Getting access to your information

Norfolk County Council collects and uses certain types of information about people we work with. The General Data Protection Regulation sets out that all personal information must be dealt with properly however it is collected, recorded and used - whether on paper, in a computer, or on other material. The Council is committed to only using your information for its intended purpose and to keeping your information safe at all times.

The Regulation gives anyone the right to find out about the information held about them.

How to ask for your information

You need to make your request to the Council and it would be helpful if you could complete our electronic form:

Make a subject access request

Please note that any information you upload on the above form will be held securely in line with GDPR requirements.

If you are unable to complete the electronic form, we have a downloadable information request form (PDF) [267KB] that you can fill in and send to us.

You can also write to us or call our customer service centre, providing enough information for us to identify you in our records - such as name, address and date of birth. You need to tell us whether you are interested in all the information we hold about you or just specific areas, eg from a certain department, date range, etc. 

Proof of identity and address

When we receive a request for information, we must make sure that you are who you say you are.

Unless the staff handling your request know you and recognise you, we need to see proof of identity.  This can be a copy of your passport, birth certificate or other official document bearing your signature.  We also need to see proof of your current address.  This can be a copy of your driving licence or utility bill for example.

Making a request on behalf of a child

Children have the right to request their own information. Adults with parental responsibility can apply on their child's behalf where the child is too young to understand.  It is important for you to know that even when a child is too young to understand, an adult making the request is acting on behalf of the child and not in their own right.

Before responding to a request for information about a child, we will consider whether the child is mature enough to understand their rights.  If we can be confident the child does broadly understand what it means to make a subject access request and how to interpret the information they receive we will respond directly to them.

The information the Council holds about children is mainly in areas such as social care but it does hold some educational information, such as special educational needs.

Most educational records are maintained by schools; as such, any requests should normally be made to the relevant school, not to the Council.

Parents interested in their children's educational records have a separate right of access to these under the Education (Pupil Information) (England) Regulations 2005 regardless of their children's ages, and they should normally apply to the school for these records. Requests for educational records should be fulfilled within 15 school days, whether they are made under the Regulation or under the Education (Pupil Information) (England) Regulations 2005

Acting on behalf of someone else

You may ask someone else to make a request on your behalf.  This might be a family member or professional person, such as your solicitor.

If you ask someone else to act on your behalf, we will need to be satisfied that the person making the request is entitled to do this and it will be their responsibility to provide evidence of this entitlement.  For example, this could be a letter providing your consent for the person to make the request or a legal power such as a Power of Attorney (for Health and Welfare).

Where requests are made on behalf of adults, the Council needs to check that the person making the request has the right to do so and the request is made in the person's best interests. If the data subject has capacity he or she can fill in a downloadable personal information authorisation form (PDF) [97KB] and give it to the person making the request on their behalf.

What the Council does to provide the information

Norfolk County Council is obliged by the General Data Protection Regulation to comply with your request within one month of receipt (or of receiving proof of identity or clarification of what is required).

We will tell you whether we hold the information requested, and, if we do, we will give you a description of the information, the purposes for which it is being processed, the types of people to whom the information may be disclosed, and the source of the information. We will do this by providing you with our privacy notice, you can read all our privacy notices on our website or ask for a copy to be given to you.

We should give you a copy of the information, but there may be occasions when you agree to visit us to view the information instead.

We are obliged to check whether any of the information is exempt as defined in the Data Protection Act 2018 and cannot be provided.

In particular we must consider other people's rights under the Data Protection Act 2018, and if your information contains information about other living individuals, we must consider whether it would be lawful and fair to them to disclose it.  We will ask you about seeking consent from other people.

What should you do if you're not satisfied

If you wish to appeal or if you are unhappy with the way in which your matter has been handled in general, you have the right to apply to the Information Commissioner. They can make a decision whether your request for information has been dealt with in accordance with the requirements of the UK GDPR and the Data Protection Act 2018.

Contact details:

Information Commissioner's Office
Wycliffe House, Water Lane
Wilmslow, Cheshire, SK9 5AF

Telephone: 0303 123 1113

Information Commissioner's Office website

The Information Commissioner is an independent supervisory authority responsible for data protection and freedom of information.

Other rights under the General Data Protection Regulation

The Regulation gives you the right to ask us to delete information about you, this is often known as the right to be forgotten.  It is important for you to know that the right to request deletion of your information is not the same as a right to demand it is done and there may be some circumstances when we cannot meet a request for erasure.

If we refuse your request for the right to erasure we will tell you why and what steps you can take next.

The regulation also gives you the right to ask us to stop doing something with your information, this is known as the right to restrict processing.  As described above, this is a right to make the request not an automatic right for it to be done and is subject to certain circumstances.

If we refuse your request for the right to restrict processing we will tell you why and what steps you can take next.

The Regulation also gives you the right to receive your information in a format that you can easily use, to request that we stop processing altogether and to prevent automatic decision-making that has no human involvement.

This information was updated in May 2018