Privacy Notice For Staff: GDPR Processing

We sometimes need to process personal information about you so that we are able to perform our functions. This Privacy Notice explains how we collect and use your personal information in accordance with Data Protection Act 2018 and the GDPR.

Personal data is any data that can be used to identify a living individual, on its own or in combination with other available information. References to names, identification numbers and location data are all personal data. Processing means anything we do with the data and includes collecting, storing, and sharing.

Key Contacts

Data Controller
The Chief Constable is the controller for any personal data processed by Cleveland Police.

Data Protection Officer
The Data Protection Officer is Maria Hopper and she can be contacted via [email protected]

What information we collect?

As your employer, Cleveland Police needs to process information about you for normal employment purposes. We will keep and use it to enable us to manage our relationship with you effectively, lawfully and appropriately, during the recruitment process, whilst you are working for us, at the time when your employment ends and after you have left. This includes using information to enable us to comply with your employment contract as well as to comply with other legal obligations.

You will, of course, inevitably be referred to in many Force documents and records that are produced by you and your colleagues in the course of carrying out your duties and Force business.

Much of the information we hold will have been provided by you directly, but some may come indirectly from other internal sources, such as your manager, or in some cases, external sources, such as referees or members of the public.

Information about you is likely to be held in various forms, including electronically in emails and in our electronic filing system, as well as in paper-based records, and on security systems such as CCTV.

The personal data we collect from you and process will include personal data and special category personal data.

Personal data may include information such as your:

 • Name
• Address
• Date of birth
• Telephone number
• Gender
• National Insurance number
• Bank account details and payroll records
• Education
• Work history
• Proof of identity, such as a photocopy of your driving license
• Marital status, family circumstance and dependents
• Next of kin and emergency contact details
• Photograph
• CCTV footage and access card records
• Salary and grade details, including data held on structure charts and disposition lists
• Records concerning your performance and training
• Sickness and other absence details, including information required to process Ill Health Retirement and Injury Award claims
• Annual leave records
• Your contract and terms and conditions of employment
• Records of grievances
• Records of disciplinary proceedings
• Health and safety records
• Secondary employment and volunteering
• Records of Employment Tribunals
• Records of any Suspension details
• Records concerning any compensation payments
• Information about your use of the Force’s information and communications systems.
• Correspondence with or about you

  • Racial or ethnic origin
  • Religious beliefs, or those of a similar nature
  • Trade union membership
  • Physical or mental health
  • Sexual orientation
  • Genetic or biometric data

The definition of special category data also includes the information collected for equal opportunities monitoring.

We may also collect and process criminal conviction data or alleged criminal behaviour data for our administrative functions, such as recruitment. We will only use information relating to criminal convictions or alleged criminal behaviour when the law allows us to do so. This can arise when it is necessary for us to comply with the law, or where it is in the substantial public interest for us to exercise our functions.

It is important that the personal information we hold about you is accurate and up to date. Please keep us informed if your personal information changes during your working relationship with us.

Why do we use your information?

Your personal data is processed by the Force to carry out the following functions:

to carry out all functions relating to your employment, including the general administration of your contract, and for matters necessary for the management and oversight of the workforce.

 This includes:

  • Payment of salary and allowances
  • Time management and timesheets
  • Conducting performance reviews and managing performance
  • Education, training and development requirements
  • Disciplinary matters and grievances - including gathering evidence and any other steps relating to possible grievance or disciplinary matters and associated hearings
  • Health and safety
  • Making decisions about your continued employment or engagement and making arrangements for the termination of our working relationship
  • Dealing with legal disputes involving you, or other employees, workers and contractors, including accidents at work and including injury award claims
  • Sickness absence and information to manage your attendance at work - including information such as reason for absence, GP Fit notes and reports, Occupational Health referrals and reports.

 This includes providing employment-related benefits to you relating to:

  • Occupational sick, adoption, maternity, paternity, shared parental and annual leave and pay
  • Pension, including liaising with your pension provider, providing information about changes to your employment such as promotions, changing in working hours.
  • Advances of salary
  • Compensation payments
  • Childcare voucher schemes
we collect personal information about you through the application and recruitment process, either directly from you or sometimes from an employment agency or background check provider. We use this information to make decisions about your recruitment or appointment. We may also use your data to assess your qualifications for a particular job or task, including your suitability for promotion.
we process data to assess your fitness to work and to manage sickness absences. We may keep information relating to your health, which could include reasons for absence and GP reports and notes. This information will be used in order to comply with our health and safety and occupational health obligations, including whether any reasonable adjustments might be appropriate. We will also need this data to administer and manage sick pay.
we process your data to ensure the integrity and security of the Force and to provide you with the security clearance appropriate for your role.
including business and workforce planning, staff directory, business continuity, inventory data (including the allocation of assets) and travel bookings.
including reward systems and childcare services
ensuring the security of our staff, visitors, property and information. This includes preventing unauthorised access to our computer and electronic communications systems and preventing malicious software distribution. It also includes the use of CCTV at our premises.
we may monitor your use of our information and communication systems to ensure compliance with our relevant policies.
including workforce demographic and diversity analysis, monitoring and reporting.
data relating to your use of force vehicles
including individual risk assessments, new expectant mothers risk assessments, accident / incident records, display screen equipment assessments and work station assessments for reasonable adjustments.
We need your data to:
  • Enable us to perform our contract with you;
  • Enable us to comply with our legal obligations;
  • Enable us to carry out our functions as a public body; or
  • Where it is necessary to do so in the public interest.

Some of the purposes for using your data will overlap and there can be several lawful conditions for processing your personal data.

If you fail to provide certain information when requested, we will not be able to fully perform the contract we have entered into with you (such as paying you or providing a benefit), or we could be prevented from complying with our legal obligations (such as to ensure the health and safety of our workers).

We will only use your personal information when the law allows us to and where it is necessary and proportionate to do so. For example to recruit and vet potential employees, and for staff administration purposes like paying your salary. Most commonly, we will use your personal information in the following circumstances:
  • Where it is necessary for performing the contract we have entered into with you;
  • Where we need to comply with a legal obligation;
  • Where it is in the public interest to do so; or for official purposes;
  • Where we have a legitimate interest to do so, and it is necessary and balanced against your own interests, rights and freedoms;
  • There may be rare occasions where it becomes necessary to use your personal information to protect your vital interests (or someone else's vital interests);
  • Where you have given your explicit consent, for example membership of staff associations or trade unions.

Special category data

Where we process special categories of your personal data, we will do so in accordance with the specific conditions of processing set out in the Data Protection Act 2018 and GDPR. It is likely that we will use your special category data in the following circumstances:

  • Where we have your explicit consent
  • Where processing is necessary to comply with employment legislation Where it concerns a medical diagnosis, or the medical assessment of your working capacity
  • Where it is necessary for the purpose of preventative or occupational medicine, to assess working capacity, medical diagnosis, or the provision of health or social care treatments.
  • Where it is for the purposes of the exercise of force functions and it is in the substantial public interest.
  • In some circumstances we will process this information where it is needed in relation to legal claims or to protect you or someone else, or where you have already made it public.

Using your consent as a legal basis to process your personal data

Occasionally, where appropriate, we may ask for your explicit consent in order to lawfully process your personal data. An example of this would be in relation to joining a staff association or trade union. This will only happen in specific and limited circumstances and when we do this, we will explain clearly what we are asking for and how we will use it. Consent must be freely given, specific and informed and there must be a genuine choice about offering your data. Where we are processing data based on your consent, you have the right to withdraw that consent at any time.

If you have provided your consent for the Force to process your personal data, you also have the right to withdraw your consent as any time. When we ask for your consent, we will tell you how we will process your data, how long we will keep it for and the steps we will take to delete it. We will also outline the steps we will take if you decide to withdraw consent.
We need your data for the purposes listed under “What information do we collect about you” which includes enabling us to perform our contract with you, enabling us to comply with our legal obligations, to perform our functions as a public body, or where it is necessary to do so in the public interest.

We will share your personal information with third parties where required by law, where it is necessary to administer the working relationship with you; where it is in the public interest to do so or where it is necessary for the performance of our functions. "Third parties" includes third-party service providers (including SopraSteria) and government departments. Some of these will be processing data on behalf of the Force and are called data processors.

External parties include:

  • HM Revenue and Customs
  • Shared service providers
  • Pension services providers
  • External auditors
  • Third party service providers

This may, in some circumstances, involve sharing special categories of personal data and, where relevant, data about criminal convictions/allegations.

All our third-party service providers are required to take appropriate security measures to protect your personal information in line with our policies and data protection laws. We do not allow our third-party service providers to use your personal data for their own purposes. We only permit them to process your personal data for specified purposes and in accordance with our instructions.

On occasion there may be times when staff are granted short term access to your e-mail account or shared drive for lawful business purposes, for example if you are absent from work. The Force will also take any steps it considers necessary to protect the integrity and security of its ICT systems. Cleveland Police operates lawful monitoring of its ICT systems.

Your business contact details will be made available to other force staff through the staff directory.

In all disclosures we will have regard to your privacy and individual rights and our duty of confidentiality as your employer. All disclosures will be carried out in a secure manner that meets government standards.

We will not: 

  • Sell your information to third parties
  • Share your information with third parties for marketing purposes

We will only disclose information about you to third parties if we are legally obliged to do so or where we need to comply with our contractual duties to you. For example we may need to pass on certain information to comply with pension schemes. All our third party providers are required to take appropriate security measures to protect your personal information in line with our policies and data protection laws. We only permit them to process personal information for specified purposes.

Some of the bodies or individuals to which we may disclose personal information are situated outside of the European Union. If we do transfer personal data to outside of the EU, including any subsequent sharing of this data, we will ensure that the conditions laid down in data protection legislation are complied with. 

We will only use your personal information for the purposes for which we collected it, unless we reasonably consider that we need to use it for another reason and that reason is compatible with the original purpose.

If we need to use your personal information for an unrelated or new purpose, we will notify you and we will explain the legal basis which allows us to do so.

Please note that if necessary we will process your personal information without your knowledge or consent, where this is required or permitted by law.

Your personal data will be processed securely. We have put in place appropriate technical and security measures to prevent your personal information from being accidentally lost, used or accessed in an unauthorised way, altered or disclosed. In addition, we limit access to your personal information to those employees, contractors and other third parties who have a business need to know. They will only process your personal information in accordance with our instructions and in line with data protection laws.
Your personal data will be retained for as long as necessary for the purpose of your employment and in line with Force retention schedules. Your data will be securely destroyed when no longer required.

In some circumstances we will anonymise or pseudonimise your personal information so that it can no longer be associated with you, in which case we will use such information without further notice to you. An example of where we may do this is where we are required to comply with our audit obligations. 

Once you are no longer an officer, employee, worker or contractor of Cleveland Police we will retain and securely destroy your personal information in accordance with our data retention policy or applicable laws and regulations.

In extraordinary circumstances the Force may be asked to retain certain data after the standard deletion period. This may, for example, be retained as evidence for a public enquiry. In this case your data will be retained for as long as necessary for the purpose for which it is being retained.

No, you will not be subject to decisions that will have a significant impact on you based solely on automated decision-making, unless we have a lawful basis for doing so and we have notified you.

Your rights as a data subject:

Under the GDPR and data protection legislation you have a number of rights that you can exercise in relation to the data we process about you. Under certain circumstances, by law you have the right to:

to your personal information (commonly known as a subject access request). This enables you to receive a copy of the personal information we hold about you and check that we are lawfully processing it and that it is accurate.
of the personal information that we hold about you. This enables you to have any incomplete or inaccurate information we hold about you corrected.
of your personal information. This enables you to ask us to delete or remove personal information where there is no lawful reason for us to continue to process it. You also have the right to ask us to delete or remove your personal information where you have exercised your right to object to processing (see below)
of your personal information where we are relying on a legitimate interest (or those of a third party) or where we are processing your personal information for the performance of a task in the public interest and there is something about your particular situation which makes you want to object to processing on this ground.
of your personal information. This enables you to ask us to suspend the processing of personal information about you, for example if you want us to establish its accuracy or the reason for processing it.


You will not have to pay a fee to access your personal information (or to exercise any of the other rights). However, we are allowed under the law to charge a reasonable fee if your request for access is clearly unfounded or excessive. Alternatively, we can refuse to comply with the request in such circumstances.

We sometimes need to request specific information from you to help us confirm your identity and ensure your right to access the information (or to exercise any of your other rights). This is another appropriate security measure to ensure that personal information is not disclosed to any person who has no right to receive it.

Further information about these rights can be found within the GDPR and on the Information Commissioner’s Office website:

Complaints and further queries:

Cleveland Police tries to meet the highest standards when processing your personal data. We take complaints very seriously. If you have any concern about the way that we have handled your personal data please bring it to our attention via the following means:

• The Force Data Protection Officer at [email protected]

You are also able to submit complaints to the Information Commissioner’s Office, advice on how to contact them based on the nature of your concern is available at
The ICO can be contacted via:
The Information Commissioner’s Office,
Wycliffe House,

Telephone: 0303 123 1113

Email: [email protected]

Further information about this privacy notice

This privacy notice has been created to be easily understood and concise. As a result, it does not include exhaustive detail about what information we hold,
every organisation we share data with, how the data is collected or how long the data is kept. For further information please contact the Data Protection Officer.

We keep our privacy notice under regular review. If we plan to use personal data in a different way than we have outlined then we will update our privacy notice before we start any new processing.