Security Privacy notice
This privacy notice tells you what to expect when Heathrow Airport Limited (Heathrow) collects personal information about you when you are processed through security at Heathrow airport (the Airport). Heathrow is committed to protecting your personal information when you use Heathrow services. Whenever you provide or we collect such information we are legally obliged to use your information in line with all applicable laws concerning the protection of personal data, including the General Data Protection Regulation (GDPR).
What information will we collect about you?
When you are processed through Airport security, we may collect the following information about you (but not limited to):
- Flight number
- Seat number
- Date of birth
- Identity document details including passport details
- Details of security searches / screening
- Details of security incidents
We are governed by regulations from the Civil Aviation Authority (CAA) and Department for Transport (DfT). In order to comply with these regulations, we need to collect and process the above personal data relating to you and your flight.
How will Heathrow collect the information about me?
We will collect your data either with consent or where we need to collect it meet our regulatory requirements. In some circumstances, you may have statutory or contractual obligations to provide the data. This data may be captured verbally face to face and using electronic systems including:
- Baggage screening technology
- Biometric cameras
- Face-recogniton systems
For further information on biometrics please see here.
Crew Compliance information is collected on behalf / on request of the respective airline. This is in relation to a compliance database of crew who do not comply with the Airport’s security guidelines and therefore leads to bags being searched more than necessary, which leads to delays. The Crew Compliance information includes the following information for each crew member:
- Airline that employs the crew member
- Time and date of non-compliance occurrence
- Reasons for non-compliance
- Time delay to process
- ID number
- Flight number
How will Heathrow use the information it collects about me?
Heathrow will use your personal data for a number of purposes which include:
- To fulfil our legal obligations to the regulatory and law enforcement authorities (being the CAA and DfT)
- Monitoring for safety and security of the Airport and other passengers
- Reuniting lost property with owners
The lawful justification for collecting and using your personal data is legitimate interests or where Heathrow has a legal obligation to do so.
Your information will be handled and used by the following recipients in order to maintain and administer the security services at the Airport:
- Heathrow staff delivering the security service at the Airport;
- Bagport staff processing the lost property logs at the Airport;
- Atkins staff.
Your information will be retained in a secure environment and access to it will be restricted according to the 'need to know' principle.
In the majority of cases we will not disclose your personal information to others unless we have previously gained your consent. We will keep your information within Heathrow and our trusted third parties except where disclosure is required by law, for example to government bodies and law enforcement agencies, e.g. to prevent or detect a crime. In the case of all disclosures we will always ensure the disclosure is legitimate and proportionate for the purpose.
The crew compliance data is collected on behalf of / on request of the respective airline and the information is passed over to them regularly.
How long will Heathrow keep my information?
We will keep your personal information relating to security in line with our retention policy which ensures that we keep your details for no longer than thirteen months.
What rights do I have over my personal data?
Under the General Data Protection Regulation, you have the right to:
- Access your personal data
- Rectification, erasure or restriction of your information where this is justified
- Object to the processing of your information where this is justified
- Data portability
To exercise your rights please contact the Heathrow Data Protection Officer using the following contact details:
By email to:email@example.com
By post to:
Office of the DPO
Heathrow Airport Ltd
The Compass Centre
This privacy notice does not provide exhaustive detail of all aspects of Heathrow's collection and use of personal information. However, we are happy to provide any additional information or explanation needed. Any requests for this should be sent to the contact address above.
Changes to this privacy notice
We keep our privacy notice under regular review and we will place any updates on this webpage. At the start of this privacy notice we will tell you when it was last updated.
Compliants and queries
Heathrow tries to meet the highest standards when collecting and using personal information. For this reason, we take any complaints we receive about this seriously. We encourage people to bring it to our attention if they think our collection or use of personal information is unfair, misleading or inappropriate.
If you are not satisfied with how Heathrow has addressed your query or if you have further concerns you may contact the Information Commissioner’s Office which is the UK’s independent authority set up to uphold information rights in the public interest, promoting openness by public bodies and data privacy for individuals. The postal addresses for various ICO offices may be found on the ICO website. The ICO can be contacted via telephone on
0303 123 1113
using the ICO website