Heathrow Expansion privacy notice

Last updated: October 2026

This privacy notice tells you what to expect when Heathrow Airport Limited (“Heathrow”) processes your personal data in relation to the Heathrow Expansion Programme.

Heathrow is committed to protecting your personal data and handling it in accordance with all applicable data protection laws, including the UK General Data Protection Regulation (UK GDPR).

What information will we collect about you?

Heathrow Airport Limited may collect and use personal data in connection with the Heathrow Expansion programme, including the development and submission of a Development Consent Order (DCO). This may include activities such as land referencing and property matters, public consultation, community and stakeholder engagement, participation in panels and forums, supplier engagement, event management, and other project-related activities. We process personal data relating to individuals who engage with the project, are affected by it, or have expressed an interest in it.

The personal data we collect will vary depending on your relationship with the Heathrow Expansion programme and the purpose of the engagement. This information may include, but is not limited to:

  • Name
  • Postal address
  • Email address
  • Telephone number(s)
  • Organisation, company or employer details
  • Job title or professional role
  • Details of land ownership, occupation, rights, interests in land or tenancies
  • Correspondence and records of communications or engagement with you
  • Survey information
  • Payment Information
  • Demographic and equality monitoring information, including age and ethnic origin, and relevant information about health, disability or other personal circumstances, where needed for the activity concerned. Equality monitoring questions are optional and help us assess participation and impacts on different groups.
  • Records of attendance at meetings, events, workshops, panels, forums, consultations or stakeholder engagement activities
  • Views, feedback, responses or submissions provided as part of consultations, surveys, engagement activities or project-related discussions
  • Technical information, such as IP addresses and browser details, used to validate online submissions and help prevent fraudulent or automated responses.
  • Any other information you choose to provide to us in connection with Heathrow Expansion activities.

This information may be collected directly from you, from publicly available sources, from organisations acting on behalf of Heathrow Expansion, or from third parties (where permitted by law).

We use personal data to plan, develop and deliver the Heathrow Expansion programme, including the preparation and submission of the Development Consent Order (DCO). This includes maintaining land and property records, compiling and maintaining a Book of Reference, carrying out consultation and engagement activities, administering stakeholder groups, panels and forums, managing relationships with suppliers and professional advisers, responding to enquiries and feedback, and meeting our legal and regulatory obligations. We may also use personal data for other purposes that are compatible with and directly related to the delivery of the Heathrow Expansion programme.

How will Heathrow use the information it collects about me?

Personal data collected will be used only where necessary and proportionate for the processing, including but not limited to the following purposes:

  • To identify landowners, occupiers, and parties with an interest in land directly or indirectly affected by the proposed development
  • To prepare, submit and maintain documentation required for the Development Consent Order (DCO) process
  • To engage with affected parties in relation to land access, rights, acquisition, or other matters
  • To comply with obligations under the Planning Act 2008 and associated legislation
  • To deliver the work required as part of any further Heathrow Expansion work.

We will only collect and use your personal data where we have a lawful basis to do so under UK data protection law. In connection with the Heathrow Expansion programme, including activities undertaken to meet regulatory and planning requirements, the following lawful bases may apply:

  • Legal obligation – where processing is necessary for us to comply with applicable legal or regulatory requirements, including obligations arising under the Planning Act 2008 and related legislation.
  • Legitimate interests – where processing is necessary for our legitimate interests in planning, developing and delivering Heathrow Expansion; engaging with communities, landowners, stakeholders and suppliers; understanding and assessing potential impacts; and managing related enquiries, consultations and project activities.
  • Consent – where you have given your consent for a specific use of your personal data.
  • Contract – where processing is necessary to perform a contract with you, or to take steps at your request before entering into a contract.

Personal data collected for the DCO process and the Heathrow Expansion programme may be shared, where necessary, with third-party suppliers and professional advisers supporting the Heathrow Expansion programme, including consultation and community engagement, IT and data hosting providers, HM Land Registry and its affiliates, and relevant central government and regulatory bodies.  Your personal information may be processed outside the UK. Where this occurs, we rely on applicable UK adequacy regulations or appropriate safeguards required by data protection law. Where applicable, you can request a copy of the international transfer safeguards using the contact details below.

We may use artificial intelligence (AI) tools while processing information.  For example, to help identify trends and insights or as otherwise set out in this privacy notice. Where we do so, appropriate safeguards are in place to protect personal data. We use automated tools (including AI-enabled tools) to support parts of our process, but we do not make final decisions based solely on automated processing. Decisions that materially affect individuals involve meaningful human review. Where automated processing is used to support or significantly influence decisions, we will provide clear information about this and how it works, and we will put in place safeguards in line with applicable law (including the UK GDPR as amended by the Data (Use and Access) Act 2025 (DUAA)) and relevant guidance from the Information Commission.

How long will Heathrow keep my information?

We will retain personal data for as long as necessary to support the Heathrow Expansion programme, including activities associated with the Development Consent Order (DCO) application process. Information may be retained to comply with applicable regulatory requirements, including requirements arising from the Planning Act 2008 and related planning processes, to maintain project records, and to establish, exercise or defend legal claims. Retention arrangements are kept under regular review to ensure personal data is not retained for longer than necessary.

We may also disclose your personal information to the police, tribunals, courts, regulators or other authorities where necessary and lawful to assist with investigations, report security incidents or suspected unlawful acts, or comply with legal requirements.

What rights do I have over my personal data?

Under UK GDPR, you have the right to:

  • Access your personal data by making a subject access request
  • Request rectification, erasure or restriction of your personal information processed in connection with Heathrow Expansion, subject to the applicable legal conditions.
  • Object to the processing of your information where this is justified
  • Data portability
  • Where we rely on your consent, you may withdraw it at any time without affecting the lawfulness of processing before withdrawal.

To exercise your rights please contact the Heathrow Data Protection Officer using the following contact details:

By Post - Data Protection Officer, Heathrow Airport Limited, The Compass Centre, Nelson Road, Hounslow, Middlesex TW6 2GW

By Email - privacy@heathrow.com

What if I find your response unsatisfactory?

If you would like to make a data privacy-related complaint, please contact us at privacy@heathrow.com

Should you find our response unsatisfactory, you have the right to lodge a complaint with the supervisory authority – the Information Commissioner’s Office (ICO). You can find more information on the ICO website at https://ico.org.uk/concerns/ regarding the complaints process.

Changes to this privacy notice

We will keep this privacy notice under regular review, and we will place any updates here. At the start of this privacy notice we will tell you when it was last updated.