This privacy policy applies only to Northamptonshire County Council (NCC). If you transfer to another site, please read the privacy policy relating to their information. We will not transfer personal information to other sites, unless you have been advised that we will do so.

We are updating this privacy notice and our service specific privacy notices to reflect changes we have made as part of our ongoing commitment to be transparent about how we use your data and keep it safe. We have included changes to address the new standards introduced by the European data protection law, known as the General Data Protection Regulation (GDPR), and the new Data Protection Act 2018. The privacy notices will also be updated in line with any new recommendations by the UK Regulator, the Information Commissioner.

Our privacy notices set out how we, Northamptonshire County Council (NCC), collect, store and handle your personal information and what your information rights are. Your rights will vary with the service being used. We provide a wide range of public services, so one notice for all services may not give you enough detail. You can also find links to further notices for each service area in the buttons below. There may be a service specific privacy notice for you to find out how your information is used and your rights.


The Secretary of State for Health & Social Care has given notice under Regulation 3(4) of the Health Service Control of Patient Information Regulations 2002 that the Council is required to process and share necessary health and social care data for the following purposes:

  • understanding Covid-19 and risks to public health, trends in Covid-19 and such risks, and controlling and preventing the spread of Covid-19 and such risks
  • identifying and understanding information about patients or potential patients with or at risk of Covid-19, information about incidents of patient exposure to Covid-19 and the management of patients with or at risk of Covid-19 including: locating, contacting, screening, flagging and monitoring such patients and collecting information about and providing services in relation to testing, diagnosis, self-isolation, fitness to work, treatment, medical and social interventions and recovery from Covid-19
  • understanding information about patient access to health services and adult social care services and the need for wider care of patients and vulnerable groups as a direct or indirect result of Covid-19 and the availability and capacity of those services or that care
  • monitoring and managing the response to Covid-19 by health and social care bodies and the Government including providing information to the public about Covid-19 and its effectiveness and information about capacity, medicines, equipment, supplies, services and the workforce within the health services and adult social care services
  • delivering services to patients, clinicians, the health services and adult social care services workforce and the public about and in connection with Covid-19, including the provision of information, fit notes and the provision of health care and adult social care services; and
    research and planning in relation to Covid-19

 Please view our Covid-19 response privacy notice for full details of how the council will use your data during the pandemic.

​Service specific privacy notices

Your privacy

Northamptonshire County Council is registered with the Information Commissioner’s Office (ICO) as a ‘data controller’ under the Data Protection Act, entry Z7589390. We are a public authority and have a nominated Data Protection Officer who makes sure we respect your rights and follow the law.

If you have any concerns or questions about how we look after your personal information, please contact the Data Protection Officer at Address post to:

Data Protection Officer
Northamptonshire County Council
One Angel Square
Northampton, NN1 1ED

You can also call 01604 368 360 and ask to speak to the Data Protection Officer.

How and why we use your personal information

Information which you have provided the Council will be stored securely. It will be used for the purposes stated when the information was collected.

Information will not be sold, rented or provided to anyone else, or used for any other purpose than that for which it was originally collected unless required to by law.

We are required under Section 6 of the Audit Commission Act 1998 to participate in the National Fraud Initiative data matching exercise. The data held will be used for cross-system and cross authority comparison for the prevention and detection of fraud. For further information see the National Fraud Initiative webpage.

Since April 2013, The Health and Social Care Act 2012 has given local authorities the power to perform public health functions. This means that the County Council has "a duty to improve the health of the people and responsibility for commissioning appropriate public health services" and the statutory responsibilities for public health services are clearly set out in the Health and Social Care Act 2012. See the 'Public Health' section below for further details.

​Personal information can be anything that identifies and relates to a living person. This can include information that when put together with other information can then identify a person. For example, this could be your name and contact details. 

As part of our statutory and corporate functions, we process special category data and criminal offence data in accordance with the requirements of Article 9 and 10 of the General Data Protection Regulation (‘GDPR’) and Schedule 1 of the Data Protection Act 2018 (‘DPA 2018’).

Special category data is defined at Article 9 GDPR as personal data revealing:

  • Racial or ethnic origin
  • Political opinions
  • Religious or philosophical belief
  • Trade union membership
  • Genetic data
  • Biometric data for the purpose of uniquely identifying a natural person
  • Data concerning health
  • Data concerning a natural person’s sex life or sexual orientation

Article 10 GDPR covers processing in relation to criminal convictions and offences or related security measures. In addition, section 11(2) of the DPA 2018 specifically confirms that this includes personal data relating to the alleged commission of offences or proceedings for an offence committed or alleged to have been committed, including sentencing. This is collectively referred to as ‘criminal offence data’.

Schedule 1 of the DPA 2018 provides conditions for processing special category and criminal offence data and some of these conditions require us to have an Appropriate Policy Document (‘APD’) in place, setting out and explaining our procedures for securing compliance with the principles relating to the processing of personal data in Article 5 of the GDPR and policies regarding the retention and erasure of such personal data.

Conditions for processing special category and criminal offence data

Our processing of special category and criminal offence data for law enforcement purposes is not covered in this document. Processing for law enforcement purposes is carried out by us in our capacity as a competent authority and falls under Part 3 of the DPA 2018 and is the subject of a separate document.

We process special categories of personal data under the following GDPR Articles:

  • Article 9(2)(b) – where processing is necessary for the purposes of performing or exercising obligations or rights which are imposed or conferred by law on us or the data subject in connection with employment, social security or social protection
  • Article 9(2)(g) - reasons of substantial public interest. We are responsible for education, highways, transport planning, passenger transport, social care (children and adults), libraries, waste disposal and strategic planning. Our processing of personal data in this context is for the purposes of substantial public interest and is necessary for the carrying out of our role
  • Article 9(2)(j) – for archiving purposes in the public interest. The relevant purpose we rely on is Schedule 1 Part 1 paragraph 4 – archiving
  • Article 9(2)(f) – for the establishment, exercise or defence of legal claims
  • Article 9(2)(a) – explicit consent. In circumstances where we seek consent, we make sure that the consent is unambiguous and for one or more specified purposes, is given by an affirmative action and is recorded as the condition for processing
  • Article 9(2)(c) – where processing is necessary to protect the vital interests of the data subject or of another natural person

We also process criminal offence data under Article 10 of the GDPR.

We may need to use some information about you to:

  • deliver services and support to you
  • manage those services we provide to you
  • train and manage the employment of our workers who deliver those services
  • help investigate any worries or complaints you have about your services
  • keep track of spending on services
  • check the quality of services
  • help with research and planning of new services

There are a number of legal reasons why we need to collect and use your personal information.

Each privacy notice (at the top of the page) explains for each service which legal reason is being used. Generally we collect and use personal information where:

  • you, or your legal representative, have given consent
  • you have entered into a contract with us
  • it is necessary to perform our statutory duties
  • it is necessary to protect someone in an emergency
  • it is required by law
  • it is necessary for employment purposes
  • it is necessary to deliver health or social care services 
  • you have made your information publicly available
  • it is necessary for legal cases
  • it is to the benefit of society as a whole
  • it is necessary to protect public health
  • it is necessary for archiving, research, or statistical purposes

If we have consent to use your personal information, you have the right to remove it at any time. If you want to remove your consent, please contact and tell us which service you're using so we can deal with your request.

Where we can, we'll only collect and use personal information if we need it to deliver a service or meet a requirement. 

If we don't need personal information we'll either keep you anonymous if we already have it for something else or we won't ask you for it. For example, in a survey we may not need your contact details so we'll only collect your survey responses.

If we use your personal information for research and analysis, we'll always keep you anonymous or use a different name unless you've agreed that your personal information can be used for that research.

We don't sell your personal information to anyone else.  

​The law gives you a number of rights to control what personal information is used by us and how it is used by us.

We would normally expect to share what we record about you with you whenever we assess your needs or provide you with services.

However, you also have the right to ask for all the information we have about you and the services you receive from us. When we receive a request from you in writing, we must give you access to everything we've recorded about you.

However, we can't let you see any parts of your record which contain:

  • confidential information about other people
  • data a professional thinks will cause serious harm to your or someone else's physical or mental wellbeing
  • if we think that giving you the information may stop us from preventing or detecting a crime

This applies to personal information that is in both paper and electronic records. If you ask us, we'll also let others see your record (except if one of the points above applies).

If you can't ask for your records in writing, we'll make sure there are other ways that you can. If you have any queries about access to your information please contact or 01604 368360.

​You can ask to change information you think is inaccurate, ask to delete information (right to be forgotten), ask to limit what we use your personal data for and you can ask to have your information moved to another provider (data portability).

Please see our 'General Data Protection Regulation' page, under the heading 'The right to rectification', for further details.

We use a range of organisations to either store personal information or help deliver our services to you. Where we have these arrangements there is always an agreement in place to make sure that the organisation complies with data protection law. 

We'll often complete a privacy impact assessment (PIA) before we share personal information to make sure we protect your privacy and comply with the law.

Sometimes we have a legal duty to provide personal information to other organisations. This is often because we need to give that data to courts, including:

  • if we take a child into care
  • if the court orders that we provide the information
  • if someone is taken into care under mental health law

We may also share your personal information when we feel there's a good reason that's more important than protecting your privacy. This doesn't happen often, but we may share your information:

  • in order to find and stop crime and fraud; or if there are serious risks to the public, our staff or to other professionals
  • to protect a child
  • to protect adults who are thought to be at risk; for example, if they are frail, confused or cannot understand what is happening to them

For all of these reasons the risk must be serious before we can override your right to privacy. 

If we're worried about your physical safety or feel we need to take action to protect you from being harmed in other ways, we'll discuss this with you and, if possible, get your permission to tell others about your situation before doing so. 

We may still share your information if we believe the risk to others is serious enough to do so.  

There may also be rare occasions when the risk to others is so great that we need to share information straight away.

If this is the case, we'll make sure that we record what information we share and our reasons for doing so. We'll let you know what we've done and why if we think it is safe to do so.

We'll do what we can to make sure we hold records about you (on paper and electronically) in a secure way, and we'll only make them available to those who have a right to see them. Examples of our security include:

  • Encryption, meaning that information is hidden so that it cannot be read without special knowledge (such as a password). This is done with a secret code or what's called a 'cypher'. The hidden information is said to then be 'encrypted'.
  • Pseudonymisation, meaning that we'll use a different name so we can hide parts of your personal information from view. This means that someone outside of the council could work on your information for us without ever knowing it was yours.
  • Controlling access to systems and networks allows us to stop people who are not allowed to view your personal information from getting access to it.
  • Training for our staff allows us to make them aware of how to handle information and how and when to report when something goes wrong.
  • Regular testing of our technology and ways of working, including keeping up to date on the latest security updates (commonly called patches).

The majority of personal information is stored on systems in the UK. But there are some occasions where your information may leave the UK either in order to get to another organisation or if it's stored in a system outside of the EU. 

We have additional protections on your information if it leaves the UK ranging from secure ways of transferring data to ensuring we have a robust contract in place with that third party. 

We'll take all practical steps to make sure your personal information is not sent to a country that is not seen as 'safe', either by the UK or EU Governments.

If we need to send your information to an 'unsafe' location we'll always seek advice from the Information Commissioner first.

There's often a legal reason for keeping your personal information for a set period of time, we try to include all of these in our retention schedule.

For each service the schedule lists how long your information may be kept for. This ranges from months for some records to decades for more sensitive records.

​The Council Advertising Network is responsible for delivering advertising on the Northamptonshire County Council website. Please take a moment to read their privacy policy which includes cookie information and details on how to opt out.

​Northamptonshire County Council will have access to the following data:

  • Primary Care Mortality Database (PCMD) – The PCMD holds mortality data as provided at the time of registration of the death along with additional GP details, geographical indexing and coroner details where applicable.
  • Births and Vital Statistics datasets – Births files include date of birth, sex, birthweight, address, postcode, place of birth, stillbirth indicators and age of mother. Deaths data includes: deaths broken down by age, sex, area and cause of death sourced from the deaths register.
  • Hospital Episode Data (HES) – Is a data warehouse containing details of all admissions, outpatient appointments and A&E attendances at NHS hospitals in England. This data is collected during a patient's time at hospital and is submitted to allow hospitals to be paid for the care they deliver. HES data is designed to enable secondary use, that is use for non-clinical purposes, of this administrative data.

This data is supplied to Public Health by NHS Digital under section 42 (4) of the Statistics and Registration Service Act 2007, as amended by section 287 of the Health and Social Care Act 2012, and Regulation 3 of the Health Service (Control of Patient Information) Regulations 2002.

Lawful basis for processing this data

  1. Statutory public health duties that the data will be used to support:
    1. Duty to improve public health: Analyses of the data will be used to support the duty of the local authority under Section 12 of the Health and Social Care Act 2012 to take appropriate steps to improve the health of the population, for example by providing information and advice, services and facilities, and incentives and assistance to encourage and enable people to lead healthier lives.
    2. Duty to support Health and Wellbeing Boards: Analyses of the data will be used to support the duty of the local authority and the Clinical Commissioning Group (CCG)-led Health and Wellbeing Board under Section 194 of the 2012 Act to improve health and wellbeing, reduce health inequalities, and promote the integration of health and care services; the data will also be used to support the statutory duty of Health and Wellbeing Boards under Section 206 of the 2012 Act to undertake Pharmaceutical Needs Assessments.
    3. Duty to produce Joint Strategic Needs Assessments (JSNAs) and Joint Health and Wellbeing Strategies (JHWBs): Analyses of the data will be used to support the duty of the local authority under Sections 192 and 193 of the 2012 Act to consult on and publish JSNAs and JHWSs that assess the current and future health and wellbeing needs of the local population.
    4. Duty to commission specific public health services: Analyses of the data will be used to support the local authority to discharge its duty under the Local Authorities Regulations 2013 to plan and provide NHS Health Check assessments, the National Child Measurement Programme, and open access sexual health services.
    5. Duty to provide public health advice to NHS commissioners: Analyses of the data will be used by Local Authorities to discharge its duty under the 2013 Regulations to provide a public health advice service to NHS commissioners.
    6. Duty to publish an annual public health report: Analyses of the data will be used by Directors of Public Health to support their duty to prepare and publish an annual report on the health of the local population under Section 31 the 2012 Act.
    7. Public Health responses on behalf of the local authority to licensing applications and other statutory local authority functions requiring public health input: Analyses of the data will be used by the Director of Public Health to support their duty under Part 3 of the National Health Services Act 2006 (as amended by Section 30 of the Health and Social Care Act 2012) to provide the local authority public health response (as the responsible authority under the Licensing Act 2003, as amended by the Health and Social Care Act 2012 Schedule 5 - Part 1) to licensing applications.

Legal basis for access to civil registration data (mortality, births and vital statistics) DARs

This data assists local authorities in tailoring local solutions to local problems, and using all the levers at their disposal to improve health and reduce inequalities and it helps to create a 21st century local public health system, based on localism, democratic accountability and evidence as directed in the Health and Social Care Act 2012.

Section 42(4) of the Statistics and Registration Service Act (2007) as amended by section 287 of the Health and Social Care Act 2012 and Regulation 3 of the Health Service (Control of Patient Information) Regulations 2002.

Vital statistics:

  • Processing: General Data Protection Regulation Article 9 (2) (h)
  • General Data Protection Regulation Article 6 (1) (e)
  • Dissemination: Health and Social Care Act 2012 - s261(5)(d)

Primary Care mortality data:

  • Processing: General Data Protection Regulation Article 9 (2) (h)
  • General Data Protection Regulation Article 6 (1) (e)
  • Dissemination: Health and Social Care Act 2012 - s261(5)(d)


  • Processing: General Data Protection Regulation Article 9 (2) (h)
  • General Data Protection Regulation Article 6 (1) (e)
  • Dissemination: Health and Social Care Act 2012 - s261(5)(d)

Categories of personal data processed

Mortality data:

  • cause of death
  • date of birth
  • NHS number
  • address and postcode
  • postcode of place of death


  • place of birth
  • address and postcode of mother
  • NHS number
  • date of birth


Alongside your Right to Object, the NHS National Data Opt-out Programme gives you the right to opt out of your confidential patient information being used for reasons other than their individual care and treatment (such as for research and planning purposes). Patients and the public will be able to use the national system from 25 May 2018. All health and care organisations will be required to uphold patient and public choices by March 2020.

There are occasions where service providers will have a legal duty to share information, for example for safeguarding or criminal issues. The process for opting out will depend on the specific data and what programme it relates to. For further information, please contact the Public Health team by emailing

If we analyse your information in this way we will inform you that this is being done and offer you the option of objecting to that process being carried out.

In some cases we may refuse your request if the profiling is required by law.

Some decisions are made by machine calculation of data held and this right allows you to object to having decisions made by an automated process. The machine calculation of the data is known as profiling and could mean analysing and predicting your economic situation, your health, your location or movements, and your preferences or behaviour.

However, this right does not apply where the processing is necessary for a contract between you and the council, the processing is authorised by law with necessary safeguards to your rights and freedoms or you have given your explicit consent to the profiling.

The council does not currently undertake profiling that has a significant and / or legal impact on you but may at times use data held to identify populations impacted by policy and legislative changes.

Where can I get advice?

If you have any worries or questions about how your personal information is handled please contact our Data Protection Officer at or by calling 01604 368 360.

For independent advice about data protection, privacy and data sharing issues, you can contact the Information Commissioner's Office (ICO) at:

Information Commissioner's Office
Wycliffe House 
Water Lane 
Cheshire SK9 5AF

Tel: 0303 123 1113 (local rate) or 01625 545 745 if you prefer to use a national rate number.

Alternatively, visit or email

Cookie declaration

You can read about the cookies used on our website and your options in managing them on our cookie page.

We don't use cookies on this website that collect information about what other websites you visit (often referred to as privacy intrusive cookies).

Our cookies aren't used to identify you personally, they're just here to make the site work better for you.

To learn more about cookies and how to manage them, visit or watch a video about cookies.

We also collect data on the number of times a word is searched for and the number of failed searches. We use this information to improve access to the site and identify gaps in the content and see if it is something we should add to the site.

Other cookies

We use videos from YouTube and feeds from other websites such as Facebook and Twitter. These websites place cookies on your device when watching or viewing these pages.

Below are links to their cookie policies: