Data protection policies
Hillingdon Council's Cabinet approved a range of policies on 24 May 2018, which are designed to ensure that the council continues to take proper care of residents' personal data.
The council is required by law to publish a privacy notice. Individuals have the right to be informed about the collection and use of their personal data. This is a key transparency requirement under the GDPR. The council is therefore required to provide individuals with the type of information contained within this Notice and this is known as 'privacy information'.
Data Protection Policy
Ourprovides important information about how we keep data safe and secure and other responsibilities necessary to meet the requirements of the DPA and the GDPR.
Individual Rights Policy
The GDPR introduces the following rights for individuals:
- The right to be informed
- The right of access
- The right to rectification
- The right to erasure
- The right to restrict processing
- The right to data portability
- The right to object
- The right not to be subject to automated decision making including profiling
Please see below to find out more information about how to make a request.
Subject Access Policy and Procedure
The Data Protection Act 2018 gives individuals the right to request copies of all their personal data processed by Hillingdon Council.
Information Governance Policy
Oursets out the framework by which the council handles information. It applies to sensitive and personal information of residents and employees and also to information related to the business of the council.
The 'lawful basis for processing'
Your personal data may only be used by us if there is a clearfor doing so.
There are six types of lawful basis under GDPR:
- Legal obligation
- Necessary to protect the vital interests of the individual or of another person
- Necessary to perform a public task or to exercise official authority
- Necessary because of legitimate interests
Managing an information security breach
Any suspected breach of personal data must be investigated immediately and, if sufficiently serious, must be reported to the Information Commissioner's Office within 72 hours.
Data protection impact assessments
When the council makes changes to services which might affect the control of personal data it must carry out a.
Retention and Destruction of personal data
Personal data should not be kept any longer than is necessary.