Common data sets and how to administer in compliance with GDPR

  • Allotments - we only contact the holders once a year to renew their ownership and send an invoice. Occasionally we send information about changes in terms and conditions (eg no hosepipes in the summer). OK - these are low risk data sets and you are infact handling them under a service contract effectively. There is no need to change anything - you will want to highlight you have a privacy notice on your website should they wish to check what you hold about them and how you manage it. You might want to include this in any communications with them as standard. However, if you had an allotment available and you wanted to market this to existing holders this means you would need their consent to use their contact information for these purposes. There is a difference.
  • Burial records - Ditto above.
  • Quarterly newsletter - yes you need to get consent if it contains marketing information.
  • Minutes - the majority of Council business is in the public interest, eg communications about planning applications, minutes of meetings etc., should be administered in the usual way. If you are unclear on best practice regarding minute taking contact the SALC team for guidance.

Dont forget:

  • computer virus software should be up to date.
  • Check in with your insurance company - ask if there are any more requirements they expect of you in relation to GDPR.
  • Be aware of attachments in emails that have personal data - password protect them or consider using encryption tools.
  • Audit your HR practices and documentation - update employment contracts in relation to GDPR to include employee rights. Include in the handbook or policies what personal data is for your council and the penalties associated with its loss. Employees should be made aware about the importance of data protection and expected standards of behaviour in relation to information security. So include privacy, IT usage, email management, use of social media, what a data breach is and how and when it must be reported.

Click here to return to the main page