Data Protection & records Management Policy
Keelby Parish Council Data Protection & Records Management Policy
Version 3.1 Final
ADOPTED BY KEELBY PARISH COUNCIL on: 1st July 2025
NEXT REVIEW DUE on: July 2028
1. The Data Protection Policy
Keelby Parish Council recognises its responsibility to comply with the General Data
Protection Regulations (GDPR) 2018 which regulates the use of personal data. This
does not have to be sensitive data; it can be as little as a name and address.
2. General Data Protection Regulations (GDPR)
The GDPR sets out high standards for the handling of personal information and
protecting individuals’ rights for privacy. It also regulates how personal information can
be collected, handled and used. The GDPR applies to anyone holding personal
information about people, electronically or on paper. Keelby Parish Council has notified
the Information Commissioner that it holds personal data about individuals.
When dealing with personal data, Keelby Parish Council staff and members must ensure
that:
Data is processed fairly, lawfully and in a transparent manner
This means that personal information should only be collected from
individuals if staff have been open and honest about why they want the
personal information.
Data is processed for specified purposes only
This means that data is collected for specific, explicit and legitimate
purposes only.
Data is relevant to what it is needed for
Data will be monitored so that too much or too little is not kept; only data that
is needed should be held.
Data is accurate and kept up to date and is not kept longer than it is
needed
Personal data should be accurate, if it is not it should be corrected. Data no
longer needed will be shredded or securely disposed of.
Data is processed in accordance with the rights of individuals
Individuals must be informed, upon request, of all the personal information
held about them.
Data is kept securely
There should be protection against unauthorised or unlawful processing and
against accidental loss, destruction or damage.
3. Purpose of this Document
This policy is to ensure that Keelby Parish Council complies with GDPR and relevant
Records Management legislation. The policy applies to the personal data (for example:-
current and former job applicants, employees, workers, contractors, and former
employees, referred to as HR-related personal data) other personal data processed for
Council business. . This policy does not apply to the personal data relating to members
of the public.
The council has appointed the Clerk to the Council as the person with responsibility for
data protection compliance within the Council. Questions about this policy, or requests
for further information, should be directed to the Clerk.
4. Management of Information
In accordance with Standing Orders, the council will have in place and keep under
review, technical and organisational measures to keep secure information (including
personal data) which it holds in paper and electronic form. Such arrangements shall
include deciding who has access to personal data and encryption of personal data.
The Council’s Proper Officer (Clerk) shall have in place, and keep under review, policies
for the retention and safe destruction of all information (including personal data) which
the council holds in paper and electronic form subject to the requirements of data
protection and freedom of information legislation and other legitimate requirements (e.g.
the Limitation Act 1980). Based on best practice, the Council’s retention policy
summarised in Appendix A confirms the period for which information (including personal
data) shall be retained.
The agenda, papers that support the agenda and the minutes of a meeting shall not
disclose or otherwise undermine confidential information or personal data without legal
justification.
Councillors, staff, the Council’s contractors and agents shall not disclose confidential
information or personal data without legal justification.
5. Data Security and Storage
Keelby Parish Council recognises its responsibility to be open with people when taking
personal details from them. This means that staff must be honest about why they want a
particular piece of personal information.
Keelby Parish Council may hold personal information about individuals such as their
names, addresses, email addresses and telephone numbers. These will be securely
kept at the Keelby Parish Council Office and are not available for public access1. All data
stored on the Keelby Parish Council Office computers are password protected. Once
data is not needed any more, is out of date or has served its use and falls outside the
minimum retention time of Councils document retention policy, it will be shredded or
securely deleted from the computer.
The council takes the security of personal data seriously. The council has internal
policies and controls in place to protect personal data against loss, accidental
destruction, misuse or disclosure, and to ensure that data is not accessed, except by
employees in the proper performance of their duties. Relevant systems (e.g. eMail)
This does not apply to data that is already in the public domain used by Keelby Parish Council
are appropriately registered with the Information Commissioner’s Office (ICO).
Where the council engages third parties to process personal data on our behalf, such
parties do so on the basis of written instructions, are under a duty of confidentiality and
are obliged to implement appropriate technical and organisational measures to ensure
the security of data.
Duplicate records of personal data MUST NOT be kept by Council members, unless
stored in officially registered systems (e.g. eMail) to support on-going business. Any
such data will be deleted/returned to the Clerk on the completion of said business.
6. Data Breaches
The Council has robust measures in place to minimise and prevent data breaches from
taking place. Should a breach of personal data occur the council must take notes and
keep evidence of that breach.
If you are aware of a data breach you must contact the Clerk or Chairman of the Council
immediately and keep any evidence, you have in relation to the breach. If the council
discovers that there has been a breach of HR-related personal data that poses a risk to
the rights and freedoms of yourself, we will report it to the Information Commissioner
within 72 hours of discovery. The council will record all data breaches regardless of their
effect.
If the breach is likely to result in a high risk to the rights and freedoms of individuals, we
will tell you that there has been a breach and provide you with information about its likely
consequences and the mitigation measures we have taken.
7. Responsibilities to Provide Information
Keelby Parish Council is aware that people have the right to have access to any
personal information that is held about them. Subject Access Requests (SARs) must be
submitted in writing (this can be done in hard copy, email or social media). If a person
requests to see any data that is being held about them, the SAR response must detail:
How and to what purpose personal data is processed
The period Keelby Parish Council tend to process it for
Anyone who has access to the personal data
The response must be sent within 30 days and should be free of charge.
If a SAR includes personal data of other individuals, Keelby Parish Council must not
disclose the personal information of the other individual. That individual’s personal
information may either be redacted, or the individual may be contacted to give
permission for their information to be shared with the Subject. Individuals have the right
to have their data rectified if it is incorrect, the right to request erasure of the data, the
right to request restriction of processing of the data and the right to object to data
processing, although rules do apply to those requests. Please see “Subject Access
Request Procedure” published by the ICO for more details.
Additionally, the Council shall publish information in accordance with the requirements of
the Local Government (Transparency Requirements, England) Regulations 2015.
8. Confidentiality
Keelby Parish Council members and staff must be aware that when complaints or
queries are made, they must remain confidential unless the subject gives permission
otherwise. When handling personal data, this must also remain confidential.
Appendix A
Document Minimum Retention Period Reason
Minutes
Minutes of Council meetings Indefinite Archive
Minutes of committee meetings Indefinite Archive
Employment
Staff employment contracts 7 years after ceasing employment Management
Staff payroll information 3 years Management
Staff references 7 years after ceasing employment Management
Application forms
(interviewed – unsuccessful) 6 months Management
Application forms
(interviewed – successful) 7 years after ceasing employment Management
Disciplinary files 7 years after ceasing employment Management
Staff appraisals 7 years after ceasing employment Management
Finance
VAT and tax records 7 years Audit
Receipt and payment accounts 7 years VAT
Bank statements Last completed audit year Audit
Cheque book stubs Last completed audit year Audit
Paid invoices Last completed audit year VAT
Paid cheques Last completed audit year Limitation Act 1980
Payroll records 3 years HMRC
Petty cash accounts Last completed audit year Audit
Insurance
Insurance policies 7 years after policy end Management
Certificates for Insurance against
liability for employees 7 years after policy end Management
Certificates for Public Liability 7 years after policy end Management
Insurance claim records 7 years after policy end Management
Health and Safety
Accident books 3 years from date of last entry Statutory
Risk assessment 3 years Management
General Management
Councillors contact details Duration of membership Management
Lease agreements 12 years Limitation Act 1980
Contracts 7 years Limitation Act 1980
Email messages At end of useful life Management
Consent forms 5 years Management
GDPR Security Compliance form Duration of membership Management
Cemetery Records 100 years Management
Burial Records Indefinite Archive