Adult social care privacy notice

The data controller for the information we collect

This Privacy Notice is provided to meet the requirements of the UK General Data Protection Regulation (GDPR) and the Data Protection Act 2018 (DPA) to explain how we process your personal data in delivering Adult Social Care Service.

Leeds City Council is the data controller for the purposes of the Data Protection Act 2018 and other regulations, including the UK General Data Protection Regulation, which means it determines what your data is used for and why it is collected. The registered address of the controller is Leeds City Council, Merrion House, 110 Merrion Way, Leeds, LS2 8BB.

The data we will collect

To deliver the service, we will process the following data:

  • name
  • address, including email
  • date of birth
  • financial information
  • support needs
  • safeguarding and deprivation of liberty (where applicable)
  • relationships (carers/appointees)

Special category (including finance data):

  • personal data revealing racial or ethnic origin
  • personal data revealing religious or cultural needs
  • data concerning health (mental health)
  • data concerning a person’s sexual orientation

Criminal offence data:

  • information related to criminal offences and investigations
  • allegations of offences

How we collect information about you

We collect information about you from you directly (for example, via email, via the telephone, or face-to-face).

We may also obtain your information from other sources, such as:

  • your family members, carers or other persons acting on your behalf
  • internal council departments
  • other public authorities
  • NHS trusts

Why we process your data

We use your information to help us to support you, facilitate your care, and, where needed, protect you from harm.

All the data collected will be treated in strict confidence and in accordance with the requirements of the Data Protection Act 2018 and the UK General Data Protection Regulation (UK GDPR). The data provided by you will only be used for the purposes specified.

Lawful basis for processing

We collect and hold your information to enable us to comply with a legal obligation or because we are acting in the public interest or exercising a public task under our official authority. Our service also needs to use sensitive personal data relating to you (also called special category data), which requires more protection by us to keep it safe.

We will process your data in accordance with UK GDPR Article 6(1). The processing shall be lawful only if and to the extent that the following applies:

Article 6(1)(a): the data subject has given consent to the processing of his or her personal data for one or more specific purposes

Article 6(1)(c): processing is necessary for compliance with a legal obligation to which the controller is subject

Article 6(1)(d): processing is necessary in order to protect vital interests of the data subject or of another natural person

Article 6(1)(e): processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller. 

This is supported by the following legal framework:

  • Care Act 2014
  • Mental Capacity Act 2005
  • The Mental Health Act 1983
  • Human Rights Act 1998
  • Health & Social Care Act 2008 &2012
  • Deprivation of Liberty Regulations
  • Children and Families Act 2014
  • Equality Act 2010
  • Reporting of Injuries, Diseases and Dangerous Occurrences Regulations 2013
  • HSE under the Health and Safety at Work Act 1974
  • 1996 Housing Grants Regeneration and Construction Act

We will process your special category data in accordance with UK GDPR Article 9(2). The processing shall be lawful only if and to the extent that the following applies:

Article 9(2)(a): the data subject has given explicit consent to the processing of those personal data for one or more specific purposes;

Article 9(2)(g): Substantial public interest laid out in law (need to list at least one of 23 specific substantial public interest conditions set out in Part 2 of Schedule 1 of the DPA 2018);

Article 9(2)(h): Health and social care as laid out in law (If you are relying on this condition, you also need to meet the associated condition in UK law, set out in Part 1 of Schedule 1 of the DPA 2018).

The processing of special category data under Article 9 and criminal offence data under Article 10 are further supported by the following conditions in Schedule 1, Parts 1, 2, and 3:

  • 1. Employment, social security and social protection
  • 2. Health or social care purposes
  • 6. Statutory and government purposes
  • 11. Protecting the public
  • 18. Safeguarding of children and individuals at risk
  • 23. Elected representatives responding to requests
  • 24. Disclosure to elected representatives

All the listed conditions require an Appropriate Policy Document to be in place, which sets out and explains the procedures for securing compliance with the principles in Article 5 and policies regarding the retention and erasure of such personal data. Our Appropriate Policy Document provides further information about this processing and supplements this privacy notice.

Withdrawing your consent

You have the right to withdraw your consent. This will not stop you from receiving care but may limit how we are able to support you. To help you decide, we will discuss with you how this may affect our ability to provide you with care and any other options you have. There may be instances when we need to share your information, even if you have told us that you do not want us to do this.

Data retention, storage and destruction

Our data retention policies and procedures are designed to help ensure that we comply with our legal obligations in relation to the retention. We are required by law to keep your information for varying lengths of time depending on individual circumstances and business requirements. This information is set out in our retention schedule. After this, your information will be deleted or archived. 

More information can be given to you on request by emailing leedsadults@leeds.gov.uk or can be found online.

Who we share your data with

Where we need to share your personal information, we will do this in line with the law (the main laws are the Data Protection Act 2018 and the UK General Data Protection Regulation).

We will only share the information that we feel is relevant for these purposes.

We will make sure that your information is kept secure and safe and is only seen by the staff who are supposed to see it.

We will ensure that secure methods are used when it is sent to other organisations.

We share your data with agencies shown below as follows:

  • NHS (such as GPs, hospitals, district nurses)
  • service providers (such as home care residential, day care, and personal assistants)
  • voluntary and community organisations
  • other local authorities
  • other departments within Leeds City Council
  • police
  • HSE (Health & Safety Executive)
  • ambulance services (including private transport)
  • nearest relatives under the meaning of the Mental Health Act ( when necessary and within parameters)

In addition, we will share your personal data:

  • where such disclosure is necessary for compliance with a legal obligation to which we are subject
  • in order to protect your vital interests or the vital interests of another natural person
  • for the purposes of security and prevention of fraud and other criminal activity
  • where such disclosure is necessary for the establishment, exercise, or defence of legal claims, whether in court proceedings or in an administrative or out-of-court procedure

 

Automated decision making

Your data will not be used for any automated decision-making, including profiling.

Your rights

The following rights under data protection law are available under the UK GDPR:

  • the right to access—you can ask for copies of your personal data
  • the right to rectification—you can ask us to rectify inaccurate personal data and to complete incomplete personal data the
  • the right to erasure (where you can ask us to erase your personal data)
  • the right to restrict processing—you can ask us to restrict the processing of your personal data
  • the right to data portability (where you can ask that we transfer your personal data to another organisation or to you)
  • the right to object to processing (where you can object to the processing of your personal data) and
  • the right to complain to a supervisory authority—you can complain about our processing of your personal data the right to
  • withdraw consent (to the extent that the legal basis of our processing of your personal data is consent, you can withdraw that consent)

All data rights apply where we process your information based on your consent.

Where we process your information under legal obligation, certain rights to do not apply, such as erasure, data portability, objection to processing and the right to withdraw consent.

Where we process your data under the public task basis, the following data rights do not apply: 

  • the right to erasure
  • the right to portability
  • the right to withdraw consent

Where we process your information under vital interests basis, certain rights do not apply, such as:

  • data portability
  • the right to objection to processing
  • the right to withdraw consent.

All the rights are subject to certain limitations and exceptions. You can learn more about your rights through ‘Your individual rights and how to exercise them' and the Information Commissioner's Office site. You may exercise any of the above rights in relation to your personal data by writing to us using the contact details provided below.

If your data is sent to other countries

The information you provide will not be transferred to another country outside of the UK.

Contact us

Any queries in relation to this privacy notice should be forwarded to:

Email:  leedsadults@leeds.gov.uk

Data Protection Officer

Aaron Linden
Head of Information Management and Governance - Data Protection Officer
Leeds City Council
Merrion House
110 Merrion Way
Leeds
LS2 8BB

DPO@leeds.gov.uk 

The council privacy notice is available online.

Complaints

If you are unhappy with the way in which your information has been handled, you should speak with the specific service in the first instance.

Any data protection complaints about how the council has processed your personal data will be handled in accordance with the council’s complaints policy. You can find out how to submit a complaint.

If we cannot resolve your complaint, you can refer to the Information Commissioner if you consider that there has been an infringement of data protection legislation. Further details can be found on the Information Commissioner’s website.

Changes to this notice

We keep our privacy notice under regular review. We will notify you of significant changes to this notice by email or other means as appropriate. This privacy notice was last updated February 2025.