Skip to main content

Data protection policy

Everyone has rights under the Data Protection Act of 2018, which incorporates the General Data Protection Regulation (GDPR), to access personal information held about them by the council.

They also have other rights, some of which are conditional, relating to their personal information ranging from the right to be informed, to ask us to update incorrect or incomplete details, to object to or restrict processing of it, to ask us to delete your information, to ask us to share it with another party or to make a complaint.

We are committed to the objectives of the Data Protection Act and hereby declare our intention that all personal information held by the council will be treated in confidence and held and used only in accordance with the terms of the act and other applicable legislation.

We will, wherever possible, seek to do more than the minimum required by law, attempting to comply with the spirit of the legislation as well as the letter at all times. We will be open about the type and extent of personal data we hold. We will keep the minimum amount of personal information needed to perform our duties and will hold that information securely, use it only for appropriate purposes, not disclose it without proper authority and when it’s no longer required for the purpose it was obtained we will securely destroy the information.

The council expects all of its employees to comply fully with this policy and the principles of the Data Protection Act and will provide training and advice necessary to enable employees to do this. Deliberate breaches of this policy will be considered as gross misconduct and will render the employee liable to disciplinary action up to and including dismissal. Individuals, as well as the council, can be prosecuted for breaches of the Act.

Our data protection officer (DPO) is responsible for informing and advising the council and its employees and elected members of our obligations to ensure compliance with the Data Protection legislation. They will also monitor our compliance with data protection legislation and our policies, including, where required, the assignment of responsibilities, awareness-raising and training of staff involved in processing personal information and the related audits.

It is, however, the responsibility of each elected member and every employee to be aware of their individual and collective responsibilities under the Data Protection legislation and to make sure they comply with its provisions.

The DPO will on behalf of the council also:

  • ensure the council, its other relevant functions and elected members are registered with the Information Commissioner’s Office as Data Controllers according to the Data Protection legislation
  • ensure the council has created and maintains an adequate record of its personal data processing activities
  • provide advice where requested regarding the data protection impact assessment (DPIA) process and monitor our performance against the process
  • be our contact point for the Information Commissioner’s Office and cooperate with them regarding the reporting and investigation of serious data breaches, the prior consultation regarding high risk processing identified by a DPIA or with regard to any other matter

We will provide any person requesting it in the proper manner a response stating whether or not the council holds personal information about that individual and, if so, the opportunity to see the information and to have it corrected, completed or deleted if appropriate. Also the person may choose to request that our processing of the information is restricted, ask us to share it with another party or to make a complaint.

Persons may only request details about themselves and no other person. Should the request be considered frivolous or otherwise a deliberate waste of council resources, the request may be refused.


South Gloucestershire Council uses the Council Advertising Network (CAN) to deliver advertising across our website. The Council Advertising Network is a network of local authorities generating revenue from appropriately sourced advertising across their digital estates.

Read more about advertising on our website

Is there anything wrong with this page?