Data protection

Data protection legislation includes the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 and other laws relating to processing of personal information and privacy. It also includes relevant guidance issued by the Information Commissioner's Office (ICO).

The Act contains six data protection principles. Organisations that collect and use personal information must be able to show that they comply with these principles. This means personal data must be processed:

lawfully, fairly and transparently
for specified, explicit and legitimate purposes
in a way that is adequate, relevant and limited to what is necessary
accurately and kept up to date
with the appropriate security and protection
and kept only for as long as necessary.

Personal data shall not be transferred to countries that do not have an adequate level of data protection. All processing of personal data must be in accordance with the data subject's rights.

These include the:

right to be informed
right of access
right to rectification
right to be forgotten
right to restrict processing
right to data portability
right to object
rights in relation to automatic decision-making and profiling
right to lodge a complaint with the supervisory authority.

Further information on how we process and protect your personal information in line with data protection legislation can be found in the section below.

You have the right to ask us whether we hold or use your personal data. You can also ask for a copy of the personal data we hold about you using our subject access form. We will respond within 30 calendar days.

Make a subject access request (opens in new tab)

You will be sent the results of the review. If you are unhappy with the outcome of the review, you can request an assessment of your case by the Office of the Information Commissioner.

Personal information will only be given to an individual whose data we are processing and ID will be required before we respond to your request.

Requests for information about a person other than yourself will be rejected except for the following circumstances:

if you are a parent of a child under 13 you may request information about your child, but there is no automatic right to your child’s personal data
a solicitor may request information on your behalf.

We are required by law to protect the public funds we administer. We may share information provided to us with other bodies responsible for auditing or administering public funds, or where undertaking a public function, in order to prevent and detect fraud.

The Cabinet Office is responsible for carrying out data matching exercises.

Read the national fraud initiative notice and find out more (opens in new tab)

Our retention schedules set out how long we keep different types of information and records.

Below, you'll find our retention schedules split into service areas.

You can exercise any of your data protection rights listed on this page under GDPR Article 15 to 22 by emailing our data protection team at data.protection@dover.gov.uk (opens in new tab)

Data protection

More on data protection

Keep Me Posted

Data protection

How to request access to your personal data

Who is entitled to personal information?

National fraud initiative - data matching

Retention schedules

Associated documents/links

Keep Me Posted