third-party credit checking agency, to verify the information you provide to us, including your name, date of birth, and bank account details

We will additionally disclose your personal information where:

  • You give us explicit permission to disclose it
  • The disclosure is necessary for the purposes of the administration of the NDRHI scheme or where we are legally obliged to by law, statutory direction or court order (e.g. we are required to share information with public inquiries, the National Audit Office or the Ombudsman)

We process and share your information with third-parties using secure file transfer portals or via Huddle.

Legal basis for processing your information

We collect and process your information as part of our remit as the administrator of the NDRHI scheme, and for purposes arising from Ofgem’s functions conferred by law, including (but not limited to) the:

  • Renewable Heat Incentive Scheme Regulations 2018 (as amended)
  • Renewable Heat Incentive Scheme Regulations 2011 (as amended)
  • Gas Act 1986
  • Electricity Act 1989
  • Utilities Act 2000
  • Energy Acts of 2008 and 2011

We would not be able to fulfil our legal obligations as the administrator of the NDRHI scheme without collecting and using your information.

If you subscribe to receive our newsletters, we also process your information on the basis of consent, where, if you have opted in, we store your name and email address in order to send you updates on the RHI schemes. You are free to unsubscribe from the newsletters at any time, either by emailing us at or by clicking on the ‘unsubscribe’ button at the bottom of any newsletter you receive.

How long do we keep your information

Your personal information is deleted when we no longer need it for our functions in administering the NDRHI scheme. As such, it is retained by Ofgem for the duration of scheme participation (up to 20 years), and for a period of 7 years thereafter.

As part of our verification process, we collect hard copies of participants’ identity documents. Once the review is completed satisfactorily, the application approved, and payment successfully initiated, these records are no longer required.

Sharing your information outside the European Economic Area

Any information you provide will not be transferred outside the European Economic Area.

Where we use cloud processing to support our data processing, the servers are located within the European Economic Area.

Your rights

If we hold information about you, you have the right to:

  • Be informed about the data we hold about you
  • Access the information we hold about you
  • Have your personal information corrected if it is incomplete or inaccurate
  • Ask us to restrict how we process your information
  • Object to certain ways we use your information
  • In some circumstances, you may have a right to object to Ofgem processing your information

To see the full suite of new consumer rights available to you under GDPR, please refer to the Ofgem Privacy Policy or the ICO website.

Disclosure of personal information

You can also get information about:

  • agreements we have with other organisations for sharing information
  • circumstances where we can pass on your personal information without consent for example, to prevent and detect crime and to produce anonymised statistics
  • our instructions to staff on how to collect, use and delete personal information
  • how we check that the information we hold is accurate and up to date

How to contact us

If you would like to:

The Data Protection Officer


10 South Colonnade

Canary Wharf


E14 4PU

Complaints to the Information Commissioner

You have a right to complain to the Information Commissioner. If you want to raise a concern about how we have handled your information, you can report it directly to the Information Commissioner’s Office at the following address:

Information Commissioner's Office

Wycliffe House

Water Lane




Telephone: 0303 123 1113

Online: Live chat

Changes to this privacy notice

We keep our privacy policy under regular review. This privacy policy was last updated on 3 March 2021.