Children's Services privacy notice

What we do and who we are

Bournemouth, Christchurch, and Poole (BCP) Council Children’s Services have a duty and responsibility to protect and promote the welfare of children in its area. We aim to provide the right help and support to children and their families at the earliest opportunity possible.

BCP Council Children’s Services teams work closely with one another, with teams across BCP Council and with Partner Organisations to provide the appropriate help, support and guidance for children, young people, and families. Support is provided from early pregnancy up until the young person reaches the age of 19 years and for some children and care experienced young people, including those who have a disability, up to the age of 25 years. BCP Council is the data controller of data held by Children’s Services.

This privacy notice provides information on how we collect and process your personal data as part of Children's Services.

Our general privacy notice also provides an overview of how BCP Council uses and protects personal information more generally.

What we use your personal information for

We only obtain and use the information we need to provide our services to you. During the course of providing support for a child, young person, and their family we collect different types of information depending on the circumstances.

We will collect enough personal information to provide you with services; this may include but is not limited to the following purposes:

informing you about alternative services available in the community
protecting children from abuse and harm
monitoring and reviewing support and interventions
identification of children and young people deemed vulnerable and/or at risk of significant harm
carry out data analysis to identify service/community needs
managing delivery of services
management of concerns or complaints
produce statistics

We are not permitted to collect information we do not need or will not use. If we do not need your personal information, we will not ask you for it. If we use your personal information for research or analysis, we will always keep your details anonymous or use a fake name. We will not sell your personal information to anyone else.

The personal information we collect and use

We only obtain and use the information we need to provide our services to you. In the course of providing support for a child, young person and their family we collect different types of information depending on the circumstances.

This may include but is not limited to the following:

personal information: name, address, contact details, date of birth, gender, and personal identifiers, for example NHS or National Insurance numbers
family information, family circumstances and relationships and other data necessary for the provision of services
assessment and Plans for children, young people and families
information, advice and guidance
information during the process of approving, matching and supporting adoptive parents and assessing special guardians
information gathered during child protection processes and serious case reviews
Special Educational Needs and Disability data
Child Sexual Exploitation (CSE) data
Early Years and Education information
Targeted Early Help Data (see section on Targeted Early Help Data Collection)
Recording of meetings, conversations and discussions (see section on recording of meetings)

Special category personal information

Our service also needs to use sensitive personal data, also called "special category data", which requires more protection to keep it safe. This is often information you would not want to be widely known and is very personal to you. It includes:

sexuality or sexual health
religious or spiritual or philosophical beliefs
ethnicity
physical or mental health
trade union membership
political opinions
genetic or biometric data
criminal history

How your personal information is collected and stored

We collect personal information in various ways, depending on the support or services provided to a child, young person, or family.

Information may be collected directly from you, from children and young people, parents, carers, and family members, through meetings, assessments, correspondence, forms, telephone calls, home visits, and other interactions with Children’s Services.

We may also receive information from other organisations and professionals involved in supporting children and families. This may include schools and education providers, health services, GPs, hospitals, police, probation services, courts, other local authorities, housing providers, voluntary organisations, and other agencies involved in safeguarding, education, health, or welfare support.

We only collect and use personal information that is necessary, relevant, and proportionate for the purposes described in this privacy notice.

When we collect and process your information, we store it securely within Council systems and approved information technology platforms. Access to personal information is restricted to authorised staff who have a legitimate need to access it to carry out their duties. We implement appropriate technical and organisational measures to protect personal information against unauthorised access, alteration, loss, disclosure, or misuse.

We retain information only for as long as necessary and in accordance with our retention schedule and legal obligations.

The law we use to process your personal information

We collect and use your personal information to meet our legal obligations and to carry out tasks in the public interest. Where we need to collect special category (sensitive) personal information, this will only be done where it is lawful to do so, including for safeguarding children and individuals at risk, promoting equality of opportunity or treatment, providing and managing social care services, complying with social security or social protection law, or establishing, exercising, or defending legal claims where courts are acting in their judicial capacity.

The UK GDPR/DPA conditions we meet:

The lawful bases that we rely on to process your personal information are:

Vital interests: the processing is necessary to protect children from harm
Public task: the processing is necessary for us to perform a task in the public interest or for our official functions to support children and families, and the task or function has a clear basis in law

Purpose	Lawful basis	Legal power
Safeguarding children	Art 6(1)(e), Art 9(2)(g)	Children Act 1989
Child protection enquiries	Art 6(1)(e), Art 9(2)(g)	Children Act 1989 s47
Provision of social care services	Art 6(1)(e), Art 9(2)(h)	Children Act 1989/2004
Education and SEND functions	Art 6(1)(e), Art 9(2)(h)	Children and Families Act 2014

We also use these additional conditions to process your special category of personal information for example:

Health or social care: the processing is necessary for the purposes of preventive or occupational medicine, for the assessment of the working capacity of the employee, medical diagnosis, the provision of health or social care or treatment or the management of health or social care systems and services
Substantial public interest: the processing is necessary for reasons of substantial public interest, on the basis of Domestic Law which shall be proportionate to the aim pursued, respect the essence of the right to data protection and provide for suitable and specific measures to safeguard the fundamental rights and the interests of the data subject
Legal claims and judicial acts: processing is necessary for the establishment, exercise, or defense of legal claims or whenever courts are acting in their judicial capacity

Statutory legislation

The main legislation that provides us with the statutory basis to deliver our services is as follows:

The Education Act, 1996, 2002, 2005
Learning and Skills Act 2000
Education and Skills Act 2008
Education and Inspections Act 2006
Academies Act 2010
Education and Adoption Act 2016
Crime and Disorder Act, 1998, 2004
Working together to Safeguard Children 2026: statutory guidance on multi-agency working to help, support and protect children
Police and Criminal Evidence Act, 1984 (PACE)
Legal Aid, Sentencing and Punishment of Offenders Act, 2012
The Localism Act, 2011
Homelessness Reduction Act, 2017
Children Act 1989 and 2004
Childcare Act 2006 Section 99 of the Childcare Act 2006 and The Education (Provision of Information About Young Children) (England) Regulations 2009)
Children and Families Act 2014
Children and Social Work Act 2017
Data Protection Act 2018
Digital Economy Act 2017
Transport Act 1985
SEND Regulations 2014
Special Educational Needs and Disability Code of Practice 0 to 25 years, 2015
Equality Act 2010
Children (Leaving Care) Act 2000
Children and Adoption Act 2006
Early Years Census
UK General Data Protection Regulation (UK GDPR) Articles 6 and 9 and associated regulations or statutory guidance

Consent

We have a statutory duty to exercise our legal obligations under section 47 of the Children Act 1989 where consent is not required to safeguard vulnerable children. If a child is accommodated and then returned; the withdrawal of consent does not affect our legal obligation to retain the child’s record and use the information should further concerns become known.

Where you have been asked to provide your consent for processing, you can withdraw it at any time. If you wish to withdraw your consent, please contact or talk to the officer at BCP Council who has been providing the service or services to you. If you do not have an officer that you have regular contact with, please make your request to withdraw consent to our Customer Services team.

Remember to tell us which service or services your request applies to, so that we know who to send it to within BCP Council.

Use of Artificial Intelligence (AI)

We use artificial intelligence (AI) technologies to assist with drafting reports and documents. This will enable us to further develop and provide our services efficiently. Where AI technologies process personal information or special category (sensitive) personal information, we will comply with our legal obligations and implement appropriate technical and organisational measures to protect the data.

AI technologies will not replace professional judgement or decision-making. All AI generated content will continue to be reviewed, edited and approved by appropriately trained staff before any assessments, outcomes or decisions are finalised and shared.

Personal information processed through approved AI tools remains under the Council's control. Any information processed through these tools will be stored and processed within approved locations that meet the Council's data protection and security requirements.

Recording meetings and using digital note-taking tools

As part of our work with children, young people, and families, we record some meetings, conversations, or professional discussions as part of our lawful duty under Article 6(1) (e) of the General Data Protection Regulation (GDPR).

Recordings may include audio, video, captions, transcripts, meeting notes, summaries, or actions. We may use approved Council digital tools, including Microsoft Teams, Microsoft Copilot or other authorised transcription and note-taking technology, to help create an accurate record of what was discussed and agreed.

Where a meeting is recorded, we will make attendees aware that recording or transcription is taking place. The information may include personal data and special category data about children, young people, family members, carers, professionals, and other people referred to during the meeting.

The recording, transcript, summary or other meeting output may be added to the relevant child or family record within the Council’s case management system where it forms part of our statutory record or is needed for safeguarding, assessment, planning, review, decision-making, complaint handling, audit or legal purposes.

Access to recordings, transcripts and meeting outputs will be restricted to authorised staff and other persons or organisations where access or sharing is necessary, lawful and proportionate. We will retain this information in line with the relevant retention period for the child’s record or the service area to which the meeting relates.

We will not use recording or transcription tools for automated decision-making about children, young people or families. Decisions remain the responsibility of appropriately authorised professionals.

Who we may collect your information from and with whom we may share it

We may collect your information from and share your information with the following third parties:

Category	Services
Local authority	Local Authority Designated Officer (LADO), other Service areas within the Council working with the child and family, *Commissioned providers of local authority services such as Independent Foster Care Agencies, Children’s Homes, Semi-Independent accommodation Providers, Supported Lodgings Providers, Residential Special Schools, and Secure accommodation
Legal	Police, Probation, Court Services, Legal Services, Her Majesty’s Courts and Tribunal Service, British Transport Police, Dorset Combined Youth Justice Service, Disclosure and Barring Service
Children’s	CAFCASS, NSPCC, Child Protection Information (CPIS), Aspire Adoption, Adoption England, providers of social care services (e.g. foster carers and short breaks), Pan Dorset Safeguarding and YMCA
Health	Child Health Information Service, Health Visitors, Midwives, National Health Service, GP/Doctor, Dorset Care Record, Child and Adolescent Mental Health Service (CAMHS), Health Care and Professions Council (HCPC), Community Mental Health Team, school nurses, other health, and mental health workers
Education	Academies and Schools (including Virtual Schools) Early Years & pre-school settings and providers, Post-16 providers, Welfare Call Ltd, Alternative provision settings and providers, transport services (e.g. SEND transport) and Independent & voluntary sector schools
Government departments	Department for Work and Pensions (DWP), Department for Education (DfE), Ministry of Housing, Communities, Local Government, Ministry of Justice, Ofsted, Home Office, Her Majesty’s Revenue and Customs (HMRC)
Financial and housing	Housing Associations, Financial Services, Housing Services
Other services providing Rescue support	Advocacy services, other Local Authorities, charitable organisations, the Share Foundation, voluntary services, Dorset & Wiltshire Fire Service, Fire and Rescue Service, Partner organisations signed up to Our Dorset/Dorset Pledge, Dorset intelligence and insight Service (DiiS), Third Party organisations commissioned by BCP Council for ad hoc projects

*Where services are commissioned, the provider will act as a processor of information on our behalf. In addition, the provider may act as an independent controller where they collect and use information for their own purposes.

Your information will not be disclosed to any other organisations, except where we are required and allowed to by law.

We will ensure that we have a lawful basis for all data sharing. We may seek your consent if we are able to offer additional services which we believe are of benefit to you. This will be clearly communicated to you.

We will also share information with the other organisation if we believe:

a child would be harmed if we did not share this information
to find and stop crime and fraud
if there may be serious risks to the public, our staff or to other professionals

We use a range of organisations to help deliver our services to you. Sometimes we have a legal duty to provide your personal information to other organisations, for example the police, schools, health services, court service or Her Majesty’s Revenue and Customs (HMRC).

Targeted Early Help Data Collection (TEHADC)

We may voluntarily share relevant personal data about children, young people and families who are supported at Targeted Early Help level with the DfE as part of the national data collection TEHADC.

We will share this data with DfE using a secure data portal called ‘achieve forms’, which is password protected. The DfE will perform data validations and analysis and provide reports back to BCP Council and it will contribute to national analysis. These reports will only contain cohort level data which is non-identifiable.

Purpose of this data collection

The DfE is implementing reforms which adapt the way in which support for families is delivered through the Families First Partnership Programme. It is collecting this data to understand the problems children and families are experiencing, which professionals are leading the support, how Early Help services are delivered across local authorities and the outcomes of the support.
Improve outcomes for children, young people and families
Support national policy development, service planning and funding decisions

The DfE is a data controller in its own right for the information it receives. Further information about how the DfE uses this data is available via their published privacy information.

Data we share with DfE

The data shared may include (where relevant):

Child identifiers which includes personal details such as local authority (LA) child ID, LA targeted early help ID, unique pupil number, pupil’s former unique pupil number, unique pupil number unknown reason, (expected) date of birth, sex and date of death
Child characteristics such as ethnicity and type of disability
Targeted Early Help episode details such as the date the Targeted Early Help request is accepted, the date a lead practitioner is assigned, the reason for closure, the date the Targeted Early Help assessment started and ended, and the episode history
Targeted Early Help needs identified

We will only share the minimum amount of information necessary for this purpose.

This processing is carried out in line with our statutory responsibilities, including safeguarding and promoting the welfare of children.

Lawful Basis for sharing personal data with DfE

We rely on the following lawful basis and special category processing condition to share personal data with DfE:

Article 6(1)(e) UK GDPR – Public task, as the processing and sharing is necessary for us to carry out our official functions and duties to support children and families
Article 9(2)(h) – Health or social care purposes, where special category data is involved, because the processing is necessary for the management of health or social care systems and services

This processing and data sharing is carried out in line with our statutory responsibilities, including safeguarding and promoting the welfare of children.

How this affects you

This data sharing helps improve how Early Help services are delivered across England. It does not affect the support you receive from us.

Data collection for the DfE is currently part of a national data return and may become a statutory requirement in the future.

Use of existing information

Where necessary and proportionate, we may use information we already hold about you or your family for the purposes of this data collection. This is because the processing is compatible with the original purposes for which the information was collected, including providing support to children and families and fulfilling our statutory responsibilities.

How long we keep information about you

Category	Retention period
Children and young people with a child protection plan	Date of case closure +35 years
Children and young people who have been in the care of the local authority and young people with care experience	Date of birth +75 years
Fostering and Private Fostering arrangements	Date of birth +75 years
Child Health and Disability records	+25 years
Children’s Complaints	10 years
Child work permits	7 years
Admissions data	7 years in accordance with The Limitation Act 1980
All other records relating to children and young people. Records of children and young people who don’t fall into any of the above categories, including Children in Need and general papers where a statutory file has not been opened	Date of birth + 25 years
Register of persons posing a risk to children and those cautioned or convicted of offences against children	Date of birth +100 years
Child Sexual Exploitation (CSE) data	10 years
Local Authority Designated Officer (LADO) records	70 years
Early Education Funding (retention is in accordance with Financial Regulations)	7 years
Serious Case Reviews Pan-Dorset Safeguarding Children Partnership	35 years
Early Years Portage and Special Educational Needs (SEND)	25 years
Nursery and childcare records Childminders records	25 years 7 years
Pupils attending BCP Schools (with no contact with SEND, Childrens Social Care)	7 years after leaving school
Management of educational welfare support and school exclusions data Free school meals	25 years 7 years
Virtual School (as required by the Independent Inquiry into Child Abuse (IICSA)	95 years
Virtual school pupil data	75 years

*Our retention schedule may require us to keep certain records for longer where we have a legal obligation to do so.

Your rights

Under data protection law, you have rights in relation to the personal information we hold about you. These include the right to:

request access to the personal information we hold about you
request that incorrect or incomplete information is corrected
request that we restrict how your personal information is used in certain circumstances
object to the use of your personal information, where we are relying on public task as our lawful basis
request the deletion of your personal information, where this applies

Please note that these rights are not absolute and may be limited in some circumstances, particularly where information is held for safeguarding purposes, the provision of social care, or where we have a legal obligation to retain it.

You also have the right to make a complaint to the Information Commissioner’s Office (ICO), the UK’s independent authority for data protection matters, if you are unhappy with how we handle your personal information.

How to complain

Our Data Protection Officer can resolve any query or concern you raise regarding use of your information.

How to contact us

Should you have any questions about this privacy notice, or wish to raise a complaint regarding the processing of your data, please contact the Information Governance Team at information.governance@bcpcouncil.gov.uk.

Caldicott Guardian, Children’s Services

A Caldicott Guardian is a senior person responsible for protecting the confidentiality of people’s health and care information.

The Caldicott Guardian for Children’s Services is Rachel Gravett, Director for Commissioning, Resources and Quality.