Policy adopted: April 3rd 2018
Last review: 3/3/26
Next review: March 2028

1. Purpose

Cropwell Bishop Parish Council recognises the importance of protecting personal data and responding promptly and effectively to any personal data breach.

This policy sets out how the Council will identify, report, manage, and record personal data breaches in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

2. Definition of a Personal Data Breach

A personal data breach is defined under UK GDPR as:

“A breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data transmitted, stored or otherwise processed.”

Examples include:

• access by an unauthorised third party
• sending personal data to an incorrect recipient
• loss or theft of devices containing personal data
• alteration of personal data without permission
• accidental deletion or loss of personal data
• loss of availability of personal data

3. Responsibilities

The Parish Council, as the Data Controller, is responsible for ensuring personal data breaches are managed appropriately.

Parish Clerk

The Parish Clerk has day-to-day responsibility for managing personal data breaches and ensuring appropriate action is taken.

Data Protection Officer (DPO)

The Council has appointed an external Data Protection Officer who provides independent advice and supports the Council in assessing breaches and determining whether notification to the ICO or affected individuals is required.

External IT Support Provider

The Council’s IT support provider may assist with:

• identifying and investigating breaches
• containing incidents
• restoring systems or data
• implementing technical measures to mitigate risks

4. Reporting a Breach

Any councillor, employee, or volunteer who becomes aware of a potential personal data breach must report it immediately to the Parish Clerk.

The Parish Clerk will then notify the Data Protection Officer without delay.

Prompt reporting is essential to allow the Council to determine whether the breach must be reported to the Information Commissioner’s Office (ICO) within the required 72-hour timeframe.

5. Managing a Breach

When a breach is identified the Council will take appropriate steps to:

1. Contain the breach
   Prevent further loss or disclosure of personal data where possible.
2. Assess the breach
   Determine:
   • the type of data involved
   • the number of individuals affected
   • the potential impact on individuals
3. Mitigate the impact
   The Council’s IT support provider may assist with technical measures to secure systems and reduce the risk of further harm.
4. Determine notification requirements
   In consultation with the Data Protection Officer.

6. Notification to the ICO

Where a personal data breach is likely to result in a risk to the rights and freedoms of individuals, the Council will notify the Information Commissioner’s Office (ICO) without undue delay and, where feasible, within 72 hours of becoming aware of the breach.

If notification is delayed beyond 72 hours, the reasons for the delay will be documented.

When reporting a breach to the ICO the Council will provide:

• a description of the nature of the breach
• the categories and approximate number of data subjects affected
• the categories and approximate number of personal data records concerned
• the name and contact details of the Data Protection Officer
• the likely consequences of the breach
• measures taken or proposed to address the breach and mitigate possible adverse effects

7. Notification to Individuals

Where a personal data breach is likely to result in a high risk to the rights and freedoms of individuals, the Council will inform the affected individuals without undue delay.

The communication will include:

• the nature of the breach
• contact details of the Data Protection Officer
• the likely consequences of the breach
• measures taken or proposed to address the breach

Notification to individuals may not be required if:

• appropriate technical measures (such as encryption) have rendered the data unintelligible
• subsequent measures have ensured that the high risk is no longer likely to materialise
• it would involve disproportionate effort, in which case a public communication may be made instead

8. Data Processors

Where a data processor acting on behalf of the Council becomes aware of a personal data breach, they must notify the Council without undue delay.

It remains the responsibility of the Council, as Data Controller, to determine whether the breach must be reported to the ICO or affected individuals.

9. Record of Data Breaches

The Council will maintain a record of all personal data breaches, including breaches that do not require notification to the ICO.

The breach record will include:

• date of breach
• description of the breach
• type of personal data involved
• number of individuals affected (where known)
• risk assessment outcome
• whether the breach was reported to the ICO
• whether individuals were notified
• actions taken to contain and mitigate the breach
• measures taken to prevent recurrence

Maintaining a breach log helps the Council identify patterns and improve the protection of personal data.

10. Learning from Breaches

Following any breach, the Council will review the circumstances of the incident and consider whether improvements are needed to:

• policies and procedures
• technical security measures
• staff awareness and training
• supplier or processor arrangements

11. Complaints

Individuals who believe their personal data has been handled incorrectly may contact the Parish Clerk or the Data Protection Officer.

Individuals also have the right to complain to the Information Commissioner’s Office (ICO).

ICO contact details:

Website: https://ico.org.uk
Telephone: 0303 123 1113

12. Review of this Policy

This policy will be reviewed periodically to ensure it remains consistent with legal requirements and the Council’s operational practices.

Policy Adopted April 3rd 2018
Last Review – 12/3/26 Minute Ref: M.295
Next Review Date: March 2028

1. Purpose of this Policy

Cropwell Bishop Parish Council is committed to protecting the privacy and personal data of individuals whose information it processes.

This policy explains how the Council ensures compliance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018 when processing personal data.

The Council recognises its responsibility to ensure that personal data is processed lawfully, fairly, securely, and transparently.

2. Scope

This policy applies to all personal data processed by the Council including data relating to:

• employees and prospective employees
• councillors and volunteers
• residents and members of the public
• individuals contacting the Council
• contractors and suppliers

This policy applies to both paper records and electronic information.

3. Data Protection Principles

The Council processes personal data in accordance with the following principles:

Personal data shall be:

1. Processed lawfully, fairly and transparently
2. Collected for specified, explicit and legitimate purposes
3. Adequate, relevant and limited to what is necessary
4. Accurate and kept up to date
5. Retained only for as long as necessary
6. Processed securely using appropriate technical and organisational measures

The Council is also responsible for demonstrating accountability for these principles.

4. Lawful Basis for Processing

As a public authority, the Council processes personal data primarily under the following lawful bases:

• Legal obligation – where processing is required by law
• Public task* – where processing is necessary for the Council to perform its public functions
• Contract – where processing is necessary to fulfil contractual obligations
• Consent – where individuals have freely given consent for specific processing activities

Special category personal data will only be processed where a lawful condition under the Data Protection Act 2018 also applies.

5. Data Protection Responsibilities

The Parish Council, as a corporate body, is the Data Controller responsible for ensuring compliance with data protection legislation.

Day-to-day responsibility for data protection is delegated to:

The Parish Clerk

Contact details:

• Email: clerk@cropwellbishop-pc.gov.uk
• Phone: 0115 9894656

The Council has also appointed an external Data Protection Officer (DPO) to provide independent advice and support compliance.

Contact details:

• Email: dpo@cropwellbishop-pc.gov.uk

All councillors, staff, and volunteers who process personal data must ensure they follow this policy.

6. Records of Processing Activities

The Council maintains a Record of Processing Activities (RoPA) which documents:

• the categories of personal data processed
• the purposes of processing
• the categories of data subjects
• recipients of personal data
• storage locations
• retention periods

This record is reviewed periodically to ensure it remains accurate.

7. Information Security

The Council implements appropriate technical and organisational measures to protect personal data from:

• unauthorised access
• loss or destruction
• alteration or disclosure

Measures may include:

• secure storage of paper records
• controlled access to systems and files
• password protection and secure IT systems
• use of secure cloud services where appropriate

8. Data Retention

Personal data will only be retained for as long as necessary to fulfil the purpose for which it was collected or to comply with legal obligations.

The Council maintains a data retention schedule which sets out how long different types of information are retained.

9. Data Breaches

A personal data breach occurs where personal data is:

• lost
• destroyed
• accessed without authorisation
• disclosed improperly

All suspected breaches must be reported to the Parish Clerk immediately.

Where required, breaches will be reported to the Information Commissioner’s Office (ICO) within 72 hours.

10. Data Subject Rights

Individuals have rights in relation to their personal data including:

• the right of access to personal data held about them
• the right to request correction of inaccurate data
• the right to request deletion in certain circumstances
• the right to object to processing
• the right to restrict processing in certain circumstances

Requests relating to these rights should be directed to the Parish Clerk.

11. Complaints

If an individual is unhappy with how their personal data has been handled, they should first contact the Parish Clerk or the Data Protection Officer.

Individuals also have the right to complain to the Information Commissioner’s Office (ICO).

Information Commissioner’s Office
Website: https://ico.org.uk
Telephone: 0303 123 1113

12. Review of this Policy

This policy will be reviewed periodically to ensure it remains up to date with changes in legislation, guidance from the Information Commissioner’s Office, and the Council’s activities.

*Public task: Refers to the processing of personal data that is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller, as defined under Article 6(1)(e) of the UK GDPR.

Adopted September 2006
Last Review Date 1st March 2022 Minute Ref: M.387
Next Review Date March 2027

This policy is intended to assist local residents to deal with complaints against actions of the Council’s staff or its administration. In order to deliver the best service to the electorate the following procedures shall apply to any complaint received.

1. Introduction

Cropwell Bishop residents may wish to complain about the decisions, the procedures, or the conduct of the members or staff of Cropwell Bishop Parish Council. Please note: it may be appropriate for bodies other than Cropwell Bishop Parish Council to investigate the following types of complaint:

• Financial irregularity: the Council may need to consult its auditor.
• Criminal activity: the Council must report this type of complaint to the police.
• Member’s conduct: If the complaint relates to a failure to comply with ‘NALC Model Code of Conduct, 2018’ the must be submitted to the EHDC monitoring officer as described in section 1 of this complaints procedure.
• Employee conduct: The council should refer to its internal disciplinary procedure. 1. Complaint relating to breach of Code of Conduct by a Councillor Cropwell Bishop Parish Council observes the ‘R.B.C. Model Code of Conduct, 2020’.

Complaints against individual councillors that involve a breach of their code of conduct should be made to the Monitoring Officer of the Rushcliffe Borough Council. The Monitoring Officer can only deal with Code of Conduct complaints. They will not deal with complaints outside of their remit. You will need to check Cropwell Bishop Parish Councils code of conduct before proceeding.

Complaints should be in writing and addressed to:
The Monitoring Officer
Rushcliffe Borough Council
Rushcliffe Arena
Rugby Road
West Bridgford
Nottingham NG2 7YG

Alternatively go to: https://www.rushcliffe.gov.uk/complaints/ and fill in the online complaints form.

Making a routine complaint (regarding Council decisions or procedures)

Definition A complaint is an expression of dissatisfaction by one or more members of the public about the Council’s action or lack of action or about the standard of a service – whether the action was taken or the service provided by the Council itself, a person, or body acting on behalf of the Council

2. Informal Complaints

2.1 It is not appropriate to deal with all complaints from members of the public under the formal complaints procedure. It is hoped that less formal measures or explanations provided to the complainant by the Clerk or Chair of the Council will resolve most issues raised by a member of the public.

2.2 Any informal complaint will be brought to the Council by the Clerk or the Chair of the Council to be noted.

3. Formal Complaints

Before the meeting In order for a complaint to be considered by the Council:

3.1 The complainant will be asked to put the complaint in writing to the Clerk. The Clerk’s contact details can be found in section 5.

3.2 a complainant does not wish to put the complaint to the Clerk, they will be advised to put it to the Chairman of the Council. The Chairman’s contact details can be found in section 5.

3.3 The Clerk will acknowledge the receipt of the complaint and advise the complainant when the matter will be considered by the Parish Council.

3.4 The complainant shall be invited to attend the relevant meeting and bring with them such representatives as they wish.

3.5 Seven clear working days prior to the meeting, the complainant will provide the Council with copies of any documentation, or other evidence, which they wish to refer to at the meeting. The Council will similarly provide the complainant with copies of any documentation upon which they wish to rely at the meeting.

At the meeting

3.6 Press and public will be excluded from the meeting.

3.7 The Chairman of the meeting should introduce everyone and explain the procedure.

3.8 The complainant (or representative) should outline the grounds for complaint before any questions from the Clerk and then from members if present.

3.9 The Clerk should explain the council’s position before any questions from the complainant, and from members if present.

3.10 The complainant and then the Clerk should then summarise their position; they then leave the room while members decide whether or not the grounds for the complaint have been made. N.B. If a point of clarification is necessary, both parties will be invited back.

3.11 Clerk and complainant return to hear decision or to be advised when decision will be made.

After the meeting

3.12 The decision should be confirmed in writing within seven working days together with details of any action to be taken.

3.13 The result of the proceedings should be reported at the next council meeting after the appeal period has passed, ensuring that agreed confidential issues are appropriately respected.

Appeals

3.14 Should the complainant not agree with the decision they are entitled to appeal the decision within fourteen days of receipt of the result of the proceedings.

3.15 The councillors nominated to handle the appeal should, within twenty-one days of receiving the appeal, examine the way in which the council dealt with the complaint.

3.16 If procedures were correctly handled by the council then the appellant should be notified that the appeal has not been successful. If the complaint was not handled correctly it must be referred back for consideration as at 3.2.

3.17 The appellant should be notified of the result of the appeals process within fourteen days.

4. Unreasonable and Vexatious Complaints

There will be circumstances when a complainant persists in wishing to pursue a complaint when it clearly has no reasonable basis, or when the Council (or a Committee) has already taken reasonable action in response, or where some other process, whether through the courts or some other recognised procedure, should or has been taken. The Clerk (or Chair of the Council) will refer these matters to the Council with a summary of the issues and of the attempts made to resolve the
complaint. They may, in such circumstances, decide that no further action can usefully be taken in response to the complainant and inform the complainant so, making it clear that only new and substantive issues will merit a response.

5. Contact Details

f you are still dissatisfied, then you can contact the Local Government Ombudsman, who will investigate the complaint on your behalf. You can contact the Local Government Ombudsman at:

PO Box 4771
Coventry
CV4 0EH
Telephone: 0300 061 0614

Based upon the ‘NALC model complaints procedure: Legal Topic Note: LTN: 9E June 2014

To achieve our ambition the Parish Council needs to work closely with all of its residents and community and voluntary groups.

This will go beyond consultation and participation; our aim is to engage residents who will, participate in decision making, work alongside us to design, deliver, and monitor services and vote in elections.

It will mean that the Parish Council will promote genuine partnership and collaboration, and ensure that people have the opportunities and capacity to be effective citizens.

Our overall aim is:

To ensure, through a wide range of public consultation and community engagement the Parish Council actively listens, considers and uses the views of its villagers as an integral part of its decision making process.

That its policies reflect the aspirations and needs of a diverse village.

Our objectives are to:

Agree shared ambitions for the locality and the community.

• Strengthen the Councils democratic engagement with and accountability to its residents.
• Be an organisation that consults, communicates, and makes changes as a result of our
  communities and service users views.
• Improve in partnership with service providers the needs of a diverse community and tackle inequality and exclusion.
• Develop working relationships with voluntary and community sector partners to deliver local priorities and improve quality of life.
• Nurture vibrant and active communities who can take up the opportunities for voice and choice in relation to public services and decision making.
• Devolve power where appropriate to voluntary and community groups.

In order to achieve these policy objectives, the Council will adopt a corporate implementation strategy.

This strategy is part of the Councils commitment to creating and maintaining effective working relationship with voluntary and community groups, based on trust, openness, and constructive challenge.