Lewisham Council Homepage Skip navigation
navigation-end

Privacy notice – Information Governance

Information about how and when the Information Governance Team processes personal information about you.​

What we do

Information Governance provide advice and support to Lewisham Council employees. We are responsible for data protection rights requests (including subject access requests), data protection complaints made by the general public and investigating data security incidents.

What information we collect

Information we collect about you may be provided by you or we may process your personal information provided by agencies for the purpose of responding to data protection complaints, data security incidents or for the prevention and detection of crime and fraud.

Personal data we may collect includes your:

  • name
  • contact details
  • family details
  • employment and education details
  • student and pupil records
  • case file information
  • goods and services
  • business activities

Sensitive personal data we may collect includes your:

  • physical or mental health details
  • offences, including alleged offences
  • criminal proceedings, outcomes and sentences
  • trade union membership

Agencies we might share the information with

  • Police
  • Other local authorities
  • Contracted suppliers
  • Regulatory bodies
  • Other Lewisham Council services
  • Government departments
  • NHS and NHSD

Why we process your information

We may have a statutory obligation to share your personal information with agencies listed above. We may also share personal information when investigating data protection complaints, data security incidents or for the prevention and detection of crime and fraud.

Our legal basis for using your personal data is because it is necessary to perform a public task or we have a legal obligation.

Our legal basis for using your sensitive personal data is under a substantial public interest and the establishment or defence of legal claims.

How long will we retain your personal information?

We will retain your information for the minimum required length of time in line with our Records Management policy. Information used to respond to data protection rights requests will be retained for 2 years.

Your data protection rights