Adopted 22 April 2025
Review Date: April 2030

A copy of this document is also available in different formats such as large print, Braille, audio or in a different language. Please contact the office if this is required.

Table of Contents

  1. General
  2. How the GDPR and DPA impacts Perranzabuloe Parish Council
  3. Aims and objectives
  4. Responsibilities for data protection compliance
  5. Breaches of this policy and data protection legislation
  6. Links to other policies and procedures
  7. Additional information and guidance

1. General

This policy and supporting procedures are designed to promote and maintain compliance with the General Data Protection Regulation (GDPR) and the UK Data Protection Act 2018 (DPA). The two pieces of legislation work in tandem. For example, the principles and requirements for handling personal data are in the General Data Protection Regulation and exemptions, enforcement and penalties are contained in the Data Protection Act.

The Data Protection Act also includes our obligations if the Parish Council process personal data for law enforcement purposes. They apply to information that is held by the Parish Council about living, identifiable individuals. Examples of this are contact information, details of the service it provides, recordings and photographs (known as ‘personal data’).

It may be automatically processed, such as on a computer, smartphone, recording device or closed-circuit TV system or in manual paper records. For example, hand-written meeting notes and printouts of what is held on computer. It includes information that has been pseudonymised. For example, given a reference number or code so an individual cannot be identified, and the identifiable information is kept separately.

The GDPR consists of principles which require that personal data must be:

  • Processed lawfully, fairly and in a transparent manner
  • Collected for specified, explicit and legitimate purposes and not further processed in a manner that is incompatible with those purposes (purpose limitation)
  • Adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed (data minimisation)
  • Accurate and, where necessary, kept up to date
  • Kept in a form which permits identification of data subjects for no longer than is necessary for the purposes for which the personal data are processed (storage limitation)
  • Processed in a manner that ensures appropriate security of the personal data, including protection against unauthorised or unlawful processing and against accidental loss, destruction or damage, using appropriate technical or organisational measures (integrity and confidentiality)
  • Only transferred to countries, territories or international organisations outside the European Economic Area if there are adequate protections in place or under specific conditions.

2.1 Accountability
The Data Controller shall be responsible for, and be able to demonstrate, compliance with the principles.

Individuals’ information rights:

  • Right to be informed about what PPC does with their information
  • Right of access to the data it holds on them
  • Rectification
  • Erasure/right to be forgotten
  • Restriction of processing
  • Data portability – to be provided with personal data in a structured, commonly used machine-readable format (if possible)
  • To make objections
  • Not to be subject to a decision based on automated individual decision-making and profiling.

2. How the GDPR and DPA impacts Perranzabuloe Parish Council (PPC)

They apply to any Councillor, member of staff or volunteer who has access to, uses or passes on personal data in their day-to-day work. Breaches of principle and other requirements may result in PPC facing prosecution, being publicly named-and-shamed, and would result in the loss of trust from the people it provides services to.

Criminal offences include:

  • To obtain, procure, handle, disclose or retain personal data without the Council’s authorisation or consent.
  • To sell, or offer to sell, personal data that has been unlawfully obtained, which includes advertising it for sale.
  • To re-identify personal data that has been de-identified.
  • If a subject access or portability request is received – to obstruct, alter, deface, block, erase, destroy or conceal personal data, with the intention of preventing disclosure of all or part of the information.

3. Aims and objectives

PPC aims to make every effort to ensure:

  • Compliance with the GDPR and the DPA is maintained.
  • Personal data is well-managed, held securely and that the rights of individuals are respected.
  • Data protection is integrated into the Council’s working practices and information systems from the moment information is collected or received, through to its destruction.
  • Data protection impact assessments are conducted, where appropriate.
  • Compliance with the accountability principle, being responsible for and able to demonstrate compliance with the other principles by implementing appropriate technical and organisational measures such as:
    • Internal data protection policies, and procedures
    • Staff reporting (for example data breaches)
    • Provision of staff training
    • Internal audits of processing activities
    • Reviews of internal Human Resources policies
    • Maintaining documentation of our processing activities
    • Implementing measures that include:
      • Data minimisation
      • Pseudonymisation
      • Transparency
      • Allowing individuals to monitor processing (where possible)
      • Creating and improving security features on an ongoing basis.

This policy commits PPC to providing the necessary resources and support to ensure that its aims and objectives can be achieved. Procedures that describe the arrangements and processes for the implementation of this policy will be available on PPC’s website.

4. Responsibilities for data protection compliance

The Parish Clerk reports to Council and is responsible for:

  • Ensuring the objectives of the GDPR and related legislation (including the Smaller Authorities Proper Practices Practitioners’ Guide 2025) is achieved;
  • Assisting PPC with its compliance and maintaining standards of good practice;
  • Providing advice to PPC for the resolution of queries and maintaining the accuracy of PPC’s internal record of processing activities and keeping it up to date;
  • Managing data protection and security policies, procedures, and documentation;
  • Arranging training opportunities for relevant councillors and staff;
  • Conducting regular data audits to identify what personal data is held, how it is used and make sure it is processed lawfully and reporting findings.

Managers have overall responsibility for ensuring that personal data held within their area is managed in a way which meets the aims of this policy and complies with the requirements of the GDPR and DPA. They should ensure that all staff responsible for managing personal data are appropriately briefed, trained or experienced and understand the need for data protection compliance.

It is the responsibility of managers to ensure that anyone who is sub-contracted or employed on a temporary or voluntary basis are made aware of this policy and any relevant supporting procedures.

Where personal data are disclosed to our service providers or anyone else acting on our behalf, there must be a written contract in place that includes the requirement for them to comply with the GDPR and DPA (in particular, the security principle).

All councillors and staff: everyone who creates, receives and uses or discloses personal data while working (paid or unpaid), has responsibilities under this policy and to comply with requirements of the GDPR, DPA and related legislation.

5. Breaches of this policy and data protection legislation

Disciplinary action, including dismissal, may be taken against any member of staff who contravenes this policy and supporting procedures. The Parish Clerk, in consultation with the Chair of the Council, has authority to take such immediate steps as considered necessary.

6. Links to other policies and procedures

This policy is linked to the following policies and information which will be available on the Council’s website:

  • Chapter 13 – Access to Information Policy
  • Chapter 14 – Information Compliance Policy
  • Chapter 15 – Publication Scheme
  • Chapter 16 – Document Retention and Disposal Policy

7. Additional information and guidance

For guidance and enquiries relating to this policy, contact the Parish Clerk, who is responsible for managing data protection compliance.

Additional guidance on data protection and related legislation is available on the Information Commissioner’s website: www.ico.gov.uk. Alternatively, the ICO can be contacted by post, telephone or email:
Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF.
Helpline telephone number: 01625 545745
Email: casework@ico.org.uk