The General Data Protection Regulation 2018 (GDPR) came into force on the 25th May 2018. The GDPR is supplemented by the Data Protection Act 2018 (DPA), replacing the earlier 1998 Act.

GDPR requires that Data Controllers must have a legal basis for processing personal data. For the Parish Council, as a creature of statute, a great deal comes under Article 6(1)(c) Legal Obligation, defined as "processing is necessary for compliance with a legal obligation to which the controller is subject."

For example, Schedule 12, Part IV, para 40 of the Local Government Act 1972 requires "the names of the members present at a meeting of a local authority shall be recorded". Accordingly, the individual's GDPR right to erasure (sometimes called the right to be forgotten) does not apply here, as deleting the name of a Councillor (or former Councillor) who attended a meeting would be contrary to the legal obligation on the Council to record the names.

The Parish Council has two Privacy Notices, depending whether you are

• a member of the general public or
• Staff*, Councillor or Role holder** of the Parish Council.

(*)"Staff" means employees, workers, agency staff and those retained on a temporary or permanent basis.
(**) Includes, volunteers, contractors, agents, and other role holders within the Council including former staff* and former Councillors. This also includes applicants or candidates for any of these roles.