Adopted: 21 September 2026  |  Review Date: September 2027

A legitimate interest assessment written under the retained EU law version of the General Data Protection Regulation ((EU) 2016/679) (the “UK GDPR”), as it forms part of the law of England and Wales, Scotland, and Northern Ireland by virtue of section 3 of the European Union (Withdrawal) Act 2018 and Data Protection Act 2018 for processing of personal data for the purposes of taking photographs of the public at council events.

Based on the ICO template.

Part 1: Purpose test

To assess whether there is a legitimate interest behind the processing.

  • Why do you want to process the data?
    • The council wishes to maintain a record of people visiting its premises to support site security, assist with emergency evacuations and investigate any security, safety or other incidents.
  • What benefit do you expect to get from the processing?
    • Visitor records will enable the council to know who is present within its premises. They will help the council respond effectively to emergencies and provide an appropriate level of security for staff, visitors, information and property.
  • Do any third parties’ benefit from the processing?
    • Visitors, council employees, contractors and other people using the premises benefit from improved safety and security. Emergency services may also benefit from accurate information about who may be present during an emergency.
  • Are there any wider public benefits to the processing?
    • The processing supports the safe and secure operation of council premises and helps protect public assets, information and services.
  • How important are the benefits that you have identified?
    • The benefits are important. The council has a legitimate need to protect its staff, visitors, information, equipment and premises and to respond effectively to emergencies and security incidents.
  • What would the impact be if you couldn’t go ahead with the processing?
    • The council might not know who was present during an emergency or incident. This could make evacuations, welfare checks and investigations more difficult. It could also increase the risk of unauthorised access to restricted areas, information or council property.
  • Are you complying with any specific data protection rules that apply to your processing (eg profiling requirements, or e-privacy legislation)?
    • N/A
  • Are you complying with other relevant laws?
    • N/A
  • Are you complying with industry guidelines or codes of practice?
    • N/A
  • Are there any other ethical issues with the processing?
    • No significant ethical issues have been identified, only the minimum necessary information is recorded, access to the records is restricted and the information is securely deleted when it is no longer required.

Part 2: Necessity test

To assess whether the processing is necessary for the purpose identified.

  • Will this processing actually help you achieve your purpose?
    • Recording visitors provides the council with an accurate or reasonably accurate account of who is present or has accessed its premises.
  • Is the processing proportionate to that purpose?
    • Yes
  • Can you achieve the same purpose without the processing?
    • Not effectively
  • Can you achieve the same purpose by processing less data, or by processing the data in another more obvious or less intrusive way?
    • No

Part 3: Balancing test

To consider the impact on individuals’ interests and rights and freedoms and assess whether this overrides our legitimate interests.

Nature of the personal data

  • Is it special category data or criminal offence data?
    • Visitor records are not intended to contain special category or criminal offence data.
  • Is it data which people are likely to consider particularly ‘private’?
    • A person’s name, organisation, arrival and departure times and the identity of the person visited may be regarded as private, particularly where the record reveals an association or meeting that the person would not expect to be disclosed.
    • The records will therefore be treated as confidential and will not be made available to other visitors or the general public.
  • Are you processing children’s data or data relating to other vulnerable people?
    • Visitor records may include children or vulnerable people who enter council premises.
  • Is the data about people in their personal or professional capacity?
    • Members of the public may visit in a personal capacity, while employees of other organisations, councillors, contractors and suppliers may visit in a professional capacity.

Reasonable expectations

  • Do you have an existing relationship with the individual?
    • The council will have an existing relationship with some visitors, including staff, councillors, contractors, suppliers and regular service users. It may have no previous relationship with other visitors.
  • What’s the nature of the relationship and how have you used data in the past?
    • The council may previously have processed the visitor’s information in connection with council services, meetings, contracts or correspondence. Visitor-record information will be used only for premises management, safety, security, emergency response and the investigation of relevant incidents, unless another use is required or permitted by law.
  • Did you collect the data directly from the individual? What did you tell them at the time?
    • The information will normally be collected directly from the visitor when they arrive
  • If you obtained the data from a third party, what did they tell the individuals about reuse by third parties for other purposes and does this cover you?
    • N/A
  • How long ago did you collect the data? Are there any changes in technology or context since then that would affect expectations?
    • Visitor information will be collected at or shortly before the visit.
  • Is your intended purpose and method widely understood?
    • Yes, it is widely understood
  • Are you intending to do anything new or innovative?
    • No
  • Do you have any evidence about expectations – eg from market research, focus groups or other forms of consultation?
    • No
  • Are there any other factors in the particular circumstances that mean they would or would not expect the processing?
    • No

Likely impact

  • What are the possible impacts of the processing on people?
    • Minimal impact to people
  • Will individuals lose any control over the use of their personal data?
    • Visitor records will not be published or routinely disclosed to third parties.
  • What is the likelihood and severity of any potential impact?
    • Minimal impact
  • Are some people likely to object to the processing or find it intrusive?
    • Yes some will object and find it intrusive
  • Would you be happy to explain the processing to individuals?
    • Yes
  • Can you adopt any safeguards to minimise the impact?
    • Visitor records will be retained for 1 day unless a particular record is required for longer because of an accident, security incident, safeguarding concern, complaint, insurance matter, legal claim or regulatory investigation.

Can you offer individuals an opt-out?            No

Outcome
Can you rely on legitimate interests for this processing? Yes
Do you have any comments to justify your answer? (optional)  
LIA completed by:  
Date: