Quickly exit this site by pressing the Escape key Leave this site
This site is a beta, which means it's a work in progress and we'll be adding more to it over the next few weeks. Your feedback helps us make things better, so please let us know what you think.
Your privacy is important to us. This Privacy Notice explains how Derbyshire Constabulary collects, stores, uses, discloses, retains and destroys information about people (their personal data ), and the steps we take to ensure that it is protected. It also describes the rights you have in regard to information we may already hold about you and any further personal information we might collect about you, either from you or from a third party.
The use and disclosure of personal data is governed in the United Kingdom by the Data Protection Act 2018 which is supplemented by the UK General Data Protection Regulation (UK GDPR) and incorporates the Law Enforcement Directive (LED). The Chief Constable of Derbyshire Constabulary is registered with the Information Commissioner as a ‘controller’ and is obliged to ensure that Derbyshire Constabulary handles all personal data in accordance with the Data Protection Act 2018 and the UK GDPR.
Derbyshire Constabulary takes its responsibility very seriously and ensures that personal data is handled appropriately in order to secure and maintain individuals’ trust and confidence in the Police Service.
The Constabulary’s Data Protection Officer, Ms A Turner, together with the Data Protection Team provides help and guidance to ensure that the Constabulary applies appropriate standards to protect your personal data. Personal data could be information which is held on a computer, in a paper record such as a file, as images, but it can also include other types of electronically held information such as CCTV images or Body Worn Video images.
You can contact our Data Protection Team or our Data Protection Officer if you have any questions or concerns about how we process your personal data:
Data Protection Team
email: [email protected]
Derbyshire Constabulary collects, stores, uses, discloses and retains personal data for two broad purposes; the Law Enforcement Purposes and to carry out activities to support the Law Enforcement Purposes, something we call General Purposes.
a) The Law Enforcement Purpose (Policing Purpose) which includes:
b) The provision of services to support the Law Enforcement Purposes (General Purposes) which includes:
In order to carry out the purposes described under Section 1 above Derbyshire Constabulary may collect, store, and disclose (see Section 8 below) and retain personal data relating to a wide variety of individuals including the following:
Derbyshire Constabulary will only use appropriate personal information necessary to fulfil a particular purpose or purposes.
In order to carry out the purposes described under Section 1 above, Derbyshire Constabulary may collect, use, disclose (see Section 8 below) and retain personal data relating to or consisting of the following:
Derbyshire Constabulary will only use appropriate personal data necessary to fulfil a particular purpose or purposes.
In order to carry out the purposes described under Section 1 above Derbyshire Constabulary may collect personal data from a wide variety of sources, other than directly from you, including the following:
Derbyshire Constabulary may also obtain personal data from other sources such as its own CCTV systems, Body Worn Video footage or correspondence.
Derbyshire Constabulary will only use your personal data where we have an appropriate lawful basis for doing so, for example we use your personal data where:
Where we rely on your consent to process data, you have the right to withdraw this at any time. To withdraw consent please contact the Data Protection Team using the details provided, or as specified on the relevant consent form.
In order to achieve the purposes described under Section 1 Derbyshire Constabulary will handle personal data in accordance with the Data Protection Act 2018 and the UK GDPR.
Where we are processing data for the General Purposes we will ensure that any personal data is:
Where we are processing personal data for Law Enforcement purposes we will ensure that any personal data is:
Derbyshire Constabulary keeps your personal data for as long as is necessary for the particular purpose or purposes for which it is held. Personal data which is placed on the Police National Computer is retained, reviewed and deleted in accordance with the agreed national retention periods which are subject to periodic change.
Other records containing personal data relating to intelligence, digital media, custody, crime, firearms, child abuse investigations, and domestic violence will be retained in accordance with the NPCC endorsed guidance on the Management of Police Information (MoPI) 2006, (this can be found on the College of Policing’s website www.college.police.uk) and the National Retention and Disposal Schedule which the Constabulary has adopted, (this can be found on the National Police Chief’s Council website www.npcc.police.uk).
Derbyshire Constabulary also manages personal data in accordance with our Review, Retain and Disposal Policy.
Derbyshire Constabulary takes the security of all personal data under our control very seriously. We will comply with the relevant parts of the Data Protection Act 2018, the UK GDPR and LED relating to security, and seek to comply with the National Police Chiefs Council (NPCC) and relevant parts of the ISO27001 Information Security Standard.
We will ensure that appropriate policy, training, technical and procedural measures are in place, including audit and inspection, to protect our manual and electronic information systems from data loss and misuse, and only permit access to them when there is a legitimate reason to do so, and then under strict guidelines as to what use may be made of any personal data contained within them. These procedures are continuously managed and enhanced to ensure up-to-date security.
In order to carry out the purposes described under Section 1, above Derbyshire Constabulary may disclose personal data to a wide variety of recipients in any part of the world, including those from whom personal data is obtained (as listed above). Recipients of the data may include:
We may also disclose to other bodies or individuals where necessary to prevent harm to individuals. Disclosures of personal data will be made on a case-by-case basis, using the personal data appropriate to a specific purpose and circumstances, and with necessary controls in place.
Where you have provided your personal data to us for the purposes of the police constable recruitment process, your data, including biographical monitoring information, will be shared with the College of Policing.
It will be stored on their secure network or within their Assessment Information Management System (AIMS). From this information, your name, email address and candidate reference number will be uploaded to the new online assessment platform for constable recruitment and shared with the third party provider hosting the system in order to progress your application virtually.
Some of the bodies or individuals to which we may disclose personal data are situated outside of the European Union - some of which do not have laws that protect data protection rights as extensively as in the United Kingdom. If we do transfer personal data to such territories, we will take proper steps to ensure that it is adequately protected as required by the Data Protection Act 2018.
Derbyshire Constabulary will also disclose personal data to other bodies or individuals when required to do so by, or under, any act of legislation, by any rule of law, and by court order. This may include disclosures to the Child Maintenance Service, the National Fraud Initiative, and the Home Office and to the Courts.
Derbyshire Constabulary may also disclose personal data on a discretionary basis for the purpose of, and in connection with, any legal proceedings or for obtaining legal advice.
Our website forms part of the national Digital Public Contact Programme. This means all completed online forms are automatically sent to us securely via the Central Police IT Team.
Requests for information from the insurance industry may be shared by Derbyshire Constabulary for the purposes of prevention and detection of crime, including fraud. They are considered on a case-by-case basis with sufficient information to support the consideration of disclosure and to meet the legitimate interests of the third party in the detection and prevention of fraud.
The UK GDPR provides certain rights for individuals however all of these rights do not apply when it comes to Law Enforcement processing, and the applicable rights do not apply in all circumstances. Details of the rights are described below:
The right to be informed – You are entitled to be told how we obtain, use, retain and store your personal data and who we share it with. This is described within this Privacy Notice.
The right of access – Previously a Subject Access request. You can request access, which may be subject to some exemption, to a copy of information that may be held about you, along with information on what personal information we use, why we use it, who we share it with, how long we keep it for and whether it has been used for any automated decision making. You can usually make a request for access free of charge.
Details of the application process, known as ‘Right of Access’ can be found on this website.
Alternatively individuals may contact Derbyshire Constabulary by using the contact details provided below; in person; via telephone or social media to make the request, however the preferred method is via the application process.
Data Protection Team
Or email: [email protected]
Rights of access do not apply to the processing of ‘relevant personal data’ , we can limit confirmation that we are processing data and any access to personal data, if necessary and proportionate in order to:
Where a limitation is in place the individual must be given an explanation of the reasons, unless providing this information undermines the purpose of imposing the restriction.
The right to rectification – Under Article 16 of the UK GDPR, individuals have the right to have inaccurate or incomplete personal data rectified. Derbyshire Constabulary can refuse this request where the data is necessary and proportionate or relates to ‘relevant personal data’ i.e. to avoid obstructing an official or legal inquiry, investigation or procedure, or to avoid prejudicing the prevention, detection, investigation or prosecution of criminal offences or the execution of criminal penalties, as detailed above.
The request must be processed within one month, or three months in complex cases. Where a request is refused the individual must be notified and where no action is taken individuals have the right to be informed of how to seek a judicial remedy.
The right to erasure – Under Article 17 of the UK GDPR, individuals have the right to have personal data erased and to prevent processing in specific circumstances:
Derbyshire Constabulary can refuse such a request where it is necessary and proportionate or relates to 'relevant personal data', i.e. to avoid obstructing an official or legal inquiry, investigation or procedure or to avoid prejudicing the prevention, detection, investigation or prosecution of criminal offences or the execution of criminal penalties, as detailed above. The erasure of personal data relating to criminal offences cannot be considered until its full period of retention has been reached (as detailed in the National Retention and Disposal Schedule which has been adopted by Derbyshire Constabulary).
The right to restrict processing – Under Article 18 of the UK GDPR, individuals have the right to restrict the processing of personal data, for example, if an individual believes that the data is incorrect but it is not possible to confirm the accuracy of the data. Derbyshire Constabulary can refuse such a request where it is necessary and proportionate or relates to ‘relevant personal data’, in order to avoid obstructing an official or legal inquiry, investigation or procedure or to avoid prejudicing the prevention, detection, investigation or prosecution of criminal offences or the execution of criminal penalties, as described above.
Where a request is received the individual must be informed in writing as to whether Derbyshire Constabulary has granted the request; and if it has been refused, the reasons why.
The right to data portability (not applicable to law enforcement processing) - Under Article 20 of the UK GDPR, individuals have the right to data portability which allows individuals to obtain and reuse their personal data for their own purposes across different service. It allows them to move, copy or transfer personal data easily from one IT environment to another in a safe and secure way without hindrance to usability. The personal data must be provided in a structured, commonly used and machine readable form. The information must be provided free of charge.
The right to object (not applicable to law enforcement processing) - Under Article 21 of the UK GDPR, individuals have the right to object to processing based on legitimate interests or the performance of a task in the public interest/exercise of official authority (including profiling), and processing for purposes of scientific research and statistics.
Rights in relation to automated decision making including profiling- Under Article 22 of the GDPR, individuals have the right to object to decisions made about them on the basis of automated processing including profiling, where those decisions have legal or other significant effects. This includes processing where there is no human intervention, for example where automated processes are used to sift recruitment applications.
An individual has the right to withdraw their consent – This does not apply to offenders or suspected offenders as the processing is necessary to perform a task within the public interest without their consent being given. There may however be circumstances in which individuals have given the Constabulary consent to use their information; this can be withdrawn at any time by writing to the Data Protection Officer using the details at section 12 Contact Us at the bottom of this notice, or as specified on the relevant consent form.
Individuals have the right to complain to the Information Commissioner’s Office if they believe that they are or have been adversely affected by the handling of personal data by Derbyshire Constabulary. Individuals may direct their complaint to the Information Commissioner’s Office via the website or by telephone.
Telephone: 0303 123 1113
Derbyshire Constabulary may monitor or record and retain telephone calls, texts, emails and other electronic communications to and from the force in order to deter, prevent and detect inappropriate or criminal activity, to ensure security, and to assist the purposes described under section 1 above. Derbyshire Constabulary does not place a pre-recorded ‘fair processing notice’ on telephone lines that may receive emergency calls (including misdirected ones) because of the associated risk of harm that may be caused through the delay in response to the call.
Any individual with concerns over the way that Derbyshire Constabulary handles their personal data or for further details about the information contained within this Privacy Notice may contact the Data Protection Officer (DPO) at the details below:
Data Protection Officer
E-mail: [email protected]
 ‘Personal Data’ is defined in Article 4 of the UK General Data Protection Regulation (UK GDPR). In practical terms it means any information handled by Derbyshire Constabulary that relates to an identified or identifiable natural person; an identifiable natural person is anyone who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.
 This document is designed to help satisfy the rules on giving privacy information to data subjects in Articles 12, 13 and 14 of the UK GDPR.
 Defined by the statutory Code of Practice on the Management of Police Information 2005 as ‘protecting life and property, preserving order, preventing the commission of offences, bringing offenders to justice, and any duty or responsibility of the police arising from common or statute law.’
 Derbyshire Constabulary is required to conduct Customer Satisfaction Surveys to evaluate our performance and effectiveness. We may contact individuals, such as victims of crime or those reporting incidents, and ask them to give us their opinion of the services we are providing to the public. We use the information given to improve our service and wherever we can, Derbyshire Constabulary, like many police forces uses a private company to undertake such surveys on our behalf with strict controls to protect the personal data of those involved.
 Relevant personal data’ means personal data contained in a judicial decision or in other documents relating to the investigation or proceedings which are created by or on behalf of a court or other judicial authority. Access to ‘relevant personal data’ is governed by the appropriate legislation covering the disclosure of information in criminal proceedings, such as (in England and Wales) the Criminal Procedure and Investigations Act 1996.