Data Protection Act
In accordance with the UK General Data Protection Regulation (GDPR), the Data Protection Act 2018 came into force on the 25th May 2018. The principles are broadly similar to the pre-existing Data Protection Act 1998, and the legislation altered how we handle and maintain your information.
We ask that you keep us informed - by email, telephone or in writing - of any changes in your personal data so that we can keep our records up to date at all times.
For more information about the Data Protection Act 2018 you can refer to the ICO website.
For further information on how personal data is processed, please refer to our Privacy notices page.
Your rights under the Act
Under the Data Protection Act 2018, you have the following rights:
The Data Protection Act 2018 gives you the right to ask the Council for a copy of the personal information that we hold about you for the purposes of providing services to you. You are also entitled to additional information including;
- The identity and contact details of the controller and data protection officer
- The purposes of the processing and the legal basis
- Your additional rights in respect of the data
- Your right to complain
- The categories of personal information
- Who your data has been and will be shared with
- Data source - where the data has not been collected directly from the data subject
The Data Protection Act 2018 gives you the right to have inaccurate and incomplete personal data held about you rectified, known as 'data rectification'. You can provide a supplementary statement detailing what information requires rectification, for example, misspellings and incorrect or out of date personal data.
The Data Protection Act 2018 gives you the right to have your data erased, for example:
- data that is no longer necessary, and unrelated to the original purpose it was collected for
- is of no legitimate interest to continue processing the data
- the data is being used for direct marketing, without your consent, you can object to the processing of the data
- withdrawing consent where data was collected for lawful basis purposes and you no longer give consent
Please note, the Council may not be able to process your request if the request is subject to a legal obligation compliancy. In the event of this, we will contact you.
The Data Protection Act 2018 gives you the right to restrict the processing of your personal data, which can include the following:
- the data has been unlawfully processed
- if the data is contested as being inaccurate and requires verification
- a legitimate objection preventing the processing of restricted information
The Data Protection Act 2018 gives you the right to request for you to use your personal data across different services. This is known as the 'right to data portability'.
Please note, you are only able to request for your personal information to be transferred if the information:
- is processed for a contract
- is processed is based on your consent
- is processed automatically
- was provided to the Council by you.
The Data Protection Act 2018 gives you the right to challenge a decision that affects you that has been made automatically without human intervention, for example an online form with an instant decision.
Please complete the data subject rights request form to assist in dealing with your request.
Validating your request
For your protection and the security of the data, the Council will need to confirm that you are the person whom the data is about, and will require proof of your identity before we process the request. If you are acting on behalf of someone else, the Council will need proof of this as well as proof of your identity. We may also need to contact the data subject to confirm that they have authorised you to act on their behalf.
If you have not provided the relevant proof of identity and consent with the form, it will need to be provided before we can process your request for information.
We accept any two of the following as proof of identity, at least one of which must be photographic identification:
- Benefit entitlement letter to your current address
- Birth certificate
- Building society account book
- Bus pass – issued by Derby City Council
- Current driving licence photocard - (full or provisional)
- Current driving licence (full or provisional) - paper version (if issued before 1998)
- Identity card – civil service, armed forces, police
- National health card
- Any official letter from Revenues & Customs
- Pension book
- Rent book
- Recent utility bill
We will only use them to progress with your request and any originals you send us will be sent back to you by first class post unless you tell us you want it sending back by recorded delivery.
If you have not provided proof of your identity with the request it will need to be provided within 3 weeks of receipt or we will close the request.
Yes, if they are under 13 years old. You will need to give us proof of your relationship to your child or children and may also need to give us proof that you have parental responsibility. This can be a birth certificate or a letter from a solicitor or a court.
If your child or children is 13 years old or over we may have to ask them for their consent before we can give you their personal data. We will tell you if we need to do this.
If you are making a request on behalf of an individual who is not your child, and you do not have the legal power to give consent, and they are able to able to consent to you acting on their behalf; they need to provide us with their consent for you to act on their behalf.
If the individual is over the age of 13 and is deemed not to have consent by virtue of a certified court order i.e. power of attorney or a deputyship order then we require confirmation of this.
If you have been given legal powers to act on an individual's behalf, then please confirm what legal powers you have. We will require evidence of this in order to process your request.
If you were born and adopted before 12th November 1975 and you do not know your birth name, you need to apply to the General Register Office for access to your birth records and you will have to attend a meeting with an approved adoption advisor.
You can contact them on 0300 123 1837 and you need to ask for an 'access to adoption records' form. Or you can apply for an 'access to adoption records' form by post to:
General Register Office
The General Register Office will arrange for you to have a meeting with an approved adoption advisor which will usually be at your local adoption office.
If you were born and adopted before 12th November 1975 and do know your birth name you should contact your local adoption support/post adoption team to apply for access to your birth/adoption records. You should always ask for support and counselling. You will need to provide proof of your identity and the local team will help you access your records.
If you were born and adopted after 12th November 1975 and before 30th December 2005 it is not compulsory to have a meeting with an approved adoption advisor although we advise that you do this. You still need to apply for your records through the General Register Office but they will send your records directly to you.
Once you have got a copy of your records you may decide you would like to try to locate a birth relative. We have a tracing pack to help you do this and can also offer advice on tracing. To ask for a pack send a letter to:
Derby City Post Adoption Team
Derby City Council
If you were aged 21 before April 1997 it is likely that Derbyshire County Council will hold your records and you should make your request direct to them. You can contact them by writing to:
The Access to Information Officer
If you were aged 21 after April 1997 your request must tell us which department you think holds personal information about you. You must also provide us with proof of your identity.
If your information contains references to anyone else we may need to get their consent before we can disclose it to you. Sometimes we will ‘redact’ some of the information to protect confidentiality. This involves us obscuring or removing personal text that identifies another person or persons prior to publication where they have not consented to us disclosing information about them but we will tell you if we do this.
Once your request has been validated, we will have a month to respond to your request. However if your request is complex or numerous, we may require a further two months, which will be communicated with you.
If you are not happy with how your request has been handled you can ask for an internal review in the first instance by contacting the Information Governance Team and we will review the original decision.