How we collect and use your data

Who we are and what we do

This privacy notice explains how Cheltenham Borough Council (as a data controller) will collect, use and protect personal data specifically with regard to the Covid-19 (coronavirus) pandemic.

You may have provided information for a specific reason, and normally we would let you know if this data is likely to be used for a different purpose.  However, due to the rapidly changing situation regarding the current pandemic this will not always be possible.  If we already hold information regarding vulnerability as defined in the current guidance from the government and Public Health England, we may share this for emergency planning purposes or to protect your vital interests by sharing with services both inside and outside the council.

We may in this current crisis need to ask you for personal information, including sensitive personal information - for example your age, if you have any underlying illnesses or if you are vulnerable - that you have not already supplied. This is so that we can assist you and prioritise our services.

Any questions regarding our privacy practices should be sent to:

Cheltenham Borough Council
Municipal Offices
Cheltenham GL50 9SA

Or you can email [email protected]

Your personal data  

So that we can respond effectively, and help coordinate the community response for Covid-19, we will need to collect basic details about you including name, address, telephone number and email address.  We will also need to collect details about your health to identify if you (or those closely linked to you) are in any of the high-risk categories and would be considered vulnerable, if infected with coronavirus.

Some of your personal data is classed as 'special categories of personal data' because it is the information that is considered to be more sensitive and therefore requires more protection.

Our lawful basis for processing your information

How we are processing your personal data will determine the legal basis for processing.  The legal bases for processing by us as a public authority will be:

  • Article 6(1)(d) – is necessary in order to protect the vital interests of the data subject or another natural person
  • Recital 46 adds that “some processing may serve both important grounds of public interest and the vital interests of the data subject as for instance when processing is necessary for humanitarian purposes, including for monitoring epidemics and their spread”


  • Article 6(1)(e) – is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller
  • Section 8(c) of the Data Protection Act sets out that such a task must be necessary for the performance of a function conferred on a person by an enactment or rule of law


  • The processing of special categories of personal data, which includes data concerning a person’s health, are prohibited unless specific further conditions can be met. These further relevant conditions are below:
    • Article 9(2)(i) – is necessary for reasons of public interest in the area of public health, such as protecting against serious cross-border threats to health.
    • Schedule 1, Part 1(1) – is necessary for the performance or exercising obligations or rights which are imposed or conferred by law on the controller or the data subject in connection with employment, e.g. Health and Safety at Work Act 1974.
    • Schedule 1, Part 1(3) – is necessary for reasons of public interest in the area of public health, and is carried out by or under the responsibility of a health professional, or by another person who in the circumstances owes a duty of confidentiality under an enactment or rule of law, e.g. Governmental guidance published by Public Health England

Who your information may be shared with (internally and externally)

In this current pandemic we may share your information with other public authorities, emergency services, and other stakeholders if it is necessary and proportionate to do so.

How long we keep your information (retention period)

We will only keep your information for the minimum period necessary. The information outlined in this privacy notice will be kept for the duration of the Covid-19 response.

All information will be held securely and destroyed under confidential conditions 12 months after the Covid-19 pandemic has officially ended.

How we protect your information

We have implemented generally accepted standards of technology and operational security in order to protect personal data from loss, misuse, or unauthorised alteration or destruction.  

Please note however that where you are transmitting information to us over the internet this can never be guaranteed to be 100 per cent secure. 

Your rights 

You have rights under Data Protection Legislation, these are:

  • To access your personal data 
  • To be provided with information about how your personal data is processed
  • To have your personal data corrected
  • To have your personal data erased in certain circumstances
  • To object to or restrict how your personal data is processed
  • To have your personal data transferred to yourself or to another business in certain circumstances
  • To be told if we have made a mistake whilst processing your data and we will self-report breaches to the commissioner.

How you can access, update or correct your information

The data protection legislation allows you to find out what information is held about you, on paper and computer records. This is known as ‘right of subject access’ and applies to your data along with all other personal records. 

If you wish to see a copy of your records you should contact the data protection officer. You are entitled to receive a copy of our records free of charge, within a month. We will do our best to adhere to this time limit, however, there may be understandable delays in relation to information rights requests during the pandemic.

The accuracy of your information is important to us so that we can provide relevant services more quickly. We are working to make our record keeping more efficient. In the meantime, if you change your address or email address, or if any of your circumstances change or any of the other information we hold is inaccurate or out of date please email us or write to us at:

Cheltenham Borough Council
Municipal Offices
Cheltenham GL50 9SA

Or you can email [email protected]

Further information

You can also complain to the Information Commissioner at