1. Introduction

1.1 St Columb Major Town Council has a responsibility under the Data Protection Act 2018 to hold, obtain, record, use and store all personal data relating to an identifiable individual in a secure and confidential manner. This Policy is a statement of what the Council does to ensure its compliance with the Act.

1.2 The Data Protection Policy applies to all Council employees, members, volunteers, contractors and to staff members of any other bodies with whom the Council works with who handle Council data jointly. The Policy provides a framework within which the Council will ensure compliance with the requirements of the Act and will underpin any operational procedures and activities connected with the implementation of the Act.

2. Aims

2.1 St Columb Major Town Council is committed to ensuring that all personal data collected is processed in accordance with all relevant data protection laws including the UK General Data Protection Regulation (GDPR) and the Data Protection Act 2018 (DPA 2018).

2.2 The lawful basis of processing will be with the consent of the data subject, necessary for compliance with a legal obligation, or necessary for the legitimate interests of the Council. Further information regarding the legal basis is outlined in section 10. St Columb Major Town Council is registered as a data controller with the Information Commissioner with the identifying reference Z9464921

3. Scope

3.1 This policy applies to all personal data, regardless of whether it is in paper or electronic format.

3.2 In order to conduct its business, services and duties, the Council processes a wide range of personal data and non-personal data relating to its own operations and some which it handles on behalf of partners. This data can be classified as:

  • Confidential information about other organisations because of commercial sensitivity;
  • Personal data concerning current, past and potential employees, Councillors and volunteers;
  • Personal data concerning individuals who contact the Town Council for information, to access its services or facilities or to make a complaint.
  • Data shared in the public arena about the services the Town Council offers, its mode of operations and other information it is required to make available to the public;
  • Confidential information and data not yet in the public arena such as ideas or policies that are being progressed.

3.3 St Columb Major Town Council will adopt procedures, and manage in a responsible manner, all data which it handles and will respect the confidentiality of both its own data, data belonging to partner organisations it works with and members of the public. In some cases, it will have contractual obligations towards confidential data but will also have specific legal responsibilities for personal and sensitive information under data protection legislation.

3.4 The Council will be as transparent as possible about its operations and will work closely with the public, the community and voluntary organisations. Therefore, in the case of all information which is not personal or confidential, it will be prepared to make it available to partners and members of the town’s communities. Details of information which is routinely available is contained in the Council’s Publication Scheme which is based on the statutory model publication scheme for local councils.

3.5 Children St Columb Major Town Council will not process any data relating to a child (under 13) without the express parental/guardian consent of the child concerned, or where it is lawfully obliged to do so.

4. Distribution

4.1 This policy is available on the Council website, and wither in hard copy from the Council offices, or by contacting the Town Clerk.

4.2 To comply with the fair processing requirements of the UK GDPR, the Council will inform its staff, Councillors, volunteers, contractors, and other community users of the data it collects, processes and holds, the purposes for which the data is held, and any third parties to whom it may be passed. This information forms part of the Privacy Notice which is available on the main Council website. A hard copy of the Privacy Notice is available from the Council offices or by contacting the Town Clerk. Privacy Notices are reviewed at least annually, and any significant changes will be publicised.

5. Definitions

5.1 Personal Data – Any combination of data items which could identify a living person and provide specific information about them, their families, or circumstances. The term covers both facts and opinions about an individual. The Council may process a wide range of personal data of staff (including councillors and volunteers) and residents as part of its operation. This personal data may include (but is not limited to):

  • names and addresses (including email addresses);
  • date of birth;
  • photograph;
  • bank details;
  • references;
  • employment history;
  • taxation and national insurance records;
  • appraisal records;
  • service bookings (allotments, cemeteries, room bookings etc);
  • complaints;
  • posts on social media networking sites;
  • Computer IP address;

5.2 Special Category Personal Data – Personal data which is more sensitive and so needs more protection, including information about a living individual’s:

  • Racial or ethnic origin
  • Political opinions
  • Religious or philosophical beliefs
  • Trade union membership
  • Genetics
  • Biometrics (such as fingerprints, retina and iris patterns), where used for identification purposes
  • Health – physical or mental
  • Sex life or sexual orientation

Note that criminal records are treated in much the same way as other special category data.

5.3 Processing – Anything done to personal data such as obtaining, recording, or holding the information or data or carrying out any operation or set of operations on the information or data, including:

  • collecting, organising, structuring, storing, adapting, altering, retrieving, using, erasing, or destroying.
  • disclosing the information or data by transmission, dissemination or otherwise making it available.

Note that processing can be either automated or manual.

5.4 Data Subject – The identified or identifiable living individual whose personal data is held or processed. That may be an employee, prospective employee, associate or prospective associate of St Columb Major Town Council or someone transacting with it in some way, or an employee, Councillor, or volunteer with one of our service users, or persons transacting or contracting with one of our customers when we process data for them.

5.5 Data Controller – a person who (either alone or jointly or in common with other persons) (e.g. Council, employer, other council) determines the purposes for which, and the manner in which, any personal data is to be processed.

5.6 Data Processor – A person or other body, other than an employee of the data controller, who processes personal data on behalf of the data controller.

5.7 Personal Data Breach – A breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to personal data.

6. Roles and Responsibilities

6.1 This policy applies to all staff (including volunteers and Councillors) who work at the Council, and to external organisations or individuals working on its behalf.

6.2 Councillors – Councillors have overall responsibility for ensuring that the Council complies with all relevant data protection obligations.

6.3 The Town Clerk acts with the delegated authority of Full Council on a day-to-day basis and will liaise with the Data Protection Officer. In the Town Clerk’s absence or in the case of an emergency, this role will be delegated to the Town Mayor.

6.4 All staff – All staff are responsible for:

  • Familiarising themselves and complying with this policy. The Council aims to allow individuals the confidence to report genuine mistakes. However, staff should be aware that a deliberate or reckless disregard of this policy could result in disciplinary action being taken.
  • Taking care to ensure the safe keeping of personal data, minimising the risk of its loss or misuse at all times. All staff should adopt the approach that they should treat the personal data of others with the same care with which they would treat their own.
  • Using personal data only on secure password protected computers and other devices, ensuring that they are properly logged off at the end of any session in which they are using personal data.
  • Storing, transporting and transferring data using encryption and secure password protected devices.
  • Not transferring personal data offsite or to personal devices
  • Deleting data in line with this policy and the retention schedule
  • Informing the Council of any changes to their personal data, such as a change of address
  • Reporting to the Town Clerk, or in his/her absence the relevant Officer/Councillor:
    • Any questions about the operation of this policy, data protection law, retaining or sharing personal data or keeping personal data secure.
    • If they have any concerns that this policy is not being followed.
    • If they are unsure whether they have a lawful basis upon which to use personal data in a particular way.
    • If they need to rely on or capture consent, deal with data protection rights invoked by an individual, or transfer personal data outside the European Economic Area
    • The discovery of a data breach or near miss (immediate action is required) – please refer to the Data Breach Policy and section 13 of this policy.
    • Whenever they are engaging in a new activity that may affect the privacy rights of individuals.
    • If they are to share personal data with a data processor, for example a contractor or someone offering a service, in which case a contract is likely to likely to be required please see – Sharing Personal Data (section 10)

7. Data Protection Officer (DPO)

7.1 St Columb Major Town Council has appointed a Data Protection Officer. The Data Protection Officer (DPO) is responsible for advising on the implementation of this policy, monitoring compliance with data protection law, providing support and developing related policies and guidelines where applicable, in amongst other data protection related functions. Where relevant, they will provide the Council with advice and recommendations on data protection issues.

7.2 The Town Council has appointed Paul Russell of MicroshadeVSM as its DPO. He can be contacted by email at paul@microshadevsm.co.uk.

7.3 Under normal circumstances, the Town Clerk will be the point of contact with the DPO.

8. Subject Access Requests and Other Rights of Individuals

8.1 In all aspects of its work, the Council will ensure that the rights of the Data Subject are protected by all practicable measures associated with the conduct of the Council’s work. Subject to exceptions, the rights of the data subject as defined in law are:

  1. The Right to be informed.
    The Town Council advises individuals how it will use their data, using transparent Privacy Notices and other documentation, such as consent forms where appropriate.
  2. The Right of Access
    An individual when making a subject access request (SAR) is entitled to the following:

    1. confirmation that their data is being processed;
    2. access to their personal data;
    3. other supplementary information – this largely corresponds to the information that should be provided in a Privacy Notice.

    The Council must respond to such a request within 30 days, unless the request is complex, in which case it may be extended by a further 60 days. Please refer to the Subject Access Request Policy for further details as to how to manage a subject access request.

  3. The Right to Rectification
    Individuals have the right to ask to rectify information that they think is inaccurate or incomplete. The Council has a duty to investigate any such claims and rectify the information where appropriate within 30 days, unless an extension of up to a further 60 days can be justified.
  4. The Right to Erasure
    The right for an individual to request that their data is erased is not absolute. It applies where:

    • The information was given voluntarily; consent is now withdrawn and no other legal basis for retaining the information applies.
    • The information is no longer required by the Council.
    • A legal obligation to erase the data applies.
    • The data was collected from a child for an online service.
    • The Council has processed the data on the basis that it is in their legitimate business interests to do so, and having conducted a legitimate interests test, it concludes that the rights of the individual to have the data erased outweigh those of the Council to continue to process it.
  5. The Right to Restrict Processing
    An individual may ask the Council to temporarily limit the use of their data when it is considering:

    • a challenge made to the accuracy of their data, or
    • an objection to the use of their data.

    In addition, the Council may be asked to limit the use of data rather than delete it, if the individual does not want the Council to delete the data but does not wish to it continue to use it, in the event that the data was processed without a lawful basis or to create, exercise or defend legal claims:

  6. The Right to Data Portability
    An individual can make a request in relation to data which is held electronically for it to be transferred to another organisation or to themselves where they have provided it either directly or through monitoring activities. The Town Council only has to provide the information where electronically feasible.
  7. The Right to Object
    Individuals have a right to object in relation to the processing of data for:

    • A task carried out in the public interest
    • A task carried out in its legitimate interests
    • Scientific or historical research, or statistical purposes, or
    • Direct marketing
  8. the right to withdraw consent to processing
  9. Rights related to automated decision making (This does not apply as the Council does not employ automated decision-making processes).

9. Data Protection Principles

9.1 The GDPR is based on seven key data protection principles that the Council complies with.

9.2 The principles say that personal data must be:

  • Processed lawfully, fairly and in a transparent manner. The Council will explain to individuals why it needs their data and why it is processing that data, for example on consent forms (where consent is used as the basis for processing), and in its Privacy Notice(s). The Council reviews its documentation and the basis for processing data on a regular basis.
  • Collected for specified, explicit and legitimate purposes – The Council explains these reasons to the individuals concerned when it first collects their data.
  • If the Council wishes to use personal data for reasons other than those given when the data was first obtained, it will inform the individuals concerned before doing so, and will seek consent where necessary and appropriate unless the new purpose is compatible with that in respect of which consent was given, or there is another lawful basis for sharing the information. The Council will document the basis for processing. For special categories of personal data, it will also meet one of the special category conditions for processing which are set out in the GDPR and Data Protection Act 2018.
  • Adequate, relevant, and limited to what is necessary to fulfil the purposes for which it is processed – The Council must only process the minimum amount of personal data that is necessary in order to undertake its work.
  • Accurate and, where necessary, kept up to date – The Council will check the details of those on its databases at appropriate intervals and maintain the databases. It will consider and respond to requests for inaccurate data to be rectified in accordance with the Data Protection Act 2018.
  • Kept for no longer than is necessary for the purposes for which it is processed – When the Council no longer needs the personal data it holds, it will ensure that it is deleted or anonymised in accordance with the retention schedule.
  • Processed in a way that ensures it is appropriately secure – The Council implements appropriate technical measures to ensure the security of data and systems for staff and all users.
  • Accountability – The Council complies with its obligations under data protection laws including the GDPR and can demonstrate this via the measures set out in this policy, including:
    • Completing Data Protection Impact Assessments (DPIAs) where the Council’s processing of personal data presents a high risk to rights and freedoms of individuals, and when introducing new technologies. This largely involves special category personal data and CCTV. However, the Council will liaise with the DPO who will advise on this process. Any activity involving the processing of personal data must be registered on the Register of Processing Activity and reviewed, at the very least, annually.
    • Integrating data protection into internal documents including this policy, any related policies and Privacy Notices.
    • Regularly training members of staff on data protection law, this policy, any related policies and any other data protection matters; the Council will maintain a record of attendance.
    • Regularly conducting reviews and audits to test its privacy measures and ensure compliance with relevant legislation and Council policies.
    • Maintaining records of its processing activities for all personal data that it holds.

10. Processing Personal Data

10.1 In order to ensure that the Council’s processing of personal data is lawful, it will always identify one of the following six grounds for processing before starting the processing:

  • The data needs to be processed so that the Council can fulfil a contract with the individual, or the individual has asked the Council to take specific steps before entering into a contract;
  • The data needs to be processed so that the Council can comply with a legal obligation;
  • The data needs to be processed to ensure the vital interests of the individual e.g. to protect someone’s life;
  • The data needs to be processed so that the Council, as a public authority, can perform a task in the public interest, and carry out its official functions;
  • The data needs to be processed for the legitimate interests of the Council or a third party where necessary, balancing the rights of freedoms of the individual). However, where the Council can use the public task basis for processing, it will do so rather than rely on legitimate interests as the basis for processing.
  • The individual has freely given clear consent. In the case of special categories of personal data, this must be explicit consent. For processing special categories of personal data an additional lawful basis is needed – these are detailed in the Special Categories of Personal Data Policy

11. Sharing Personal Data

Please refer to the Council’s Privacy Notices.

  • The Council will only share personal data under limited circumstances, when there is a lawful basis to do so and where identified in the Privacy Notice(s). The following principles apply:
  • The Council will share data if there is an issue that puts the safety of staff at risk;
  • The Council’s suppliers and contractors need data to provide services – for example, IT companies. When sharing data, the Council will:
    • Only appoint suppliers or contractors which can provide sufficient guarantees that they comply with data protection law;
    • Establish a data processing contract with the supplier or contractor, either in the contract or as a standalone agreement, to ensure the fair and lawful processing of any personal data it shares where there is regular sharing;
    • Only share data that the supplier or contractor needs to carry out their service, and information necessary to keep them safe while working with the Council.
  • The Council may also share personal data with law enforcement and government bodies where there is a lawful requirement/basis for it to do so, including:
    • For the prevention or detection of crime and/or fraud;
    • For the apprehension or prosecution of offenders;
    • For the assessment or collection of tax owed to HMRC;
    • In connection with legal proceedings;
    • For research and statistical purposes, as long as personal data is sufficiently anonymised, or consent has been provided.
  • The Council may also share personal data with emergency services and local authorities to help them to respond to an emergency situation that affects Councillors or staff.

12. Data Protection by Design and Default

12.1 The Council has a legal obligation to integrate appropriate technical and organisational measures into all of its processing activities, and to consider this aspect before embarking on any new type of processing activity.

12.2 It is a statutory requirement that any activity involving a high risk to the data protection rights of the individual when processing personal data be assessed by the Data Protection Impact Assessment. The Council will undertake a DPIA when required.

13. Personal data breaches or near misses

13.1 A Personal Data Breach is defined as “a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data transmitted, stored or otherwise processed in connection with the provision of a public electronic communications service.” It may be deliberate or accidental.

13.2 Wherever it is believed that a security incident has occurred or a ‘near miss’ has occurred, the staff member must inform the Town Clerk immediately, in order that an assessment can be made as to whether the ICO should be informed within 72 hours as is legally required, and/or those data subjects affected by the breach.

13.3 Further details on security incidents and data breaches can be found in the Data Breach Policy.

14. Destruction of records

14.1 The Council applies its retention policy and will permanently destroy both paper and electronic records securely in accordance with these timeframes.

14.2 The Council will securely destroy hard copies and will ensure that any third party who is employed to perform this function will have the necessary accreditations and safeguards.

14.3 If the Council deletes electronic records with the intention to put them beyond use, although it may be technically possible to retrieve them, the Council will follow the Information Commissioner’s Code of Practice on deleting data, and this information will not be made available on receipt of a subject access request.

15. Training

15.1 To meet its obligations under Data Protection legislation, the Council will ensure that all staff, volunteers, and Councillors receive an appropriate level of data protection training as part of their induction. Those who have a need for additional training will be provided with it, for example relating to use of systems or as appropriate.

15.2 Data Protection also forms part of continuing professional development, and updates will be provided where changes to legislation, guidance or the Council’s processes make it necessary.

16. Monitoring Arrangements

16.1 Whilst the DPO is responsible for advising on the implementation of this policy and helping to monitor the Council’s overall compliance with data protection law, the Council itself is responsible for the day-to-day implementation of the policy and for making the Data Protection Officer aware of relevant issues which may affect the Council’s ability to comply with this policy and the legislation.

16.2 This policy will be reviewed annually, unless an incident or change to regulations dictates a sooner review.

17. Complaints

17.1 The Council seeks to implement best practice, strives for the highest standards, and ensures that data subjects are aware of their rights and have easy access to that information on request. The Council is fully transparent and is happy to discuss any concerns about the implementation of this policy or related issues. The Council’s complaints policy may be found on its website.

17.2 Data subjects have a right to make a complaint to the Information Commissioner’s Office (ICO), but under most circumstances the ICO would encourage the complainant to raise the issues in the first instance with the Council or via the Town Council’s DPO (details in section 7).

17.3 The ICO is contactable at;
Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF.
casework@ico.org.uk
Telephone: 0303 123 1113.

18. Legislation and Guidance

18.1 This policy takes into account the following:

  • The General Data Protection Regulation (GDPR) 2016
  • The Data Protection Act (DPA) 2018
  • The Protection of Freedoms Act 2012
  • Guidance published by the Information Commissioner’s Office

19. Links with Other Policies

19.1 This Data Protection Policy is linked to the following:

  • Information Security Policy
  • Retention of Records Policy
  • Data Breach Policy
  • Management of Transferable Data Policy
  • Special Categories of Personal Data Policy
  • Privacy Notices
  • Consent / Permissions Form.

19.2 Who is responsible for protecting a person’s personal data?

The Council, as a corporate body, has ultimate responsibility for ensuring compliance with the Data Protection legislation. The Council has delegated this responsibility day to day to the Clerk to the Council/Town Clerk/Chief Executive.

  • Email: clerk@stcolumbmajor-tc.gov.uk
  • Phone: 01637 889014

19.3 External Data Protection Officer

The Council has also appointed an external Data Protection Officer to ensure compliance with Data Protection legislation who may be contacted at: paul@microshadevsm.co.uk

Adopted by Full Council 12th May 2026
For review by Full Council May 2027