Only individuals can apply to the Registrar to have their protected data kept from public inspection. This can be done by the individual themselves, or by the overseas entity on their behalf if it has their consent to do so.
Protected information means the person's name and/or any former name, their date of birth, nationality, addresses, e-mail address and the fact that they are (or were) a relevant individual in relation to an overseas entity for the purposes of the Act.
The application must establish that the individual reasonably believes that if the protected information is made available for public inspection or is revealed by the Registrar then the activities of the overseas entity, or one or more aspects of the person when associated with that overseas entity, will put them or someone living with them at serious risk of violence or intimidation. The exact contents of the application are set out in regulation 7(4) of The Register of Overseas Entities (Delivery, Protection and Trust Services) Regulations 2022.
The Registrar must notify the applicant of its decision as to whether or not the application has been successful within 7 days, and that there is a right of appeal for unsuccessful applications.
The Registrar can disclose protected information in order to communicate with the relevant individual or the relevant overseas entity, or to any of the public authorities set out in schedule 1 to the Register of Overseas Entities (Delivery, Protection and Trust Services) Regulations 2022 where the authority has notified the Registrar that it will use the data only for its public function. The list contains 54 authorities including the Bank of England, the Charity Commission, the Competition and Markets Authority, the National Crime Agency and the Health and Safety Executive.
If the data is required by the National Crime Agency, Secret Intelligence Service, Security Service or Government Communications Headquarters then they do not have to confirm to the Registrar how it will use the data.