Data Protection and Subject Access Policy

Policy Statement
1.1Wiltshire Council will ensure every user is aware of, and understands, their responsibilities regarding the security of personal data held by, and on behalf of, the Council in respect of;
a) their responsibilities under data protection law for the protection of personal data
b) the benefits of appropriate data sharing
c) the necessity for good records management
d) the technical and administrative controls operating in the Council
e) other laws and statutory guidance around this subject
1.2 Wiltshire Council holds and processes information about its employees, clients, and other individuals for various purposes. To comply with the Data Protection legislation, personal information must be collected and used fairly, lawfully and transparently for specific purposes. It should be limited to what is necessary, be maintained accurately, and stored safely for no longer than is necessary. When no longer required, it should be securely disposed of, and not disclosed to any unauthorised person.
1.3 The GDPR and this policy apply to all personal information processed by the council. Non-compliance with this policy may result in disciplinary action.
1.4Any work activity involving personal data now has the status of a regulated activity.

Scope
2.1 This policy is intended for all Councillors, Committees, Services, Partners, Employees of the Council, Contractual Third Parties and Agents of the Council who have access to information held or processed by Wiltshire Council.
2.2 This policy covers all personal information held and processed by the Council however it is collected, recorded and used, whether digital, on paper or recorded on other media.
2.3 The council is responsible for its own records under the terms of the GDPR, and it has registered as a Data Controller with the Information Commissioner. Registration No. Z1668953