The Data Protection Act 2018

In accordance with the General Data Protection Regulation (GDPR), the Data Protection Act 2018 came into force on May 25, 2018. The principles are broadly similar to the pre-existing Data Protection Act 1998. However, the new Act has changed how we handle and maintain your information.

For more information about the Data Protection Act 2018 you can refer to the Information Commissioner's website.

Your rights under the Act

You have the following rights:

The right of access – The Data Protection Act 2018 gives you the right to ask us for a copy of the personal information that we hold about you for the purposes of providing services to you. You are also entitled to additional information including:

  • the identity and contact details of the controller and Data Protection Officer
  • the purposes of the processing and the legal basis
  • your additional rights in respect of the data
  • your right to complain
  • the categories of personal information
  • who your data has been with and will be shared with
  • data source - where the data has not been collected directly from the data subject

This is known as a Subject Access Request (SAR). There is no charge. Make sure you enclose the appropriate identity to ensure the security of your personal information.

When an appropriate application is made using our data request form (pdf, 245kb) we are required to provide you with the information, subject to any exemptions, within 30 days of verification.

The right to rectification - The Data Protection Act 2018 gives you the right to have inaccurate and incomplete personal data held about you rectified, known as ‘data rectification’. You can provide a supplementary statement detailing what information requires rectification, for example, misspellings and incorrect or out of date personal data.

The right to erasure - The Data Protection Act 2018 gives you the right to have your data erased, for example:

  • data that is no longer necessary and unrelated to the original purpose it was collected for
  • is of no legitimate interest to continue processing the data
  • the data is being used for direct marketing, without your consent.  You can object to the processing of the data
  • withdrawing consent where data was collected for lawful basis purposes and you no longer give consent

Please note that the Council may not be able to process your request if it is subject to a legal obligation compliancy. In the event of this, we will contact you.

The right to restrict and object to processing - The Data Protection Act 2018 gives you the right to restrict the processing of your personal data, which can include the following:

  • the data has been unlawfully processed
  • if the data is contested as being inaccurate and requires verification
  • a legitimate objection preventing the processing of restricted information

The right to data portability - The Data Protection Act 2018 gives you the right to request for you to use your personal data across different services.

This is known as the ‘right to data portability’.

Please note that you are only able to request for your personal information to be transferred if the information:

  • is processed for a contract
  • is processed based on your consent
  • is processed automatically
  • was provided to the Council by you

Rights in relation to automated decision making and profiling – you have the right to challenge a decision that affects you and has been made automatically without human intervention. For example, an online form with an instant decision.

Please complete the data request form (pdf, 245kb)to assist in dealing with your request.

Validating your request

For your protection and the security of the data, we will need to confirm that you are the person whom the data is about, and will require proof of your identity before we process the request. If you are acting on behalf of someone else, the Council will need proof of this as well as proof of your identity.

We may also need to contact the data subject to confirm that they have authorised you to act on their behalf.

If you have not provided the relevant proof of identity and consent with the form, it will need to be provided before we can process your request for information.

Once your request has been validated, the Council will have 30 days to respond to your request. However, if your request is complex or numerous, the Council may require a further two months, which will be communicated with you.

Please send completed application forms to:

dataprotection@southderbyshire.gov.uk

Or

South Derbyshire District Council
Civic Offices
Civic Way
Swadlincote
Derbyshire
DE11 0AH

If you have any queries, you can get in touch with our Data Protection Officer by calling 01283 595795.

Please note: We ask that you keep us informed – by email, telephone or in writing – of any changes in your personal data so that we can keep our records up to date at all times.

Data Protection Complaints and Concerns

We take the protection of personal information seriously. If you are concerned about how the Council has handled your personal data, you can contact us and we will look into it.

This page explains:

  • what counts as a data protection complaint or concern
  • how to raise it with us
  • what happens next and how long it takes
  • what to do if you are not satisfied with our response

What is a data protection complaint?

A data protection complaint (or concern) is where you think the Council may have:

  • used your personal information unfairly or unlawfully
  • shared your personal information with someone who should not have received it
  • kept your personal information longer than necessary
  • failed to keep your information secure
  • recorded inaccurate information and not corrected it
  • not handled your information in line with your data protection rights

If you are unsure, you can still contact us — we will route your enquiry to the right team.

Before you contact us

To help us deal with your complaint quickly, please provide:

  • your full name and contact details
  • the service area involved (if known)
  • a clear description of what happened and when
  • what personal information you believe is affected
  • what outcome you are seeking (for example, an explanation, correction, restriction, apology, or reassurance)

Please do not send original identity documents (e.g., passports) unless we ask you to.

How to submit a data protection complaint

You can raise a data protection complaint in any of the following ways:

Email: dataprotection@southderbyshire.gov.uk
Telephone: 01283 595795
Post: Data Protection, South Derbyshire District Council, Civic Offices, Civic Way, Swadlincote, Derbyshire, DE11 0AH

If you contact a service area directly, they may still refer your complaint to the Information Governance team to ensure it is logged and handled correctly.

What happens after you submit a complaint

We will:

  1. Acknowledge your complaint and log it so it can be tracked.
  2. Clarify any missing information, if needed, to ensure we understand your concern.
  3. Ask the relevant service area to check their records and provide information.
  4. Review the response to make sure it addresses the data protection issues raised.
  5. Write to you with the outcome, including any actions we have taken or will take.

The Council’s Information Governance / Data Protection team provides advice and assurance. The relevant service area remains responsible for the underlying decision-making and operational handling of records.

Timescales

We aim to respond to data protection complaints within 30 calendar days of receipt.

If your complaint is complex or we need further information from you, we will tell you as early as possible and explain the reason for any delay.

Outcomes you can expect

Depending on what we find, outcomes may include:

  • an explanation of how and why your information was used
  • confirmation of what checks have been carried out
  • correction of inaccurate information (where appropriate)
  • steps to improve how we handle your information
  • staff reminders, training, or process changes
  • an apology (where we have got things wrong)

What this process is not

If you contact us using the wrong route, we will signpost you to the correct process.

If you are not satisfied

If you are unhappy with our response, please tell us what you feel has not been addressed and we will review it.

You also have the right to raise your concern with the Information Commissioner’s Office (ICO), the UK’s independent data protection regulator.

For independent advice about data protection, privacy and data sharing issues, you can contact the Information Commissioner’s Office (ICO) at:

Post: Information Commissioner's Office Wycliffe House Water Lane Wilmslow Cheshire SK9 5AF

Telephone: 0303 123 1113 (local rate) or 01625 545 745 (national rate number).

Email: casework@ico.org.uk  

Further guidance on the use of personal information can be found at www.ico.org.uk

Data Protection Policy

We will publish our updated Data Protection Complaints Policy on this page in due course.

More Information

For more information on how your data is processed please see the Council’s Privacy Notices: Data, privacy and cookies | South Derbyshire District Council