Decision details

RESOLVED:

Cabinet resolved to:

1. Approve the Data Protection Policy 2026 at Appendix A, to take effect from the date of this meeting.

2. Note that the data protection complaints procedure required under section 103 of the Data (Use and Access) Act 2025 (inserting section 164A into the Data Protection Act 2018) will be published on the Council's website by 19 June 2026 in accordance with the statutory deadline.

3. Authorise the Data Protection Officer, in consultation with the Leader of the Council, to update the Policy between formal review cycles where required by changes to ICO guidance or legislation, subject to those updates being reported to the next available Cabinet meeting.

REASON FOR DECISION:

The Council has a statutory obligation to comply with UK GDPR, the Data Protection Act 2018, and from 19 June 2026 the data protection complaints procedure requirement introduced by the Data (Use and Access) Act 2025. The existing policy predates the DUAA and does not reflect the new complaints procedure obligation.

Approval of the revised Policy is necessary to ensure the Council is demonstrably compliant with its legal obligations by the statutory deadline, to protect individuals whose data the Council processes, and to protect the Council from the risk of regulatory enforcement action by the Information Commissioner's Office.