Policies

Status: Final

Adopted: Adopted by Resolution of the Council on: 26th October 2026

Prepared by: Geraldine McCarthy Parish Clerk

Review Date: October 2027, or sooner if legislation or operational experience dictates

Version: Updated to reflect current legislation, best practice guidance, and operational arrangements

Legislative Basis:
UK GDPR (2021)
Data Protection Act 2018
Digital Information Act 2025

Introduction
North Somercotes Parish Council is committed to protecting the personal data of residents, staff, councillors, contractors, and anyone who interacts with the Council.  This updated Data Protection Policy explains how the Council collects, uses, stores, and protects personal data in accordance with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, the Data Use and Access Act 2025, and current Information Commissioner’s Office (ICO) guidance.
The policy sets out the Council’s responsibilities as a data controller and outlines the rights of individuals whose data we process.  It aims to ensure that personal data is handled lawfully, fairly, securely, and transparently, supporting good governance and public trust.

1. Scope
This policy applies to all personal data processed by North Somercotes Parish Council, whether held electronically, on paper, or in any other format.  It covers all individuals working with or for the Council, including:
• Councillors
• Employees
• Volunteers
• Contractors and service providers
It applies to all Council activities where personal data is collected, used, shared, or stored.

2. Definitions
To support clarity and understanding, the following definitions apply:
I. Personal Data:
ii. Any information relating to an identifiable individual, such as a name, address, or email.
iii. Special Category Data:
iv. Sensitive information requiring extra protection (e.g., health, ethnicity, religious beliefs).
v. Processing: 
vi. Any action involving personal data, including collecting, storing, sharing, or deleting it.
vii. Data Subject: 
viii. The individual whose personal data is being processed.
ix. Controller: 
x. The organisation deciding how and why personal data is processed (the Council).
xi. Subject Access Request (SAR):
xii. A request from an individual asking for access to the personal data the Council holds about them.

3. Purpose of the Policy
The purpose of this policy is to ensure that North Somercotes Parish Council processes personal data in a lawful, fair, and transparent manner.  It sets out how the Council protects personal data, upholds the rights of individuals, and complies with all relevant legislation. The policy also supports consistent, responsible data handling across all Council functions.

4. Lawful Bases for Processing
I. The Council must have a valid legal reason for processing personal data. These lawful bases ensure that personal information is used appropriately and only when necessary.
ii. Public Task
iii. The Council processes personal data when it is required to carry out official duties in the public interest.  This includes managing cemetery records, responding to planning consultations, maintaining governance documentation, issuing notices, and communicating with residents. Without processing personal data, the Council could not fulfil its statutory responsibilities.

iv. Legal Obligation
v. Some data must be processed because the law requires it.  Examples include financial accounting records, audit documentation, statutory registers, and responses to Freedom of Information requests.  The Council cannot choose whether to process this data — it is a legal requirement.

vi. Contract
vii. The Council processes personal data when entering or managing a contract.  This applies to employees (e.g., payroll and HR records), suppliers (e.g., invoicing details), and contractors delivering services.  Processing is necessary to meet contractual obligations.
viii. Consent
ix. In certain situations, the Council may ask individuals for consent to process their data.  Consent is used only when individuals have a genuine choice and can withdraw it at any time.  The Council avoids relying on consent where another lawful basis is more suitable.
x. Vital Interests
xi. This basis is used only in emergency situations where processing personal data is necessary to protect someone’s life or safety.  Although rare, it ensures the Council can act quickly if urgent circumstances arise.
xii. Recognised Legitimate Interests – DUAA - Data 
xiii. (Use and Access) Act 2025
xiv. Under updated legislation, the Council may process personal data where there is a legitimate interest that does not override an individual’s rights.  This basis is used carefully and only when the impact on individuals is minimal, such as improving service delivery or managing routine administrative tasks.

5. Data Protection Principles
I. The Council follows the six principles of UK GDPR to ensure responsible and secure handling of personal data.
ii. Lawfulness, Fairness, Transparency
iii. The Council ensures that personal data is processed legally, fairly, and openly.  Individuals are informed about how their data is used, helping build trust and accountability.
iv. Purpose Limitation
v. Personal data is collected for specific, legitimate reasons and is not used for anything unrelated.  This prevents misuse of information and ensures data is only used for appropriate Council activities.
vi. Data Minimisation
vii. The Council collects only the information needed to carry out a task.  This reduces unnecessary data storage and helps protect individuals’ privacy.
viii. Accuracy
ix. The Council takes reasonable steps to ensure personal data is correct and up to date.  Inaccurate information can lead to mistakes, so maintaining accuracy is essential for good governance.
x. Storage Limitation
xi. Personal data is kept only for as long as necessary.  Once it is no longer required, it is securely destroyed.  This prevents long‑term storage of outdated or unnecessary information.
xii. Integrity and Confidentiality
xiii. The Council protects personal data from unauthorised access, loss, or damage.  Security measures ensure that information is handled safely and responsibly.

6. Types of Personal Data Processed
I. The Council processes a range of personal data depending on its duties and responsibilities.
ii. Contact Details
iii. Names, addresses, telephone numbers, and email addresses used to communicate with residents, suppliers, councillors, and organisations.

iv. Correspondence
v. Letters, emails, and messages received from residents, organisations, and authorities.  These may contain personal information and are processed to respond to queries and maintain transparency.
vi. Planning Representations
vii. Comments submitted by residents regarding planning applications.  These often include personal opinions and contact details and are processed to ensure representations are considered appropriately.
viii. Cemetery Records
ix. Burial registers, plot ownership details, and related documentation required for statutory record‑keeping.  These records support families, funeral directors, and legal requirements.
x. Councillor Information
xi. Contact details, declarations of interest, and governance records processed to ensure transparency and compliance with statutory duties.
xii. Staff HR Data
xiii. Employment records, payroll information, training records, and performance documentation processed to manage staff effectively and meet employment law requirements.
xiv. Supplier Information
xv. Details of contractors and service providers processed to manage procurement, invoicing, and service delivery.
xvi. Website Enquiries
xvii. Information submitted through online forms or emails sent via the Council’s website, processed to respond to enquiries and support residents.
xviii.    CCTV (if applicable)
xix. Images captured for security, safety, or crime prevention purposes may be processed to protect Council property and support law enforcement when necessary.

7. Individual Rights
I. Individuals have rights under UK GDPR, and the Council ensures these rights are respected and supported.
ii. Right of Access
iii. Individuals can request access to the personal data the Council holds about them.  This supports transparency and accountability.
iv. Right to Rectification
v. Individuals can request corrections to inaccurate or incomplete data.  Keeping information accurate helps prevent errors and misunderstandings.
vi. Right to Erasure
vii. In certain circumstances, individuals can request the erasure of their personal data.   This right applies when data is no longer required for the purpose it was collected, or where it has been processed unlawfully.
viii. Right to Restriction
ix. Individuals can ask the Council to limit how their data is used, such as during disputes or when accuracy is being checked.
x. Right to Object
xi. Individuals can object to the Council processing their personal data if they believe their rights outweigh the Council’s reasons for doing so. 
xii. Right to Data Portability
xiii. Individuals can request their data in a structured, commonly – used format.  Although this right is rarely relevant to Council functions, it is included for completeness.

xiv. Right to Human Review
xv. If automated decision‑making is ever introduced, individuals can request human intervention to ensure fairness.
xvi. Subject Access Requests – 2026 Requirements
xvii. The Council follows updated SAR rules to ensure compliance and fairness.
xviii. Clarification Requests
xix. If a SAR is unclear, the Council may request clarification and pause the response timeframe until the information is provided.  This ensures the Council searches the correct records.
xx. Reasonable and Proportionate Searches
xxi. The Council will search relevant systems and records but is not required to conduct exhaustive searches.  This ensures a balanced approach that protects both individuals and Council resources.
xxii. Timeframes
xxiii. Responses are provided within one month.  For complex or multiple requests, the Council may extend the timeframe by up to two months.
xxiv. Verification
xxv. The Council may request proof of identity before releasing personal data to ensure information is provided securely and only to the correct person.
xxvi. Secure Responses
xxvii. Information is provided securely, using appropriate methods to protect confidentiality. All SARs are recorded in the Council’s SAR log.

8. Data Security
I. The Council takes appropriate steps to protect personal data from loss, misuse, or unauthorised access.
ii. Secure Systems
iii. Electronic data is stored on secure systems with appropriate access controls and regular updates.
iv. Controlled Access
v. Only authorised individuals can access personal data relevant to their role. Access is granted on a need‑to‑know basis.
vi. Password and Device Security
vii. Strong passwords, secure devices, and regular updates help protect data from cyber threats.
viii. Secure Disposal
ix. Paper and electronic records are disposed of securely when no longer needed, preventing accidental disclosure.
x. Physical Protection
xi. Paper records are stored in locked cabinets or secure areas to prevent unauthorised access.
xii. Encryption
xiii. Sensitive data may be encrypted to provide an additional layer of protection.

9. Data Sharing
I. The Council shares personal data only, when necessary, lawful, and appropriate.
ii. Government Bodies
iii. Data may be shared with district councils, statutory agencies, or other authorities to support service delivery or meet legal requirements.
iv. Auditors
v. Information may be shared for financial or governance audits to ensure transparency and accountability.

vi. Contractors and Service Providers
vii. Data may be shared with trusted providers delivering services on behalf of the Council.  These providers must follow data protection requirements.
viii. Law Enforcement
ix. Information may be shared when required for crime prevention, investigation, or public safety.
x. Statutory Requirements
xi. Data may be shared when legislation requires disclosure, such as during legal proceedings.
xii. No Selling of Data
xiii. The Council does not sell personal data under any circumstances.

10. Retention & Disposal
I. The Council keeps personal data only for as long as necessary.
ii. Retention Schedules
iii. Retention follows ICO guidance, NALC model schedules, and statutory requirements. This ensures data is kept for appropriate periods and not stored indefinitely.
iv. Secure Disposal
v. Data is destroyed securely when no longer required, protecting confidentiality and reducing risk.
11. Data Breach Procedure
I. The Council responds promptly and responsibly to data breaches.
ii. Immediate Reporting
iii. All breaches must be reported to the Clerk as soon as they are discovered.
iv. Risk Assessment
v. The Clerk assesses the severity and potential impact of the breach.
vi. Containment
vii. Steps are taken to limit further exposure or damage, such as isolating affected systems.
viii. Notifications
ix. Affected individuals are informed where required, especially if there is a high risk to their rights or freedoms.
x. ICO Reporting
xi. High‑risk breaches are reported to the ICO within 72 hours, as required by law.
xii. Record Keeping
xiii. All breaches are logged for accountability and future learning.
12. Data Protection Complaints Procedure
I. Residents can raise concerns about how their data is handled.
ii. Submission
iii. Complaints must be submitted to the Clerk in writing or by email.
iv. Acknowledgement
v. The Clerk acknowledges complaints within 5 working days to confirm receipt.
vi. Investigation
vii. Investigations are completed within 20 working days, ensuring a timely and thorough response.
viii. Outcome
ix. A written response is provided, explaining findings and any actions taken.
x. Escalation
xi. Individuals may escalate concerns to the ICO if they remain dissatisfied.

13. Automated Decision‑Making
The Council does not currently use automated decision‑making.
I. Future Use If automated systems are introduced, individuals will have the right to request human review and challenge decisions to ensure fairness and transparency.

14. Data Protection Lead
The Parish Clerk acts as the main point of contact for data protection matters, ensuring that the Council follows its policies and meets its responsibilities. The Clerk provides guidance where appropriate and coordinates responses to data requests. 

15. Training
Councillors and staff receive periodic training to ensure ongoing compliance with data protection legislation.  Training helps individuals understand their responsibilities and supports good governance.

16. Policy Review
This policy is reviewed annually or when legislation or guidance changes. Regular reviews ensure the policy remains accurate, relevant, and effective.

17. Subject Access Requests 
I. This section provides the complete SAR process.
ii. Verbal or Written Requests
iii. SARs may be made in any format, including email, letter, or verbal request.
iv. Clarification
v. The Council may request clarification to identify relevant data and ensure accurate searches.
vi. Timeframe
vii. The Council responds within one month, with extensions available for complex cases.
viii. Verification
ix. Proof of identity may be required to ensure data is released securely.
x. Secure Delivery
xi. Responses are provided securely, using appropriate methods to protect confidentiality.
xii. Confidential Handling
xiii. Only authorised staff access SAR‑related data, ensuring privacy and security.

18. Confidentiality
I. The Council treats all personal data as confidential.
ii. Access Control
iii. Only authorised individuals may access personal data relevant to their role.
iv. Lawful Disclosure
v. Data is shared only when legally required or justified.
vi. All staff and councillors must always uphold confidentiality and ensure that personal information is not disclosed without a lawful basis.
vii. Breach Consequences
viii. Breaches may lead to internal investigation, disciplinary action, or regulatory involvement from the ICO (Information Commissioner’s Office).