Privacy notice guide

2. Why and when you need a privacy notice

Why you need a privacy notice

Being transparent and providing information to individuals about how we use their personal data is a key element of the Data Protection Act 2018 (DPA) and the UK General Data Protection Regulation (GDPR). The most common way to provide this information is in a privacy notice. If the overarching Cheshire East Council privacy notice does not apply to, or provide enough information about, your data processing, you will need to make a service-specific privacy notice.

When you need a privacy notice

• At the time data is obtained, especially sensitive personal data
• If not provided directly by the data subject, within one month of obtaining the data
• If used to communicate with an individual, when initial communication takes place
• If disclosure to a third party is envisaged, before disclosure takes place

Reviewing your privacy notice

It is your responsibility to proactively bring any changes to the way that you process data to your customer’s attention, so you should review your service’s privacy notice regularly. When reviewing your privacy notice, you should look out for:

• Does your privacy notice state the most up to date legislation you work under
• Have the types of data you use changed
• Do you still use data in the same way as your privacy notice says you do.  For example, where you get the data from, who you share the data with, or how long you retain the data for.
• Is the lawful basis under Article 6 UK  GDPR given in your privacy notice still the most applicable

If you think the purpose for which, or the lawful basis under which, you process data has changed, you should consult the Data Protection Team and your customers should be made aware of the change.

If you change your privacy notice, you should retain a copy of your original privacy notice, so that we can keep a track of what information was provided to our customers, and when.

Where you need a privacy notice

To comply with the transparency requirements of the UK GDPR, it is crucial that information about how you handle personal data is freely and easily accessed by everyone who’s personal data you process.

• If your processing of personal data does not fall within the information given in Cheshire East Council’s privacy notice, you should publish your individual service’s privacy notice on the Cheshire East Council website, as that is mainly how customers and clients will find you.
• Provide a link to the location of your privacy notice in the signature of all your external emails, so that your data subjects are provided with the information at the time of initial communication or obtaining of data, and before any disclosure is made.

A Privacy Notice can be provided:

• orally
• face to face
• telephone
• in writing
• digitally
• video
• signage