Your privacy is important to us, and we take great care to protect it. We collect your personal details when you fill in a form, write us a letter, phone us or send us an email.
This privacy notice explains how we use information about you and how we protect your privacy.
Each of our service areas has its own privacy notice with more detailed information. This covers how we handle your information for specific council services, including who we may share your information with and why.
For data protection information see our data protection policy page.
Who we are
Bristol City Council is the data controller and is responsible for ensuring that we:
- only collect and use the personal information necessary to provide you with a service, or for our interaction with you
- maintain the highest standards necessary to protect your personal information
Our address:
Bristol City Council
City Hall
College Green
Bristol
BS1 5TR
Call: 0117 922 2000
Our Data Protection Officer monitors Bristol City Council's compliance with the law and provides advice.
If you have any concerns or questions about how we look after your personal information, contact our Data Protection Officer:
Email: data.protection@bristol.gov.uk
Write to:
Data Protection Officer
Information Governance
Bristol City Council
City Hall
PO Box 3399
Bristol, BS1 9NE
What is personal information
Personal information is anything that identifies and relates to a living person.
It can include information that when put together with other information can identify a person.
For example, this could be your:
- name
- contact details
- bank details
- personal and family history
- identification numbers
- online identifiers
Special category information
Some personal information is more sensitive and needs more protection.
It's often information that is very personal to you and is information that can reveal or is concerning your:
- Racial or ethnic background
- Genetic or biometric data
- Health
- Political opinions
- Religious or philosophical beliefs
- Sex life
- Sexual orientation
- Trade union membership
Criminal Offence information is any information that can reveal or is concerning your criminal history.
We get most of the personal information we use from you and from what we learn about you through your interactions with us.
We may also get some information about you from:
- the technology you use to access our services
- information you make public on social media
- family members
- your legal representative
- referees
- employers
- information from publicly available sources
- health and education providers
- commissioned partners
- regulatory bodies
- police and other local authorities
Details about what information we get from other sources can be found in the different service area privacy notices.
Why we need your personal information
We may need to use your personal information to:
- deliver services and support to you
- manage those services we provide to you
- train and manage the employment of our workers
- help investigate any worries or complaints you have about our services
- keep track of spending on services
- check the quality of services
- help with research and planning of new services
- prevent and detect crime and fraud
There are circumstances when you are required by law or contract to provide personal information.
When this is the case, you can find the details in the different service area privacy notices.
If you're a supplier or commissioning body, we will need to retain your name and contact details for the purpose of our contract management.
Analysis of data held by Bristol City Council
We use personal data to provide services to people. We also use it to help managers understand how our services are working and where improvements may be needed.
To do this, we may take information from our systems and match it with other information we hold. This helps us understand service performance and plan improvements.
Our legitimate interests
There may be some limited circumstances when we process your personal data as it is in our legitimate interests to do so.
When this occurs, our legitimate interests are provided in the relevant service area's privacy notice.
Our use of cookies on our websites
We sometimes store small files called cookies on your computer or other device to help improve your experience on our website.
We collect web statistics automatically about your visit to our site based on your IP address.
This information is used to help us to improve your experience on our website.
Our use of automated decision making and profiling
There are some circumstances when BCC uses automated decision making and profiling.
When this occurs, details of this are provided in the relevant service area's privacy notice.
How the law allows us to use your personal information
There are a number of legal reasons why we are allowed to collect and use your personal information.
These are different for each council service and the specific details are contained in their privacy notice.
A summary of these reasons is set out below:
Consent
You have given your consent for us to use your personal information.
Contract
We need the information because you have:
- entered into a contract with us, or
- asked us to do something before entering into a contract
Legal Obligation
We need the information to comply with the law.
Vital Interests
We need the information to protect someone's life in an emergency
Public Task
We need the information to exercise our official authority and to carry out tasks in the public interest that is set out in law
Legitimate Interests
We need the information to conduct our legitimate business for non-statutory services.
Recognised Legitimate Interests
We need the information for a recognised legitimate interest set out in law.
Summary of additional legal reasons
There are additional legal reasons which have to apply when we process your special category personal information and criminal offence personal data.
A summary of these is set out below:
- We need your information for employment, social security or social protection purposes
- We need your information to deliver health or social care services
- You have made your information publicly available
- You have given your explicit consent
- We need your information to defend or make legal claims
- There is a substantial benefit to society as a whole for us to use the information
- We need the information to protect someone's life in an emergency
- We need the information to protect public health in the public interest
- We need the information for archiving, research or statistical purposes.
We process criminal offence personal data where it is authorised by law.
Use of AI and Microsoft Copilot
We use approved Artificial Intelligence (AI) tools, including Microsoft Copilot, to help staff work more efficiently and support the delivery of our services. These tools can assist with tasks such as drafting documents, summarising information, and analysing data.
AI tools may use personal information we already hold about you where this is necessary to provide services. We only use the minimum information needed for each task.
Copilot is used in different ways, including general tools available to staff and more specialised AI tools developed for specific services. Access to personal data in these tools is limited to trained and authorised staff.
In some cases, and where appropriate safeguards are in place, AI tools may be used to process more sensitive information (for example health or social care information). These uses are subject to strict controls, approvals, and data protection impact assessments.
We do not use AI to make decisions about you without human involvement that would have a legal or significant effect. Any information produced by AI is reviewed by a member of staff before it is used.
We have measures in place to make sure personal data is used safely and appropriately when using AI. This includes staff training, monitoring, and governance controls.
Any personal data processed using Microsoft Copilot remains within our secure Microsoft environment and is not used to train external or public AI systems.
Your data protection rights continue to apply when your information is used in AI tools.
Who we share your personal information with
Sometimes we have a legal duty to provide personal information to other organisations.
This includes where we have a statutory enforcement duty, disclosures we are required to make by law, to detect or prevent fraud and to audit or administer public money.
Sometimes we share data with other organisations in the exercise of our functions as a local authority, which includes via the Connecting Care system which enables health and social care professionals to share medical records. Read their transparency notice Go to https://www.connectingcarebnssg.co.uk/find-out-more/transparency-notice/ (opens new window).
You can choose if your health records are used for research and planning purposes and opt-out if you want to via the National data opt-out service.
We only share information if necessary and where we have a legal basis for doing so.
We may share your personal information with a range of organisations to store personal information on our behalf or help deliver our services.
When we do this, we always have an agreement in place to make sure that organisation complies with data protection law to keep your information safe.
When we share your personal information, details are provided in the relevant service area's privacy notice.
We also share some personal information within Bristol City Council to ensure the successful delivery of local services.
Safety concerns
Occasionally, we may share your personal information when we feel there is a good reason that is more important than protecting your privacy, for example:
- if there are serious risks to the public, our staff, or other professionals
- to protect a child, or
- to protect adults who are thought to be at risk
If we're worried about your physical safety or feel we need to take action to protect you from being harmed by others, we'll discuss this with you and if possible, get your permission to tell others about your situation before doing so.
We may still share your information if we believe the risk to others is serious enough to do so.
If the risk is so great, we need to share information urgently, we'll record:
- what information we share
- our reasons for doing so
We'll let you know what we've done and why, if it is safe to do so.
Surveys
From time to time, we may ask you to take part in surveys. Surveys help us understand your views about our services, websites, systems and social media channels such as Facebook, LinkedIn.
Each survey will explain why we are asking for your views and what we will do with the information you provide. Taking part is your choice.
If we ask for your consent to take part in a survey, we will only use your information for that survey. We will not use your consent for any other purpose.
In some cases, we may use an external organisation to run or manage a survey for us. If this happens, we will explain this in the survey information.
Details of the purpose and scope of the survey will be made clear for each survey we may ask you to participate in, this will provide you with the details for you to clearly decide if you want to consent to participate in the Survey.
Personal data collected during a survey will be deleted after the survey analysis is complete, unless we clearly tell you otherwise.
Taking part in our surveys will not affect your mailing preferences. Unless we tell you otherwise, your responses will be anonymous.
Fraud prevention and detection
Bristol City Council is required by law to protect the public funds it administers.
We may share information provided to it with other bodies responsible for:
- auditing
- administering public funds or
- where undertaking a public function, in order to prevent and detect fraud
How we protect your information
We work hard to make sure that the records we hold about you are:
- looked after securely
- only available to those who have a right to see them
Some of the ways we do this are by:
- controlling access to systems and networks
- training of staff so they understand how to look after your information
- putting in place controls over where data is stored
- ensuring personal information sent by email is encrypted
- deleting personal information when it is no longer needed
More information about how we protect your personal information can be found in our information security policy.
Will my personal data be sent outside the UK
Most personal information we collect, and use is stored on systems in the UK.
On occasion, your information may leave the UK:
- either to get to another organisation or
- if it is stored in a system outside the EU
Details of these transfers can be found in the service area privacy notices.
When this happens, we make sure the country it is sent to has the required level of data protection.
We take additional steps to protect your information including:
- making sure it is transferred securely
- there is a contract in place which ensures the recipient will protect your information
We do all we can to make sure your information is not sent to a country that is not deemed to look after your personal data sufficiently by the UK or EU governments.
If we have to send it to such a country, we will seek advice from the Information Commissioner's Office first.
How long we keep your personal information
We'll only keep your information as long as we need to.
Each service states how long your information may be kept for in its privacy notice. This ranges from months for some records to indefinitely for others.
Sometimes the law states how long we must keep personal data for. We try to include all of these time limits in our spreadsheet Record retention schedule(575 KB)
Your rights in relation to your personal information that we collect and use
You have a number of rights in relation to the personal information we collect and use about you.
Further information about these rights can be found on the Information Commissioner's guide to individual rights.
Your rights
You can ask for access to a copy of the personal information we have about you in both paper and electronic records.
If you would like a copy of the personal information we hold about you, you can contact us either by:
- online Subject Access Request form
- email: subjectaccessrequest@bristol.gov.uk
- or by writing to our Data Protection Officer
We cannot share any information which contains:
- personal information about other people
- information a professional considers will cause serious harm to you or someone else's physical or mental wellbeing
Additionally, we will not give you a copy of the personal information if we think that giving it to you may stop us from preventing or detecting a crime.
You can ask us to change information you think is inaccurate
If the information we hold about you is inaccurate or incomplete let us know by contacting Citizens Services.
We may not always be able to change or remove the information but we:
- will correct factual inaccuracies
- may include your comments in the record to show that you disagree with it
You can ask for your information to be deleted
In some circumstances you can ask for your personal information to be deleted for example, where:
- your information is no longer needed for the reason for which it was collected in the first place
- you have removed your consent for us to use your information
- there is no legal reason allowing our use of your information
- deleting the information is a legal requirement.
We don't have to delete your information if:
- we are required to have it by law
- it's used to carry out a task in the public interest or our exercise of official authority
- it's used for freedom of expression and information
- it's used for public health purposes or preventative or occupational medicine purposes (special category data only)
- it's scientific or historical research, or statistical purposes where it would make information unusable
- it's necessary for legal claims
You can ask us to limit what we use your personal data for
You are able to ask us to restrict what we use your personal information for where:
- you have identified inaccurate information and have told us about it
- we have no legal reason to use that information, but you want us to restrict what we use it for rather than erase the information altogether
When use of information is restricted, it can't be used other than to securely store the information and with your consent to handle legal claims and protect others or where it is required by law.
When use of information is restricted at your request, we will inform you before we carry on using your personal information.
You can ask us to stop using your personal information for any council service. If this request is granted, this may cause delays or prevent us delivering that service.
Where possible we'll try to comply with your request, but we may need to hold or use information because we are required to by law.
You can ask to have your information moved to another provider (data portability)
If we are using your information with your consent or to comply with a contract, and we use it only through a computer, you have the right to ask for your personal information to be given to you or another service provider in a machine-readable format.
It's unlikely this will apply in relation to personal information used by the council.
You can ask to have any computer made decisions explained to you, including details of how we may have 'profiled' you.
You have the right to question decisions made about you by a computer, unless the use of your information in this way is needed to:
- comply with a contract between you and the council or
- it is required by law or you have given your consent to your information being used in this way
This includes the right to object if you are being 'profiled', that is, decisions are made about you based on your personal information.
You can object to us sending you direct marketing
You have the right to ask us to stop sending you marketing information about our services. If you ask us to stop, we will do so.
You may have the right to object to our use of your personal information
In some circumstances you can object to our use of your personal data. In these circumstances we weigh your right to privacy against the wider public interest in continuing to use your data.
You have the right to withdraw your consent
When we rely on your permission to use your personal information, you have the right to withdraw your consent to us using your personal information at any time.
How to exercise your rights
You can exercise any of these rights, ask questions about how we use your personal data or complain by contacting us at data.protection@bristol.gov.uk
You can also write to our Data Protection Officer at:
Data Protection Officer
Information Governance
Bristol City Council
City Hall
PO Box 3399
Bristol
BS1 9NE
If you think we have dealt with your information inappropriately or unlawfully, you have the right to complain to the Information Commissioner's Office (ICO) at:
Information Commissioner's Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF
Website: Information Commissioners Office
Service Area privacy notices
You can also read more detailed privacy notices for specific council services:
Privacy and processing notices for adults, children and education services
What we do with the information you give us when you use our adults, children, and education services.
Privacy and processing notice for community services
What we do with the information you give us when you use our community services.
Privacy and processing notice for resource services
What we do with the information you give us when you use our resource services.
Privacy and processing notice for growth and regeneration services
What we do with the information you give us when you use our growth and regeneration services.
Privacy and processing notice for public health services
What we do with the information you give us when you use our public health services.