Local government in Surrey is changing
From April 2027, the existing county council and 11 district and borough councils will be replaced by two new unitary councils. Learn more about Future Surrey
View the Surrey Heath Borough Council privacy notices.
We may collect, use, store and transfer different kinds of personal data about you to carry out various functions and services. We have grouped these together as follows:
We have a duty to help prevent and reduce anti-social behaviour and crime. Therefore, processing your information is necessary for the performance of a task carried out in the public interest or in the exercise of our official authority. Sensitive personal data is processed because it is a necessary function conferred on us by an enactment or rule of law or because we have a duty to prevent or detect an unlawful act.
The Council collects information in a variety of ways, for example, whereby you contact us or correspond with us by post, phone, email or online forms, and when working in partnership with other public authorities and partners.
We have set out below, in a table format, a description of all the ways we plan to use your personal data, and which of the legal bases we rely on to do so.
Note that we may process your personal data for more than one lawful ground depending on the specific purpose for which we are using your data. Please contact us if you need details about the specific legal ground we are relying on to process your personal data where more than one ground has been set out in the table below.
| Purpose/Activity | Type of data | Lawful basis for processing including basis of legitimate interest |
| Anti-social behaviour investigations and prosecutions |
a) Identity data b) Contact data c) Criminal data |
Public Task |
| Public Space Protection Orders (PSPO) investigations and prosecutions |
a) Identity data b) Contact data c) Criminal data |
Public Task |
|
Domestic abuse reviews |
a) Identity data b) Contact data c) Criminal data d) Health data |
Public Task
|
| Housing and Planning Enforcement investigations |
a) Identity data b)Contact data |
Public Task |
|
Fraud investigations |
a) Identity data b) Contact data c) Finance data d) Criminal data |
Public Task |
We may have to share your personal data with the parties set out below for the purposes set out in the table above, including but not limited to:
The Crime and Disorder Act 1998 introduced a statutory requirement that key local agencies work together in partnership to tackle crime and disorder in their localities, Surrey Heath Borough Council is part of the Community Harm and Risk Management Meeting (CHaRMM) partnership and shares information using the Empowering Communities Integrated Network System (ECINS) this is a secure, encrypted hub where all the partners share timely and efficient information on joint cases for the reduction of crime, disorder and anti-social behaviour
We are a member of the Surrey Heath Partnership, this is a local partnership that work collaboratively together on targeted interventions to help make Surrey Heath a safer place to live and work. The authorities within the partnership shares top level information to help target and run Surrey wide strategies and guidance.
We require all third parties to respect the security of your personal data and to treat it in accordance with the law. We do not allow our third-party service providers to use your personal data for their own purposes and only permit them to process your personal data for specified purposes and in accordance with instructions.
We do not transfer your personal data outside the European Economic Area (EEA).
We have put in place appropriate security measures to prevent your personal data from being accidentally lost, used or accessed in an unauthorised way, altered or disclosed. In addition, we limit access to your personal data to those employees, agents, contractors and other third parties who have a need to know. They will only process your personal data on our instructions and they are subject to a duty of confidentiality.
We have put in place procedures to deal with any suspected personal data breach and will notify you and any applicable regulator of a breach where we are legally required to do so.
We will only retain your personal data for as long as necessary to fulfil the purposes we collected it for, including for the purposes of satisfying any legal, or reporting requirements.
To determine the appropriate retention period for personal data, we consider the amount, nature, and sensitivity of the personal data, the potential risk of harm from unauthorised use or disclosure of your personal data, the purposes for which we process your personal data and whether we can achieve those purposes through other means, and the applicable legal requirements.
What are my rights with regards to data?
Please see the Your Legal Rights section of the main Privacy Notice.