People Services (Human Resources, Organisational Development and Culture) processes personal information relating to job applicants, employees, workers, apprentices, volunteers and former employees.
This privacy notice explains how Cheshire East Council collects, uses, stores and shares your personal information in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.
Customer Experience services are covered by a separate privacy notice.
What information we collect
We may collect and process:
- personal details such as name, address, contact details, date of birth and employee number
- recruitment information, including applications, CVs, references, qualifications and employment history
- employment information, including contracts, working arrangements, attendance, training, performance and conduct records
- financial information, including payroll, pension, National Insurance and bank details
- emergency contact and next of kin information
- special category information, such as health information, disability information, ethnic origin, religion or belief, sexual orientation and trade union membership where relevant
- criminal convictions and DBS information where required for your role
Why we use your information
We process personal information to:
- recruit and employ staff.
- administer contracts, pay, pensions and employment benefits.
- manage attendance, leave, performance and employee relations matters.
- provide workplace support, wellbeing services and reasonable adjustments, including occupational health referrals
- meet our safeguarding, health and safety, equality and employment law obligations.
- deliver training and workforce planning.
- maintain employment records.
- protect council systems, assets and services.
- respond to legal claims and statutory requests.
Our lawful basis for processing
Under Article 6 UK GDPR, we rely on one or more of the following lawful bases:
- Article 6(1)(b) Contract - processing necessary for the performance of your employment contract or to take steps before entering into a contract.
- Article 6(1)(c) Legal Obligation - processing necessary to comply with employment, safeguarding, health and safety, tax, pension and other legal obligations.
- Article 6(1)(e) Public Task - processing necessary for the Council to perform its statutory functions and duties as a local authority.
- Article 6(1)(f) Legitimate Interests - in limited circumstances, where necessary to protect Council interests, prevent fraud or establish, exercise or defend legal claims.
- Article 6(1)(a) Consent - where consent is required for specific voluntary activities or services and no other lawful basis applies.
Special category and criminal offence information
Where we process special category personal information, we rely on one or more of the following conditions under Article 9 UK GDPR:
- Article 9(2)(b) - employment, social security and social protection obligations.
- Article 9(2)(g) - substantial public interest, including safeguarding and equality monitoring.
- Article 9(2)(h) - occupational health and assessment of working capacity.
- Article 9(2)(a) - explicit consent where no other lawful basis applies.
Where criminal offence information is processed, including DBS checks, this is undertaken in accordance with Article 10 UK GDPR and the Data Protection Act 2018.
Who we share information with
Information may be shared where necessary with:
- Managers and authorised Council employees.
- Payroll, pension and occupational health providers.
- HMRC, the Department for Work and Pensions and other government bodies.
- Training providers and professional bodies.
- Disclosure and Barring Service (DBS).
- Regulators, courts, tribunals and law enforcement agencies.
- Organisations providing services on behalf of the Council.
We only share information where there is a lawful basis to do so.
Where we obtain information from
We collect information directly from you and may also receive information from:
- Recruitment agencies.
- Referees and previous employers.
- Occupational health providers.
- DBS.
- Government departments and regulators.
- Training providers and professional bodies.
- Managers and colleagues.
How long we keep information
We retain personal information in accordance with the Council's Records Retention Schedule and legal requirements. Information may be retained after employment ends where necessary to comply with legal obligations or manage legal claims. See the Council’s Information Asset Register for detailed retention schedules
How we protect information
We use appropriate technical and organisational security measures to protect personal information and restrict access to authorised individuals who require it for their role.
Where third parties process information on our behalf, we require them to meet appropriate security and data protection standards through contracts, data sharing agreements, or acceptable use agreements.
International transfers
Personal data used by People Services is not routinely transferred outside the UK. However, where personal information is transferred outside the UK, the Council ensures appropriate safeguards are in place in accordance with UK GDPR requirements.
Further information
Information about your data protection rights and how to make a complaint can be found in Cheshire East Council's Corporate Privacy Notice.
If you have any questions about this privacy notice, please contact Human Resources or the Council's Data Protection Officer.