Privacy

Privacy notice for Legal Services – SEN Tribunal

Devon County Council (DCC) is collecting and/or processing your personal data as a Data Controller under Data Protection Legislation and our ICO registration number is Z6475582.  This privacy notice concerns the processing of personal data that takes place by DCC’s Legal Services for the purposes of SEN Tribunal; therefore, may also relate to the collecting and/or processing of your child’s personal data.

This notice explains what information we collect, why we collect it and how we keep it secure. It also explains your rights and our legal obligation. Should you wish to find out more about Devon County Council’s data protection policies please contact our Data Protection Officer.

We will notify you of any changes to this privacy notice

This privacy notice was last updated January 30th 2026. If we use your personal data for any new purposes, updates will be made to the policy information and changes communicated, where necessary in accordance with current data protection legislation.  Any queries relating to this privacy notice please contact the Data Protection Officer.

What information are we processing?

We may collect, store or otherwise process information about you or your child which may include:

  • personal information (such as name, address, date of birth).
  • special category information (health data).
  • information relating to your interactions with Devon County Council and the services that we provide.
  • information you provide to us as part of your interactions with Devon County Council.
  • Information provided to us by your child’s educational setting.

Purpose of collecting or processing your personal data

DCC may need to collect or otherwise process your personal data so that we can;

  • understand you and your child or young person’s needs in order to provide appropriate services and/or support.
  • measure whether our services are improving outcomes for children and young people with SEND.
  • help us develop and improve our services.
  • complete statistical returns to government departments.
  • prepare legal documents, such as contracts.
  • conduct litigation on behalf of the Council.

The legal basis for us collecting your personal data

Where we are collecting personal data about you for the provision of one of the purposes outlined in this privacy notice, we rely upon:

Article 6(1)(c) – processing that is necessary for DCC to fulfil a statutory obligation.

We also rely upon the following legislation to process this data:

  • The Children and Families Act 2014.
  • The Tribunal Procedure (First Tier Tribunal) (Health, Education and Social Care Chamber) Rules 2008.
  • The Special Educational Needs and Disability Regulations 2014.
  • The Special Educational Needs (Personal Budgets) Regulations 2014.
  • The Special Educational Needs and Disability (Detained Persons) Regulations 2015.
  • The Children and Families Act 2014 (Transitional and Saving Provisions) (No 2) Order 2014).

Personal data that is collected for any of the purposes outlined in this notice is never used for direct marketing purposes and is not sold on to any other third parties.

Recipients or categories of recipients that we may share your personal data with

To deliver tribunal services to you, it may be necessary for us to share your personal data with the following organisations:

  • Internal departments.
  • Schools, including non – maintained special schools.
  • Further education colleges and sixth form colleges.
  • Academies (including free schools, universities, technical colleges).
  • Pupil referral units.
  • Independent schools and independent specialist providers.
  • Early years providers in the maintained, private, voluntary and independent sectors.
  • The First-tier Tribunal (Special Educational Needs and Disability).
  • External contractors that provide services on our behalf as a data processor, such as external solicitors.
  • Agencies with whom we have a duty to co-operate, such as police.

If we feel that it is necessary to share personal data with professionals to ensure you or your child is safeguarded from harm, we rely upon the provisions of the Safeguarding Vulnerable Groups Act 2006 and Children Act 1989 & 2004.  Where it is necessary to share medical or social care information for these purposes, we rely upon article 9(2)(h) of the General Data Protection Regulation (information necessary for medical diagnosis, the provision of health or social care or treatment or the management of health or social care systems).

We may also need to share some personal data about you, so that we can support third party organisations to discharge their regulatory requirements.  This includes organisations such as;

  • The data protection regulator (the Information Commissioner’s Office).
  • The Care Quality Commission.
  • Ofsted.

We may also share information to enable us to comply with court orders and other legal obligations.  If this is necessary, we will only share the minimum amount of personal data needed for this purpose.

How long will we hold your personal data?

We will retain your personal data for only as long as is necessary, and in line with our organisations record retention schedules.

Automated decisions

No automated decisions are taken using personal data provided for the purposes of special educational needs and disabilities (SEND) service delivery.

International transfers

Devon County Council does not intend to transfer your personal data to countries outside of the scope of UK data protection laws. However, should this become necessary for whatever reason, we will always ensure that appropriate and lawful controls are implemented to safeguard any transfers.

Such controls will include:

  • Ensuring that the recipient country is the subject of an adequacy decision under UK GDPR legislation.
  • There is a legally binding and enforceable instrument between public authorities or bodies.
  • There are binding corporate rules in place in accordance with Article 47 of the UK GDPR.
  • There are standard data protection clauses adopted by the Commission in accordance with the examination procedure referred to in Article 93(2) of the UK GDPR.
  • There are standard data protection clauses adopted by a supervisory authority and approved by the Commission pursuant to the examination procedure referred to in Article 93(2) of the UK GDPR.
  • An approved code of conduct pursuant to Article 40 of the UK GDPR is in place, together with binding and enforceable commitments of the controller or processor in the third country to apply the appropriate safeguards, including as regards data subjects’ rights; or
  • An approved certification mechanism pursuant to Article 42 of the UK GDPR in place, together with binding and enforceable commitments of the controller or processor in the third country to apply the appropriate safeguards, including as regards data subjects’ rights.

Your data protection rights

Under Data Protection Legislation, you have the right to obtain a copy of your or your child’s personal records held by us, this is called a Subject Access Request (SAR).

Further details on your rights under data protection legislation and how to exercise them.

Complaints

If you have any comments, queries or complaints about this privacy notice or the processing of your personal data please contact our Data Protection Officer.

Alternatively, if you are not happy with the way that DCC is handling your personal data, you are entitled to appeal to the Information Commissioners Office (ICO). The Information Commissioners Office enforces and oversees the Data Protection Regulations.

Contact details are below:

Information Commissioner’s Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF

Email: casework@ico.org.uk