Privacy notice

Coronavirus (COVID-19): update to our privacy notice 

We have updated our privacy notice to explain how we will be using your personal data during the Coronavirus (COVID-19) pandemic.

See further information about changes to services.

We are committed to protecting your privacy when you use our services.

Bournemouth Borough Council, Christchurch Borough Council and Borough of Poole Council are working together as we prepare for the new BCP Council. During this period of transition, we will share relevant personal information to ensure your services are delivered smoothly from 1 April 2019. We are permitted to do this by law in The Bournemouth, Dorset and Poole (Structural Changes) Order 2018.

Privacy and your personal information

The council must look after your personal information by law. The main law that applies to protecting your information is:

  • General Data Protection Regulation (GDPR)
  • Data Protection Act 2018 (DPA)
  • Human Rights Act (Article 8) (HRA)

Our information governance and information security policies are available below:

Our information governance and information security policies are available on our website(s) at:

The Data Protection Officer for BCP Council is Vivien Bateman, Head of Information Governance.


If you have any queries or concerns about how your personal information please contact us via: 

General privacy notice for the council

This is our general Privacy Notice, which provides an overview of how we use and protect your personal information. For our service specific privacy notices, which provide additional information, please use the links from this web page to the service or services you are interested in.

What is personal information and what do you hold? 

Personal data only includes information relating to living people who:

  • can be identified or who are identifiable directly from the information in question; or,
  • who can be indirectly identified from that information, in combination with other information. 

Personal information includes, for example:

  • name
  • address
  • date of birth
  • National Insurance Number
  • Council Tax information
  • benefit entitlements
  • financial information, including bank details
  • housing information
  • licensing information

However, personal information must also relate to and concern an individual in some way; that is, it must be directly about and personal to the individual and their activities.

Special category information

Some information is known as “special category” data and is given more protection by the law, because of its confidential or sensitive nature. It is information that is likely to be very personal to you and will include:

  • race
  • ethnic origin
  • political opinions or affiliation
  • religious or other spiritual beliefs
  • trade union membership
  • genetics
  • biometrics (where used for ID purposes)
  • physical or mental health
  • sex life
  • sexual orientation
  • criminal offences, alleged offences or convictions

The categories or type of personal information we hold about you will vary according to the services you receive. You will provide a lot of this information to us yourself, but we will also obtain information from and share it with other individuals and public and private organisations (providers/contractors) that we work with.

What purposes do you use personal information for?

We collect and use your personal information to:

  • deliver services and support to you and manage those services
  • investigate concerns or complaints you may have
  • process claims you may have made
  • pay, manage and train our employees
  • check the quality of our services, which may include conducting surveys
  • prepare financial information and manage our spending
  • prepare statistical information for reporting purposes
  • undertake research to help to improve our services and plan future service delivery 

The GDPR specifically says that we can use your personal information for the following additional purposes, because they are well-matched with the original purpose or purposes that we collected and used it for:

  • archiving purposes in the public interest
  • scientific and historical research purposes
  • statistical purposes

What does the law say about using personal information?

We have a broad range of Acts and Regulations that require or allow us to deliver services to you. Some of the legislation covers the whole council, for example Local Government Acts. Other legislation is specific to areas of service delivery, for example housing, planning, environment, education, children and adult social care Acts and Regulations.

This law gives us powers to collect and use your personal information.

As well as this law, we must also meet reasons or “conditions” that are in the GDPR/DPA 2018. 

Conditions for personal information that is not “special category”:

The conditions that will most often apply to the council are:

  • Public task: the processing is necessary for us to perform a task in the public interest or for our official functions, and the task or function has a clear basis in law
  • Contract: the processing is necessary for a contract we have with you, or because you have asked us to take specific steps before entering into a contract with you
  • Legal obligation: the processing is necessary for us to comply with the law (not including contractual obligations) 

There are other conditions that we may also use. These are:

  • Consent: you have given consent for us to process your personal data for a specific purpose, or purposes
  • Vital interests: the processing is necessary to protect someone’s life.

Extra conditions for “special category” information:

There are extra reasons or conditions that apply for this category of information. The conditions that will most often apply to the council are:

  • Health or social care: the processing is necessary for the purposes of preventive or occupational medicine, for the assessment of the working capacity of the employee, medical diagnosis, the provision of health or social care or treatment or the management of health or social care systems and services
  • Employment, social security or social protection: the processing is necessary for the carrying out of obligations under employment, social security or social protection law 
  • Legal purposes: the processing is necessary for the establishment, exercise or defence of legal claims or whenever courts are acting in their judicial capacity 
  • Public interest: the processing is necessary for reasons of substantial public interest 
  • Public health: the processing is necessary for reasons of public interest in the area of public health, such as protecting against serious cross-border threats to health or ensuring high standards of quality and safety of health care and of medicinal products or medical devices

There are other conditions we may also use. These are:

  • Consent: you have given explicit consent to the processing of your personal information for one or more specified purposes
  • Vital interests: the processing is necessary to protect your life or the life of any other person, where you are physically or legally incapable of giving consent

If you want to find out more about these reasons or conditions, please refer to the Information Commissioner’s website:

Do you always need consent to obtain and use personal information and can consent be withdrawn?

We do not often need to use consent, because we have other conditions or reasons that we can use that we have explained in this Notice. However, even if we do not use consent because we use other conditions, we will usually tell you about what we are doing with your personal information, which we will normally do through our Privacy Notices.

This does not mean we will never use consent. There will be times when it is necessary, or where we can still reasonably use consent and think it is best practice.

If we have obtained consent to use your personal information you have the right to withdraw it at any time. If a service delivery area is using consent as a condition to collect and use your information its Privacy Notice will tell you how you can withdraw your consent.

Who do you obtain information from and share it with?

A lot of the personal information we obtain and use we will get directly from you, but we also work with a broad range of other public, voluntary and private sector organisations. Our service area specific privacy notices will tell you which categories of organisations or agencies that information may be shared with by those areas, so their services can be delivered to you. 

If we have obtained consent to use your personal information we may provide more detailed information about the organisations or agencies that we want to share information with.

Can you share my information without telling me?

Yes. There are some circumstances where we can lawfully share information and we are not obliged to tell you. These circumstances are known as “exemptions”. The exemptions we are most likely to use are for the purposes of:

  • crime prevention or detection (including fraud)
  • legal proceedings, or by Order of the courts
  • meeting an obligation by law; that is, we are obliged by law disclose information
  • regulatory functions that we are responsible for and which provide us with enforcement powers

What rights do I have relating to my personal information?

The law gives you rights relating to your personal information. These are:

  • the right to be informed (Privacy Notices)
  • the right of access
  • the right to rectification
  • the right to erasure
  • the right to restrict processing
  • the right to data portability
  • the right to object
  • rights in relation to automated decision making and profiling

The rights that are most likely to apply to the relationship you have with the council are briefly explained below, but to find out more about all of your rights and how to exercise them please refer to the Information Commissioner’s Office website:

Access to your information

You have the right to ask for the personal information we hold about you. There is no charge for this service. Your request must be in a written format, for example by letter, email, or our online form.

There may be some information we hold about you that you will not be able to see. This will usually be if your data includes information about another individual, unless

  • the other individual has agreed to the disclosure, or
  • it is reasonable to provide you with this information, without the other individual’s consent.

We can refuse to comply with a subject access request if it is manifestly unfounded or excessive.

If you cannot make a request in written format please tell us, so that we can help you to make a request. If you have any general queries about how to access your information you can contact the Information Governance Team.

Correcting information you think is inaccurate (rectification):

You can challenge the accuracy of personal data held about you by us and ask for it to be corrected or deleted. If your data is incomplete, you can ask us to complete it by adding more details. You don’t have to ask a specific person – you can contact any part of the council with your request.

Erasure (right to be forgotten):

You can ask for your personal information to be erased (deleted), but this is not an absolute right.

Restricting processing:

You have the right to ask us to restrict what we use your personal information for in certain circumstances, but again this is not an absolute right.

How long do you keep personal information for?

For some of the information we hold there is legislation that sets out how long we must keep it for; we have to keep some types of information for very long periods of time. Where there is no legislation, the length of time we keep information will be based on our business needs and best practice guidance.

Our service specific privacy notices provide more information about how long we retain information in the different areas of service delivery. 

How do you keep personal information safe? 

We must keep your information safe and secure. To find out more please refer to our Information Security policy. 

Do you transfer personal information outside of the UK?

Most of your personal information is stored on systems in the UK, but there may be some occasions where your information leaves the UK. This may be because it is stored in a system outside of the European Economic Area (EEA), or we need to send it to an organisation that is outside of the EEA. 

We must have additional protections on your information if it leaves the UK. These range from secure ways of transferring data, to making sure we have robust contracts in place with organisations who hold information for us. 

National Fraud Initiative

BCP Council is engaged with the National Fraud Initiative which is an exercise that matches electronic data between public and private sector bodies to prevent and detect fraud. This is a government backed initiative to protect public funds. If you would like to know how your information is used in this initiative please go to NFI Privacy

Who can I make a complaint to, or get further advice from? 

If you wish to make a formal complaint about how your personal information has been used, we would encourage you contact us first through our complaints procedure. 

You can also seek independent advice and/or submit a complaint about data protection, privacy and data sharing issues directly to the Information Commissioner’s Office (ICO) at: 

Information Commissioner's Office
Wycliffe House
Water Lane
Cheshire, SK9 5AF 



Tel: 0303 123 1113(local rate) or 01625 545 745 (national rate)

Preceding authority privacy sections:

Page last updated: 19 November 2021
Help us improve
This is just for feedback on our website, not comments or questions about our services. Feedback on services will not be passed on. To tell us anything else, contact us.

Please don't include any personal or financial information.

Privacy notices

Adult Social Care Services privacy notices

Bereavement services privacy notice - BCP

Bournemouth and Poole learning disability partnership board privacy notice 

Building consultancy services privacy notice 

Children's Services privacy notice

Commissioning and improvement - people services quality team

Commissioning and improvement - people services - Adult Social Care Complaints Service privacy notice

Commissioning and improvement – People Services learning and development privacy notice 

Commissioning and improvement - people services troubled families programme privacy notice

Commissioning and Improvement - People Services - UP2U privacy notice

Communities and enforcement privacy notice - BCP

Communities privacy notice - BCP

Community enforcement privacy notice - BCP

Concessionary fares bus pass privacy notices

Coronavirus (COVID-19) pandemic privacy notice

CPD Online service privacy notice 

Culture Volunteers Poole privacy notice

Democratic services privacy notice

Development services privacy notice

Disabled facilities grant service privacy notice

Dorset care record (DRC) information and privacy notice 

Dorset homechoice privacy notice

Electoral services privacy notice 

Emergency planning privacy notice

Environmental Services - Garden waste collection service privacy notice 

Housing options privacy notice - BCP

HR Recruitment privacy notice - BCP

Insight team privacy notice

Local Land Charges privacy notice

Parking services privacy notice

Parks privacy notice - BCP

Planning Services privacy notice - BCP

Poole bereavement services privacy notice

Poole children's centres volunteering team privacy notice - BCP

Poole integrated community mental health teams adult (18-64) and older persons privacy notice 

Provision of the financial wellbeing service privacy notice 

Regulatory services privacy notice - BCP

Restorative Dorset privacy notice

Revenue and Benefits privacy notice

Risk Management and Insurance privacy notice

Safer Communities team privacy notice

Skills for care’s national minimum data set for social care privacy notice

Taxi Licensing privacy notice

Telecare services, Bournemouth Careline and Poole Lifeline - BCP 

Tourism services privacy notice

Virtual school privacy notice - BCP