Devon County Council (DCC) is collecting and or processing your personal data as a Data Controller under Data Protection Legislation and our ICO registration number is Z6475582. This privacy notice concerns the processing of personal data that takes place by our Integrated Adult Social Care Service.

This notice explains what information we collect, why we collect it and how we keep it secure. It also explains your rights and our legal obligation. Should you wish to find out more about Devon County Council’s data protection policies please contact our Data Protection Officer.

The Council is committed to meeting its data protection obligations and handling your information securely.

We will notify you of any changes to this privacy notice

This privacy notice was last updated 20/11/2025. If we use your personal data for any new purposes, updates will be made to the policy information and changes communicated, where necessary in accordance with current data protection legislation. Any queries relating to this privacy notice please contact the Data Protection Officer.

What information are we processing?

To deliver adult social care services we need to collect and use your personal data in several ways depending on the level of care / support being provided to you. We will also collect information about you if you are a carer so that we can provide support to you. For some services only limited personal data will be processed. The information we collect is detailed below: –

Personal information such as, your name, contact details (address, email address and telephone number), date of birth, nationality, gender, financial details, employment details, care services provided, housing needs, individuals who support you / you support, National Insurance Number, NHS Number.

Special category data such as your ethnicity, information about your physical and mental health. We may also process information about your religious and philosophical beliefs, sex life or sexual orientation.

How we collect your personal data

We collect your information from you directly (e.g. by asking you to complete one of our forms online, via the telephone through our contact centre or face-to-face). We may also obtain your information from other sources such as: –

your family members, carers or other persons acting on your behalf
internal Council Departments
NHS Trusts
health service providers, such as GPs and hospitals
care providers and support networks
care agencies
other councils
housing providers
Care Quality Commission (CQC)
Councillors and MPs
Department for Work and Pensions (DWP)
Devon Safeguarding Adult Board
partner agencies, such as voluntary organisations and other statutory organisations (police, etc.)

How will we use your personal data

Your personal data might be used to: –

provide you with advice and guidance on the services offered by adult social care, health care providers and community-based services as appropriate
fully understand your needs
identify services and/or support
understand your previous health and care support
carry out an assessment of your needs
delivery of services or commissioning of services to be carried out on behalf of the Council
sign post you to services available to you
request and arrange installation of specialist equipment for you
arrange short/long term care solutions
create a secure and comprehensive record of all the work that we do with and for you
promote your health and wellbeing in partnership with other agencies i.e., Health services
liaise with agencies, companies, and charities on your behalf
assess your financial contribution to your care
work with you or your representative to create a Protection / Safety Plan
endeavour to keep you safe from harm and investigate safeguarding concerns
process complaints and compliments regarding the services we have provided
enable the regulator to carry out inspections and peer reviews, and also investigations which they are legally required to conduct
analyse the service that we are providing and ensure that it continually evolves.
comply with our legal obligation to submit mandatory returns to NHS Digital/NHS England, to allow them to assist us with our statutory functions of monitoring, developing more effective prevention strategies, designing, and implementing new payment models and for local strategic planning and commissioning purposes

Purpose of collecting or processing your personal data

We need to use this personal, and often sensitive information, to:-

help make the right decisions about the type of service, healthcare, or treatment you need
provide appropriate support and care for Adult Social Care purposes
assess whether our services are making a difference
develop and improve services and measure how well the council is doing
administer and protect public funds

We may use your contact details to ask if you would like to provide feedback or take part in local or national surveys about social care administer and protect public funds

The legal basis for us collecting your personal data

When we collect your personal data, we rely on the following legal bases:-

processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller
processing is necessary for compliance with a legal obligation to which the controller is subject
processing is necessary in order to protect the vital interests of the data subject or of another natural person

When we collect your ‘special categories of personal data’, (such as health, race, ethnicity, sexual orientation) we rely on the following legal bases:-

processing is necessary to protect the vital interests of the data subject or of another natural person where the data subject is physically or legally incapable of giving consent
processing is necessary for reasons of substantial public interest
processing is necessary for the provision of health or social care or treatment or the management of health or social care systems and services

The Council can rely on the legal bases above under various UK laws these include but, are not limited to:-

The Care Act 2014
The Health and Social Care Act 2012
The Health and Social Care (Quality and Safety) Act 2015
The Mental Capacity Act 2005
Mental Health Act 1983 & 2007
Local Safeguarding Children & Adult Boards Regulations 2006 (SI 2006/90)
The Localism Act 2011
The Crime and Disorder Act 1998
Human Rights Act 1998
Equalities Act 2010

Health and Social care services will often ask for your consent to engage with them however, this may not be the legal basis they are relying on to process your information. If the Council is relying on your consent to process your data this will be explained separately along with the right to withdraw consent at any time.

Who we may share your personal data with

The Council will collect and use your personal information in order to provide Adult Social Care services effectively and to meet our statutory duties under the Care Act 2014, and other relevant legislation. Sometimes some of the information held needs to be shared with staff working in other Council departments, and with the NHS, Police and other agencies or organisations working on our behalf. This is to ensure that you receive appropriate care, support and treatment. Sharing this information also helps to avoid you being asked for the same information more than once.

In order to be able to better commission the services we provide to you, we share adult social care information with the Devon Integrated Care System. Joining this information with NHS data will allow us to provide better quality services. You cannot be identified from this sharing.

Under the direction known as the Collection of Client-Level Adult Social Care Data (No.2) we will share certain identifiable information with NHS England/NHS Digital.This sharing assists us to fulfil our statutory functions under Part 1 of the Care Act 2014, and is required in exercise of the powers conferred by section 259(1)(a) of the Health and Social Care Act 2012.

We may also share aggregated social care data with partners for the purposes of assisting us with analysis. This data may be shared via secure email or through PowerBI dashboards that have been set up to support research and analysis.

Your information may also be shared with organisations such as the emergency services, NHS, and others for the purpose of enabling the council to prepare for, respond and recover from emergencies that may affect the area (such as flooding). This is in line with the council’s responsibilities under the Civil Contingencies Act 2004. Wherever possible we will discuss with you the reasons for sharing information and listen to your views. When sharing information we do so in line with the Data Protection Act and agreed information sharing protocols. We will not share your information without a legal basis to do so.

There are some circumstances where we may share information without needing to discuss this with you, including where:-

we believe there is a risk of serious harm to you or someone else
we are required to share information by law
we are required to by the Courts
the Police need information in relation to a criminal investigation

Information may need to be shared with the Care Quality Commission (CQC) to enable them to carry out their role as the regulator of health and social care in England. This could include carrying out inspections and peer reviews, and investigations which they are legally required to conduct. For inspections, in most circumstances we will endeavour to only provide anonymised information however, in rare circumstances copies of a person’s record may be required. You can read their privacy notice here: CQC Privacy Notice.

As noted above, to provide you with services and support it is likely that we will need to share some of your information with one or more of the following:

our providers, such as care providers and equipment providers
commissioned service providers
other charitable and voluntary sector partners
health service providers, including NHS agencies (e.g. GPs, hospitals, ambulance, health visitor, mental health services)
Devon Safeguarding Adult Board
Cabinet Office for the National Fraud Initiative (NFI)
Devon and Somerset Fire and Rescue
Workforce Development Team
the Police
Legal Services
advocacy services
Direct Payment support services
Direct payment pre-payment card providers
supported lodging or semi-independent accommodation providers
Locality Hubs
Government departments and agencies
other local authorities

Other individuals and organisations working with you so that everyone understands your needs and circumstances.

Devon County Council have also engaged the services of a Transformation Partner, Newton Consulting Ltd who are helping the Council to identify opportunities to transform our services to enable better outcomes for the people we service. As part of their work, it will be necessary to share information with them to support their work as one of our processors. Any sharing that takes place will be undertaken securely and will be regulated by a robust contract.

The Devon and Cornwall Shared Care Record

The Devon and Cornwall Care Record brings together patient data from a number of health and social care providers and presents it as a single record.

This new system enables frontline staff to see details held by GP practices, hospitals, care homes and other organisations across Devon, Cornwall and the Isles of Scilly, giving them a more complete view of a patient’s history.

More information about the Devon and Cornwall Shared Care Record.

International transfers

Devon County Council does not intend to transfer your personal data to countries outside of the scope of UK data protection laws. However, if this is required for whatever reason, we will ensure that such transfers comply with our obligations under Chapter 5 of the UK GDPR.

How long will we hold your personal data?

Devon County Council will retain your personal data in accordance with our Adult Social Care Record Retention Schedule.

Your data protection rights

Under Data Protection Legislation, you have the right to obtain a copy of their personal records held by us, this is called a Subject Access Request (SAR).

Further details on your rights under data protection legislation and how to exercise them.

Complaints

If you have any comments, queries or complaints about this privacy notice or the processing of your personal data please contact our Data Protection Officer.

Alternatively, if you are not happy with the way that DCC is handling your personal data, you are entitled to appeal to the Information Commissioners Office (ICO). The Information Commissioners Office enforces and oversees the Data Protection Regulations.

If you would like to contact the ICO please visit their website.

Automated decisions and Artificial Intelligence

Please note that Devon County Council does not intend to use your personal data to make automated decisions that might have a legal affect on you. However, we may use Artificial Intelligence services to support us administrative tasks such as minute taking, summarising documents, improving the accessibility of our communications and to help us organise meeting agendas etc.

If we use Artificial Intelligence tools to help us we will ensure that the outputs from these tools are properly scrutinised, and we will only use tools that have been assessed as providing appropriate levels of security to protect the personal data they are processing.