BMG was recently commissioned by Ofgem to conduct a survey seeking to explore more about how people  view and think about energy deals. Ofgem’s privacy notice for the study is below.

Please read this privacy notice carefully – details of who to contact if you have any questions, or if you wish to exercise your data subject rights, are included below. In this privacy notice, we explain our research project and how your personal data might be used if you consent to BMG research collecting your data on behalf of Ofgem.

Who is Ofgem?

Ofgem is the Office of Gas and Electricity Markets. We are a non-ministerial UK government department and an independent National Regulatory Authority. You can find more information about Ofgem and what we do at

Why are we doing this research

We have commissioned BMG, an independent market research agency, to conduct research for Ofgem in order to better understand how consumers make decisions about energy tariffs.

For information on BMG’s privacy policies and procedures please see their privacy notice (BMG-Privacy-Notice_May_2023_V7.pdf (

What if I don’t want to take part in the research?

Your participation in this survey is voluntary. If you do not wish to take part you can choose not to, and you can withdraw from completing the survey at any point.

What is personal data?

Personal data is information that relates to an identified or identifiable individual – for example, your name and contact details. The UK General Data Protection Regulation is the General Data Protection Regulation (Regulation (EU) 2016/679) as retained in domestic law following the UK’s withdrawal from the European Union (“UK GDPR”)1. It gives individuals the right to be informed about the collection and use of their personal data.

What types of personal data will be processed?
Ofgem is the data controller in this research project. The types of personal data that will be processed in this project are:

Will my responses to the research be confidential?

Ofgem will receive a data set from BMG, along with aggregated findings. Only a limited number of Ofgem employees will be given access to the data. It will be used for research and analysis purposes only and will not be used to identify any individuals. Any published results from the research will be anonymised and will not contain information which could identify individuals. After 24 months the data will either be deleted or anonymised. By anonymised we mean removing any information which could lead to individuals being identified.

What is the lawful basis for processing personal data in this research project?
Any data controller or data processor must always ensure that its processing of personal data is lawful, fair and transparent, and that it complies with all the other principles and requirements of the UK GDPR. The lawful basis for processing your personal data in this project is your consent to Ofgem for participating in this project (Article 6(1) (a) of UK GDPR).

What rights do I have in respect of my personal data?
Under data protection law, you have the right to:
• request access to the personal data which Ofgem holds about you;
• request amendment or destruction of your information;
• request Ofgem to restrict the processing of your information;
• object to Ofgem’s processing of your information;
• withdraw your consent to Ofgem’s processing of your information; or
• request Ofgem transfer your information to another organisation.

In order to exercise any of these rights in relation to this research project, you may contact Ofgem at

At any time you can raise any questions or concerns you have in respect of your personal data held by Ofgem. Ofgem’s Data Protection Officer can be contacted at

You also have the right to make a complaint at any time to the Information Commissioner’s Office (ICO), the UK supervisory authority for data protection issues (

More information on our data and information policies can be found in our privacy policy at

[1] The General Data Protection Regulation (Regulation (EU) 2016/679) as retained in domestic law following the UK’s withdrawal from the European Union (“UK GDPR”)