The General Data Protection Regulation (GDPR) and the Data Protection Act 2018 apply in the UK and work together to govern the processing of personal data. They place duties on organisations on how they collect, process, store and disclose information about people. It also gives individuals (data subjects) the right of access to information held about themselves.
You can ask to see any information we hold about you as part of the General Data Protection Regulation. This is called a subject access request.
There may be some occasions when an exemption would apply from providing the information and if this is the case then we will write to you and let you know why.
- to ask us to remove data we hold about you or limit our use of it - this right is not absolute and we may not be able to comply with your request unless the following specific circumstances apply:
- Your personal data is no longer necessary in relation to the purpose for which it was originally collected and processed.
- You withdraw consent we have relied upon.
- You object to the processing of your information and there is no overriding legitimate interest for continuing the processing.
- Your personal data was unlawfully processed.
- Your personal data has to be erased in order to comply with a legal obligation.
- to data portability - the right to obtain and reuse your personal data for your own purposes across different services only applies where the processing is based on your consent or for the performance of a contract, and when processing is carried out by automated means.
- not to be subject to automated decision-making, including profiling - this right only applies where the decision is based on automated processing and it produces a legal effect or has a similarly significant effect on you.
You can make a request to:
- rectify an inaccurate record
- erase a record or to restrict processing
- object to processing
- request portable data
- cease automated decision-making and/or profiling
For further information about your rights, including the circumstances in which they apply, see the guidance from the UK Information Commissioner's Office (ICO) on individuals’ rights under GDPR.
If you would like to exercise a right, please contact the Information Management team at firstname.lastname@example.org.
On receiving your request, we will get back to you with a timescale for carrying it out. If we aren't able to comply with your request for any reason we will explain why.
- Data Protection Policy V3 21 August 2020 [docx] 57KB
Data Protection Policy [HTML version]
- Records and Retention Policy V2 25 September 2018 [pdf] 60KB
Records and Retention Policy [HTML version]
Directorate record retention schedules
- Environment and Communities directorate records retention schedule (updated 13 July 2022) [pdf] 108KB
- Organisational Excellence directorate records retention schedule (updated 18 April 2023) [pdf] 132KB
- Growth directorate records retention schedule (updated 6 June 2023) [pdf] 145KB