General Data Protection Regulations (GDPR) Privacy Notice National Highways - ESDAL

National Highways have fully committed to adherence of the General Data Protection Regulations (GDPR) following implementation on the 25th May 2018. In relation to our collection and processing of personal data, please see the below information.

Section 1 – Collection of Data

1) National Highways will be the data controller and the contact details for the company are:
a) Data Protection Officer: Graham Woodhouse
b) E-mail:

2) The data is being collected for: The ESDAL (Electronic Service Delivery for Abnormal Loads) Service

3) The data processor, working on behalf of National Highways in relation to this will be:


4) Collected data will be stored within secure electronic records management systems, with the system being dependant on the nature of information. The systems used by National Highways are: ESDAL

5) Information stored by third parties will be held on the following systems:
Oracle in UK

Section 2 – Processing of data

In addition to the information referred to in section 1, at the point of collection we will, at the time when personal data are obtained, provide you with the following further information necessary to ensure fair and transparent processing:

1) The personal data will be stored until the user asks to be removed from the system or we are informed they are no longer employed by the company which their data is held under.

2) Under GDPR you have rights to request information from the company

• Right of access to the data (Subject Access Request)
• Right for the rectification of errors
• Right to erasure of personal data – not an absolute right
• Right to restrict of processing or to object to processing
• the right to data portability;

3) As this processing is based on receiving the consent of the data subject then we have an obligation to inform the data subject that they have the right to withdraw their consent at any time, without affecting the lawfulness of processing based on consent before its withdrawal.

4) You have the right to lodge a complaint with a supervisory authority (in the UK that is the Information Commissioners Office).

5) The provision of this personal data is a contractual requirement and you are obliged to provide this information for this requirement to be fulfilled.

6) If we are to process the personal data we hold for a purpose other than that for which it was originally collected then we will provide the you with information on what that other purpose is prior to that further processing taking place. The extra information will include any relevant further information as referred to above including the right to object to that further processing.