Information and Data Protection policy
May 2026
Introduction
In order to conduct its business, services and duties, Stoke Poges Parish Council processes a wide range of data relating to its own operations and some which it handles on behalf of partners. In broad terms, this data can be classified as:
- Data shared in the public arena about the services it offers, its mode of operations and other information it is required to make available to the public.
- Confidential information and data not yet in the public arena such as ideas or policies that are being developed.
- Confidential information about other organisations because of commercial sensitivity.
- Personal data concerning its current, past and potential employees, Councillors and volunteers.
- Personal data concerning individuals who contact it for information, access services or facilities, or make a complaint.
Stoke Poges Parish Council will adopt procedures and manage responsibly all data which it handles and will respect the confidentiality of both its own data and that belonging to partner organisations and members of the public. In some cases, it will have contractual obligations towards confidential data, and in addition will have specific legal responsibilities under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.
Stoke Poges Parish Council will periodically review and revise this policy in light of experience, comments from data subjects and guidance from the Information Commissioner’s Office (ICO).
The Council will be as transparent as possible about its operations and will work closely with public, community and voluntary organisations. In the case of all information which is not personal or confidential, it will be prepared to make it available to partners and members of the Parish community. Details of information which is routinely available are contained in the Council’s Publication Scheme based on the statutory model publication scheme for local councils.
Protecting Confidential or Sensitive Information
Stoke Poges Parish Council recognises it must at times keep and process sensitive and personal information about employees and the public. It has therefore adopted this policy not only to meet its legal obligations but to ensure high standards of practice.
The UK GDPR, alongside the Data Protection Act 2018, seeks to strike a balance between the rights of individuals and the legitimate interests of organisations such as the Parish Council in using personal information.
The policy is based on the principle that personal data must be:
- Processed fairly, lawfully and in a transparent manner in relation to the data subject.
- Collected for specified, explicit and legitimate purposes and not further processed in a manner incompatible with those purposes.
- Adequate, relevant and limited to what is necessary for the purposes for which it is processed.
- Accurate and, where necessary, kept up to date.
- Kept in a form which permits identification of data subjects for no longer than is necessary.
- Processed in a manner that ensures appropriate security, including protection against unauthorised or unlawful processing and against accidental loss, destruction or damage, using appropriate technical or organisational measures.
Data Protection Terminology
Data subject - the person whose personal data is being processed (e.g. employee, Councillor, volunteer, service user or member of the public).
Personal data - any information relating to an identified or identifiable natural person, such as name, address, email, telephone number, date of birth, IP address or financial details.
Sensitive personal data - includes information such as racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, health data, sex life, sexual orientation, and genetic or biometric data.
Data controller - the person or organisation which determines the purposes and means of processing personal data (Stoke Poges Parish Council).
Data processor - a person or organisation which processes personal data on behalf of the data controller.
Processing - any operation performed on personal data including collection, recording, organisation, structuring, storage, alteration, retrieval, consultation, use, disclosure, restriction, erasure or destruction.
Stoke Poges Parish Council processes personal data in order to:
- Fulfil its duties as an employer and comply with employment law.
- Carry out its statutory and public functions as a Parish Council.
- Manage contractual relationships with third parties.
- Monitor and improve service delivery, including equality and diversity.
- Maintain security and safeguard Council premises and services.
- Assist regulatory and law enforcement agencies where required.
- Administer Councillor, employee, volunteer and contractor records.
- Respond to enquiries, complaints and service requests.
- Undertake surveys, research and consultation.
- Carry out general Council administration..
Where appropriate and subject to safeguards, the Council may process data jointly with other public bodies.
The Council will ensure that at least one lawful basis applies for processing personal data, including:
- Consent of the data subject.
- Performance of a contract.
- Compliance with a legal obligation.
- Protection of vital interests.
- Performance of a public task.
- Legitimate interests of the Council (where appropriate).
For special category data, additional lawful conditions will be applied, including explicit consent or legal necessity.
Who is responsible for protecting a person’s personal data?
The Parish Council as a corporate body has ultimate responsibility for compliance with data protection legislation. Day-to-day responsibility is delegated to the Parish Clerk.
Contact details:
- Email: theclerk@stokepogesparishcouncil.gov.uk
- Phone: 01753 644803
- Address: The Parish Clerk, Stoke Poges Parish Council, The Village Centre, Rogers Lane, Stoke Poges, Bucks, SL2 4LP
Diversity Monitoring
Stoke Poges Parish Council monitors workforce and Councillor diversity to ensure equality of opportunity and compliance with equality legislation. This data is treated as confidential and is only accessed by authorised personnel. It will not be used in selection decisions.
Anonymised data may be used for reporting and monitoring purposes.
The Council will ensure individuals are informed of their rights through Privacy Notices and that personal data is processed in accordance with UK GDPR principles. Appropriate technical and organisational measures will be in place to protect personal data.
Personal data will not be transferred outside the UK or European Economic Area unless adequate protection is ensured in line with UK GDPR requirements.
Information provided to us
Personal information provided (such as name, address, email or telephone number) will be processed to allow the Council to respond to requests, provide services or complete transactions.
By engaging with the Council, individuals consent (where applicable) to their data being processed in accordance with this policy. Where required, explicit consent will be obtained.
Individuals are responsible for ensuring their personal data is accurate and up to date.
Lawful Basis for Processing Information
Processing is carried out under UK GDPR Article 6(1):
- Consent of the data subject.
- Compliance with a legal obligation.
- Performance of a public task or legitimate interests of the Council.
Information Security
The Council takes appropriate technical and organisational measures to protect personal data against loss, misuse, unauthorised access, alteration or disclosure.
Personal data is retained only for as long as necessary and is securely deleted or destroyed when no longer required.
Children
The Council will not knowingly process personal data relating to children under 13 without appropriate consent from a parent or guardian.
Rights of a Data Subject
Individuals have the right to:
- Access their personal data.
- Request correction of inaccurate data.
- Request deletion of personal data (where applicable).
- Object to processing.
- Lodge a complaint with the Information Commissioner’s Office (ICO).
The Council does not use automated decision-making or profiling.
Making Information Available
The Council operates a Publication Scheme under the Freedom of Information Act 2000. This promotes transparency and allows routine access to information without formal requests.
Meetings of the Council are held in public unless confidential matters are being discussed under exempt provisions.
The Council complies with the Openness of Local Government Bodies Regulations 2014, including recording of delegated decisions where required.
The Council may also support filming, recording or reporting of meetings in accordance with legislation, provided it does not disrupt proceedings.
Reasonable adjustments will be made for individuals with accessibility needs.
Disclosure Information
The Council undertakes appropriate Disclosure and Barring Service (DBS) checks where required and complies with DBS Code of Practice regarding handling and retention of disclosure information.
Data Transparency
The Council will act in accordance with the Code of Recommended Practice for Local Authority Transparency and will publish relevant public data including:
- Annual accounts and governance statements
- Internal audit reports
- Councillor responsibilities
- Public land and asset registers
- Draft minutes within one month
- Agendas and reports in advance of meetings