Wealden District Council
More
You are using an unsupported version of Internet Explorer.
Parts of our website may display incorrectly or not work at all. Please consider downloading an up to date browser such as Chrome or Firefox.
Wealden District Council > Transparency, Spending and Performance > Data Protection > Privacy Policy > Internal Audit

Internal Audit

Internal Audit forms part of the Chief Executive Directorate and this document explains how information will be held about you and processed.

This notice should be read in conjunction with our Privacy Policy.

How do we get your information?

Internal Audit has access to all information supplied to any service within the council by individuals; including customers, staff, suppliers and any other third parties.

Such information is gathered during internal audit reviews of council provided services and of services provided to the council. The information collected during the review is limited to the purpose of the audit.

What personal data do we process and why

The information we process about you will vary depending on the audit review being conducted, but will fall within the following categories:

  • Name
  • Date of birth
  • Address
  • email addresses
  • telephone numbers
  • financial information
  • employee data
  • employment data
  • personal identification data
  • website user stats
  • references
  • income
  • photos
  • disabilities
  • household
  • benefits/allowances

Information relating to health and wellbeing and other special category data

In order to meet our statutory and legal obligations in respect of these services, we may also need to process sensitive, or “special category” personal data about you, which could include data related to:

  • trade union membership
  • health

We only process this type of data where it is necessary for our lawful function i.e. meeting statutory duties under the Accounts and Audit Regulations.

We always ensure appropriate safeguards are in place to protect your rights and freedoms (including, where required, maintaining an appropriate policy document), and we only retain this data for as long as necessary for the purpose(s) for which it is processed.

Information relating to criminal offence data

We may process personal data relating to criminal convictions and offences or related security measures. 

 

This could include, for example: 

  • The fact that someone is in prison

 

We only process this type of data where it is necessary for our lawful functions, such as  

  • evaluating the effectiveness of the council’s risk management, control and governance processes,

 

We always ensure appropriate safeguards are in place to protect your rights and freedoms and we only retain this data for as long as necessary for the purpose(s) for which it is processed.

Why we collect personal information about you.

Wealden District Council will collect and hold personal information relating to Internal Audit.  We use this information to deliver and manage the services we provide.

Lawful basis for processing your personal data

We process personal data because it is necessary to comply with our legal obligations which are:

 

  • The Accounts and Audit Regulations 2015.

 

As outlined above, we also process personal data that is ‘special category data’ and ‘criminal offences data’. Where this is the case, we process such data on the following, additional, conditions:

  • Article 9(2)(g) – Substantial public interest.

We process criminal offences data in accordance with Article 10 UK GDPR and Schedule 1 of the Data Protection Act 2018, where the processing is necessary for reasons of substantial public interest and to enable us to carry out our statutory functions and comply with legal obligations.

Who do we share your data with?

The data you provide may be disclosed with other departments of the Council or external organisations for related purposes or as required by law.  We may share information with the following types of organisations:

  • Other internal council services to enable the establishment of the effectiveness of corporate systems and processes.
  • The council’s external auditors (Grant Thornton)
  • Other Councils where there is a shared service
  • During the course of an investigation or audit, data may be shared with other council departments such as Human Resources and the Investigations Team

 

We may also share information internally, in order to verify or confirm your personal details, to ensure our records are accurate and up-to-date. Data held by this service will only be used by other internal departments or services when we are satisfied there is a lawful basis for doing so and is considered fair.

Do we use data processors?

Data processors are third parties who provide certain parts of our services for us. We have contracts in place with them and they cannot do anything with your personal information unless we have instructed them to do so. Our current data processors for this service are listed below.

Data Processor

Purpose

Microsoft packages

To hold data and enable us to achieve our objectives

All Council IT systems

Processing and retaining data for the individual council services to which Internal Audit require access

Transfer of personal data

Your personal data may be transferred to other organisations or jurisdictions where necessary to deliver our services or meet our legal obligations. Any such transfers will be carried out in accordance with data protection laws and appropriate safeguards will be applied to ensure your information remains secure and protected. This may include the use of approved contractual clauses, adequacy decisions, or other legally recognised transfer mechanisms designed to maintain the confidentiality, integrity, and security of your personal data.

Automated decision making

Internal Audit does not use automated decision making in respect of your personal data.

Retention Period

We process your personal data for the above purposes for no longer than necessary and in accordance with current legislation and the Councils Retention Schedule.

Only in exceptional circumstances will we hold your information for longer, for example a pending court case.  All information will be held securely and disposed of confidentially.

Anonymising your data

Your personal information may be converted into statistical or aggregated data that ensures that you cannot be identified from it.  Anonymised data means it cannot be linked back to you as an individual and may be used to conduct research and analysis.  This includes the preparations of statistics for use in our reports.

Your rights

Your rights are set out in the Data Protection legislation and include:

  • the right to access your personal information
  • to request rectification or erasure of certain personal information
  • to object to processing in certain circumstances
  • the right to withdraw any consent you may have given to process your personal information
  • the right to restrict processing activity in certain circumstances
  • the right to object to certain types of processing activity
  • the right to request that your data is ‘ported’ (i.e. transferred) to you or an appointed third party

If you wish to exercise any of these rights please contact our Information Governance team on informationgovernance@wealden.gov.uk in writing or by completing our online form.

If you have concerns about how we use your personal data, you have the right to make a data protection complaint directly to us. You can raise a complaint by following the Council’s Complaints Procedure. We will acknowledge your complaint and investigate it without undue delay. We will keep you informed of progress and notify you of the outcome. If you are not satisfied with our response, you have the right to escalate your complaint to the Information Commissioner Office.

Data Protection Officer

If you have any questions about how your personal data is handled, you can contact our Data Protection Officer (DPO) at dataprotection@wealden.gov.uk