Exit Accessibility View

Data protection

There are strict regulations on what data we can collect and store, how we can use and process the data, who we are allowed to share with, and who we must pass data to when ordered to do so. 

You have the right to request information from us; we must reply to you within strict timescales giving you the information you asked for, or tell you why we cannot give the details because it is exempt.

The Data Protection Act 1998 (DPA) was put in place to help protect people's personal data.
It aims to ensure that people know where their data is:

  • Held
  • What it is used for
  • Who it is shared with

It also makes sure that an organisation treats people's data correctly and has systems in place for managing the information.

The DPA is a law that was introduced in order to comply with the European Directive 1995 and replaces the Data Protection Act 1984. It also amends or partially repeals other statutes.

The new act is the legal framework within which all organisations who are controllers of personal data must operate. It covers all data held about an individual (data subject) in both manual and computerised files.


Personal data is any information about an individual from which the individual can be identified:

  • Name
  • Address
  • Date of birth
  • Photograph
  • Video image
  • Payroll number, etc,
  • Personal information also includes any written opinions about the individual

As an individual you have rights regarding your own personal information. You have the right to:

  • Be informed about the use of your personal data
  • Gain access to, and receive a copy of your personal data.
  • Be told by whether we, or someone else on our behalf, is processing your personal data.
  • Request a copy of your personal information. (If the copy is not clear without an explanation, you should be given an explanation of the information, e.g. an explanation of codes used).
  • Have inaccurate data corrected
  • In instances where there may a difference of opinion about interpretation, sequence of events etc. Wiltshire council is normally happy to insert your version alongside the practitioner’s

You may also receive details of:

  • The source of the personal data, unless this would identify the source as an individual (see third party guidelines)
  • Why your personal data is being used
  • Other organisations whom the information is or may be shared with

Where information comes from or where it is sent can often be seen in the information itself, for example letters will indicate who they were sent to and where they came from.

You should also be told at the time we first start working with you the reasons why your information is being used, if you are ever in any doubt please ask.


You are entitled to apply for personal information recorded about you and/or your child by making a Subject Access Request under Section 7 of the Data Protection Act 1998. Please note you can only obtain information which is about yourself (or your child/ren if under the age of 14 when they may have capacity to apply in their own right). You have the right to request this from any organisation you believe is processing your information. Wiltshire Council makes no charge for this service, but you may find other authorities charge up to a maximum of £10.

If you wish to make any such application, please write to the Information Governance team or email to make your request to dataprotection@wiltshire.gov.uk. Please be as specific as you can about the information you seek as this helps us to find it as quickly as possible.

Before providing you with such sensitive information, the Information Governance team will need to see evidence to confirm your identity (this can be by scan or photocopy of a passport or driving licence or birth certificate) and address (similarly by scan/copy of a utility bill or official letter header). Your identity evidence will not be retained after it has been examined.

If you are seeking information from your child(ren)’s records, in addition we will need to see something to prove parental responsibility such as copies of the child(ren)'s birth certificates.

Please do not send original documents to the council offices as we cannot guarantee their safety.


As an individual many organisations will have your personal details for example

  • Your bank
  • The council
  • Insurance companies
  • Supermarkets and so on

Wiltshire council is committed to compliance with all requirements of the Data Protection Act 1998.

Wiltshire council regards the protection of people’s data as important, not only for improving confidence in the council but for improving the quality of service provided. The council is committed to openness and following the requirements of the Act will help to achieve this.

Wiltshire council will implement and follow procedures that aim to make sure all:

  • Employees
  • Elected members
  • Volunteers
  • Contractors
  • Agents
  • Consultants
  • Partners
  • Other persons that have access to personal data held by or on behalf of the council are made aware of their responsibilities and fulfill their duties under the Act

Personal data must be:

  • Fairly and lawfully processed
  • Processed for limited purposes
  • Adequate, relevant and not excessive
  • Accurate
  • Not kept for longer than is necessary
  • Processed in line with the data subject’s (individual’s) rights
  • Secure
  • Not transferred to countries outside of the EU without adequate protection (this will affect information on the internet/website)

More information on the eight principles of data protection


Wiltshire council is an organisation that provides services for the people and local communities. The day-to-day work of the council involves collecting and using information about the people whom we provide services to and with whom we work.

There will be personal information on:

  • Forms
  • Claims
  • School records
  • Planning applications
  • Personnel records and so on

A lot of the time Wiltshire council uses personal data for services it is required to provide by law, and therefore has no choice. There may be times that the service is not essential and you can opt in or out.


The Information Commissioner enforces and oversees:

  • The Data Protection Act 1998
  • The Freedom of Information Act 2000
  • The Environmental Information Regulations 2004

The Commissioner is a UK independent supervisory authority, which reports directly to the UK Parliament and has both an international and national role.


The council uses information about children for whom it provides services, to help it to carry out specific functions for which it is responsible.

Please see our privacy notice.


Notification is the process in which organisations register what personal data they use and how they use it.

Each entry includes the name and address of the data controller and a general description of the processing of personal data by a data controller. Individuals can consult the register to find out what processing of personal data is being carried out by a particular data controller.

The Data Protection Act 1998 requires every data controller who is processing personal data to notify those concerned unless there is a legal reason for them not to.


There are many words that are used when talking about data protection. This section is designed to help you understand what they mean.

Data Controller

Person or organisation who decides how and why any personal data is used

Wiltshire council is our Data Controller

Data Processor
Any person, other than employees of the data controller, who process data on behalf of the data controller
Data Subject
An individual who is the subject of personal data
Personal data
Information which, alone or together with other information in the possession of or likely to come into the possession of the data controller, identifies a living individual
In relation to information or data processing means obtaining, recording, holding, organising, adapting, altering, retrieving, consulting, disclosing, combining, blocking, erasing or destroying data. Anything that can be done to information is processing
Sensitive data

Information relating to:

Racial or ethnic origin, sexual life, political opinions, membership of trade union, physical or mental health, commission or alleged commission of an offence, any proceedings for any offence committed or alleged to have been committed, disposal of such proceedings or court sentence of such proceedings

Third party
Any person other than the data subject, the data controller or the data processor

Share this page

Last updated: 3 May 2018 | Last reviewed: 3 May 2018