Skip to main content

Privacy notice for Emergency Planning

Data Controller

Waverley Borough Council (WBC) is the public body exercising control over the purpose for which and the way your personal data is processed. 

Data Controller's contact details

Waverley Borough Council, The Burys, Godalming, Surrey, GU7 1HR 

01483 523333 

Data Protection Officer:

The legal basis for and the purposes of the processing

WBC has a statutory duty, as a Category 1 Responder, to plan for, prepare for, respond to and recover from emergencies. These responsibilities as a Category 1 Emergency Responder are set out by the Civil Contingencies Act (CCA) 2004, Part 1 Local Arrangements for Civil Protection

The amount and type of data collected will differ depending on the reason for data collection. In relation to emergency planning the objective of data collection will only to be protect life, property, and the environment. 

We may also collect information at the time of an emergency and/or business disruption to assist us to deliver a timely and effective response and recovery. 

The Emergency Planning team can process relevant personal information. This is permitted under one or more of the conditions referred to below, as set out in the UK GDPR under Article 6: 

  • Consent: the individual has given clear consent for WBC to process their personal data for a specific purpose 
  • Statutory Duty: Processing is necessary for compliance with a legal obligation to which the controller is subject 
  • Public task: Processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the control
  • Vital interests: Processing is necessary to protect someone's life 

Where special category personal data is processed, an additional condition as set out in the UK GDPR must also be satisfied, under Article 9. The two most likely conditions are likely to be:

  • The data subject has given explicit consent to the processing for one or more specified purposes 
  • The processing is necessary because of the strength of public interest in having appropriate measures in place to assist vulnerable people in emergency situations 

(The full text for the above conditions are set out in articles 6 and 9 of the UK GDPR). 

The source of the personal data

Contact details: The information we hold is provided by the individual. This personal information includes

  • name
  • mobile and home telephone numbers
  • home location. 

Vulnerable people data: The information is provided by the relevant service (Assisted Waste Collections, Community Alarm, and Benefits). Across the data sets, this personal information includes

  • name
  • address
  • contact number
  • date of birth
  • address 

During an incident: The information is provided by the individual. Their personal information would include

  • name
  • address
  • contact details
  • gender
  • nationality
  • next of kin details (including contact information)
  • welfare information (including medical information)
  • religion. 

Recipients and categories of recipients of the personal data 

In some cases, we may be required to share your personal information with other agencies. The CCA 2004 places a duty on Category 1 and 2 responders to share information upon request which relates to the performance of their duties or functions relating to the response and recovery stages of an emergency.  

When sharing data, a specific platform, the vulnerable person reporting system (VPRS), will be used. This system requires stakeholders (including WBC) to regularly upload vulnerable person data where it is securely stored. The data can then only be accessed once its release has been agreed by all local resilience forum partners involved in the given emergency incident. When accessed the system will only allow for location specific data to be retrieved and shared. 

Further information on onward transfers

WBC will not transfer personal data outside of the UK or European Union unless this is permitted in accordance with the Data Protection Act 2018. 

How long the personal data will be kept for

The personal data you have supplied will be retained and destroyed in accordance with WBC’s Retention Schedule.  

Statutory Obligations to provide the personal data

There is no statutory obligation on you to provide any personal data about you, however, if you do not it may not be possible to aid you in the event of an emergency. 

Automated Decision Making 

The personal data provided by you will not be used for any automated decisions. 

Data Subject Rights

From 25th May 2018 you have specific rights in respect of your personal data. Further information can be found on our main privacy notice.  

Will the personal data be processed for a different purpose? 

No. If WBC needs to inform recipients about any action it has taken under the Data Protection Act then it will do so by placing a Notice on WBC’s website informing the public of any relevant changes 

If you are dissatisfied with how your personal data is processed by WBC then you have the right to complain to the Information Commissioner who can be contacted at:

Information Commissioner's Office

Wycliffe House

Water Lane


SK9 5AF. 

Further information