Children and Young People Services (CYP) privacy notice

Download the Children and Young People's (CYP) privacy notice in a different language.

This privacy notice explains how the Children and Young People’s Service use and protect your personal data.

CYP is responsible for providing services to children and young people in Suffolk; these include Family Support (formerly known as Early Help), Social Care and services relating to Education, Youth Justice, Statutory SEND Services & Inclusion and Early Years services. On occasions we may need to collect and use personal data in order to fulfil these duties.

The use of personal data is governed by the UK General Data Protection Regulation (UK GDPR), and the Data Protection Act 2018 (DPA 2018), as amended by the Data (Use and Access) Act 2025 (DUAA); together, they are known as data protection law.

Suffolk County Council is the controller for the personal data that it uses. If you have any queries about how [insert name of service/directorate] is using your information, you can contact the service on:

cyp.dataprotection@suffolk.gov.uk

Contact details for the council’s Data Protection Officer and Compliance Manager can be found in the council’s corporate privacy notice, which is available on the council’s website.

Personal data includes information about you, which can be used to identify you as an individual. Examples include:

• Your name
• Your date of birth
• Your contact details
• Your image

Special category data is the most sensitive type of personal data and is protected by stronger safeguards. It includes:

• Information about your health or any social care services that you may use
• Information that could identify your racial or ethnic origins
• Information that could identify your political beliefs
• Information that could identify your religious or philosophical beliefs
• Information that could identify your trade union membership
• Genetic data
• Biometric data (where used to identify you, e.g. use of fingerprints to access online services)

Information about your sex life, or sexual orientation

So that we can provide the right services, we collect the following personal data from you:

• Name
• Contact details including email address and telephone number
• Your date of birth
• Any other personal information that you provide that is relevant to your contact

We sometimes need to collect the following information from other sources including:

• Your health records
• Information about your eligibility to work with vulnerable groups of people (such as DBS and Police National Computer (PNC) checks, and checks with the Local Authority Designated Officer (LADO))
• Information relating to education
• Ethnic group, home circumstances, language, and health information
• National Curriculum assessment results
• School attendance/ exclusion information
• Details of any special educational needs for young people
• Relevant medical information for young people/ parents/ carers – only where appropriate e.g. special educational needs or disability
• Physical or mental health
• Any additional personal information that is necessary to provide you with the correct service

In some circumstances this may require us to hold information on adults within the family.

We may, in some circumstances, also check what previous services have been offered to you and your family.

Children and Young People’s Services provide the following (non-exhaustive list of) services:

Early Years and Childcare

• Leading, managing, and developing Early Years and Childcare services
• Planning, reviewing, and organisation early years places, childcare places, and school places
• Identifying those children eligible for funded early years education, and informing parents of their entitlement to funded childcare
• Administration and payment of early education funding to all childcare providers

Education and learning

• Provision of education within schools
• Services to schools to promote high standards – including training, advice, monitoring, and support
• Provision of educational support services
• Provision of education for children in care
• Providing information to schools regarding licences (such as Performance licences)
• Admissions to school
• School travel
• Free school meals eligibility
• Provision of careers and Post-16 education
• Post-16 skills opportunities

Inclusion service

• Provision for Children & Young People with Specialist Educational Needs & Disabilities
• Delivery of statutory duties for EHC Needs Assessment, Annual Reviews and EHC Plans
• Strategic oversight with partners in the Local Area including coproduction.
• Quality assurance of providers and internal processes
• Specialist services for children and families who may be vulnerable or have higher levels of needs. This includes Special Educational Needs and/or Disabilities and those with medical needs
• Commissioning and contract management of specialist provision for children in Suffolk
• Admissions to specialist and Alternative Provision
• Manage Short Break Offer
• Support for CYP for Emotional Wellbeing, behaviour and learning across Suffolk

Social Care services

• Provision of social care services for vulnerable children and young people, and their families
• Fostering and adoption services
• Safeguarding services
• Specialist services for children and families who may be vulnerable or have higher levels of needs. This includes Special Educational Needs and/or Disabilities, young people who have offended, or are at risk of offending, or being involved in anti-social behaviour
• Services for young people at risk from gangs, County Lines activity or radicalisation
• Services that support Children in Care and Care Leavers
• Residential Care Provision

Enhanced and preventative services

• Universal services
• Family Support (formally known as Early Help) Services, including the CHRIS service and Key Worker Services
• Community Nursing
• Family Support
• Attendance support for young people at risk, or not in education, employment or training (NEET)

Management information

• Planning and performance of CYP
• Managing fully integrated information systems supporting CYP
• Collecting, processing, and administering statutory data – including census returns and end-of-key-stage assessments
• Overseeing services provide by CYP, including SENDIASS and Safeguarding
• Working with other organisations to support the health and wellbeing of children and young people, including the commissioning of services to enable us to do this

We collect and use information about young people and families to enable CYP to provide the above services and to ensure we carry out specific functions for which we are responsible. These functions include providing appropriate support and care to young people and families and collating statistics which inform decisions. Such as funding, provision of services, admissions to schools, exclusions from schools, assess performance and set targets to maintained schools, audit how well our services are meeting the needs of young people and families, and assess levels of funding required.

This can include: 

• free school meals
• early years funding
• promote welfare, safeguarding, health and wellbeing for young people
• assess how well Children’s Services is performing
• assess and improve finance and individual service planning
• monitoring of ethnicity and disability
• delivery of services and support to you
• managing our services
• training workers
• investigating complaints about our services
• monitoring and protecting public spending
• helping us to improve and plan new services
• complying with laws that require us to provide personal information to other organisations, such as health organisations, government departments, and courts

Personal data

Under data protection law, CYP can only use your personal data if it is lawful to do so. Please see the details below of the lawful bases, or conditions, that we rely on for using different types of personal data.

For processing personal data, we rely on the following conditions:

• UK GDPR Article 6(1)(e) – where processing is necessary for us to perform a task which is in the public interest (public task) (we use your information to deliver services or carry out duties that we are required to do as a council)
• UK GDPR Article 6(1)(f) – where processing is necessary to meet our legitimate interests which are not part of our public function (we use your information for a valid reason that you would reasonably expect, and which does not unfairly impact your rights)

Special category data

When we use special category data, we rely on the following additional conditions:

• UK GDPR Article 9(2)(b) – where processing is necessary for [insert name of service] to carry out specific obligations or exercise rights relating to employment, social security, and social protection (Schedule 1, Part 1, section 1, DPA 2018) (we need to use your sensitive information to meet our responsibilities as an employer or to provide social security or social care support)
• UK GDPR Article 9(2)(f) – where processing is necessary to establish, carry out or defend legal claims (we need your information to deal with legal cases, for example, to make or defend a legal claim)
• UK GDPR Article 9(2)(g) – where processing is necessary for reasons of substantial public interest, specifically:
• for statutory and government purposes (Schedule 1, Part 2, section 6, DPA 2018) (we use your sensitive information because the law requires us to carry out certain official duties)
• for monitoring of equal opportunities and treatment (Schedule 1, Part 2, section 8, DPA 2018) (we use sensitive information to check that you are treated fairly and equally) – note this will only apply where specific special category data (health, sexual orientation, and religious or philosophical beliefs) is being processed to enable equality of opportunity or treatment to groups of people in relation to the category of data
• for preventing or detecting unlawful acts (Schedule 1, Part 2, section 10, DPA 2018) (we use sensitive information to help stop or investigate crimes)
• to protect the public against dishonesty (Schedule 1, Part 2, section 11, DPA 2018) (we use sensitive information to protect you from fraud or dishonest behaviour)
• for preventing fraud (Schedule 1, Part 2, section 14, DPA 2018) (we use sensitive information to help prevent fraud)
• for the safeguarding of children and of individuals at risk (Schedule 1, Part 2, section 18, DPA 2018) (we use your sensitive information to protect children or vulnerable adults from harm)
• UK GDPR Article 9(2)(h) – where processing is necessary for the provision of health and/or social care purposes (Schedule 1, Part 1, section 2, DPA 2018) (we use your information to provide you with, or manage health or social care services)
• UK GDPR Article 9(2)(j) – where processing is necessary for archiving, research or statistical purposes that are in the public interest (Schedule 1, Part 1, section 4, DPA 2018) (we use your information for research, statistical work, or archiving that benefits the public)

Criminal offence data – general processing

CYP also uses criminal offence data which can include:

• Information about any criminal record or criminal history
• Allegations of criminal behaviour, including unproven allegations
• Absences of convictions, for example the results of DBS checks, or Police National Computer checks
• Personal data of victims and/or witnesses
• Personal data about criminal penalties that may have been awarded

In addition to the lawful bases that we have identified under “Personal data” above, we process criminal offence data under the following condition(s) of Schedule 1 of the DPA 2018:

• where processing is necessary to carry out specific obligations or exercise rights relating to employment, social security, and social protection (Schedule 1, Part 1, section 1, DPA 2018) (we use your information when the law requires us to meet duties related to employment, benefits, or supporting people)
• where processing is necessary for the provision of health and/or social care purposes (Schedule 1, Part 1, section 2, DPA 2018) (we use your information to deliver or manage health or social care services)
• where processing is necessary for reasons of public interest relating to matters of public health (Schedule 1, Part 1, section 3, DPA 2018) (we use your information to help protect the public from serious health threats or to support public health work)
• where processing is necessary for archiving, research or statistical purposes that are in the public interest (Schedule 1, Part 1, section 4, DPA 2018) (we use your information for research, statistics, or archiving when it benefits the public and when strong safeguards are in place)
• where processing is necessary for statutory and government purposes (Schedule 1, Part 2, section 6, DPA 2018) (we use your sensitive information because the law requires us to carry out certain official duties)
• where processing is necessary for the administration of justice and for parliamentary purposes (Schedule 1, Part 2, section 7, DPA 2018) (we use your sensitive information to support courts or legal processes)
• where processing is necessary for preventing and detecting unlawful acts (Schedule 1, Part 2, section 10, DPA 2018) (we use your sensitive information to help stop or investigate crimes)
• where processing is necessary for regulatory requirements relating to unlawful acts and dishonesty (Schedule 1, Part 2, section 12, DPA 2018) (we use sensitive information to protect you from fraud or dishonest behaviour)
• where processing is necessary for preventing fraud (Schedule 1, Part 2, section 14, DPA 2018) (we use sensitive information to help prevent fraud)
• where processing is necessary for the provision of counselling (Schedule 1, Part 2, section 17, DPA 2018) (we use your information to deliver or manage counselling services)
• where processing is necessary for the safeguarding of children and individuals at risk (Schedule 1, Part 2, section 18, DPA 2018) (we use your sensitive information to protect children or vulnerable adults from harm)
• where processing is necessary for disclosing information to elected representatives (Schedule 1, Part 2, section 24, DPA 2018) (we provide information to an MP or councillor when it is needed for their official duties)
• where processing is necessary for legal claims (Schedule 1, Part 3, section 33, DPA 2018) (we need your information to deal with legal cases, for example, to make or defend a legal claim)

Law enforcement purposes

CYP is a competent authority for the purposes of Part 3 of the DPA 2018. This means that we can process personal data so that we can prevent, investigate, and prosecute crime, or exercise criminal penalties

There needs to be a lawful basis and:

• you have provided us with your consent to use your personal data for law enforcement purposes; OR
• where processing is necessary to enable us to perform a task that is being carried out for law enforcement purposes

In addition to the above, we undertake sensitive processing for law enforcement purposes when:

• we have consent from you to process your personal data in this way; OR
• when processing is strictly necessary and cannot be achieved in any other way and meets the following conditions from Schedule 8 of the DPA 2018:
• where processing is necessary for statutory purposes (Schedule 8, section 1, DPA 2018) (we use your sensitive information because the law requires us to carry out certain official duties)
• where processing is necessary to safeguard children or people who are at risk (Schedule 8, section 4, DPA 2018) (we use your sensitive information to protect children or vulnerable adults from harm)
• where processing is necessary to prevent fraud (Schedule 8, section 8, DPA 2018) (we use sensitive information to help prevent fraud)
• where processing is necessary archiving, research or statistical purposes (Schedule 8, section 9, DPA 2018) (we use your sensitive information for research, statistical work, or archiving that benefits the public)

Legitimate interests

Sometimes, CYP relies on recognised legitimate interests, or legitimate interests as a lawful basis for processing your personal data. These conditions under the UK GDPR (as amended by DUAA) allow CYP to use personal data in ways that you would reasonably expect and that have a minimal impact on you, or where there is a justified reason for processing your data.

Recognised legitimate interests

To rely on this basis, there must be a legitimate interest for CYP to use your personal data for a recognised purpose. The recognised purposes are:

• Disclosure for purposes of carrying out our official duties as a council (under Article 6(e) (public task))
• Processing for safeguarding national security, protecting public security of for defence purposes
• Processing is necessary for responding to an emergency (under Civil Contingencies Act 2004)
• Processing is necessary for the purposes of detecting investigating or preventing crime, or apprehending and prosecuting offenders
• Processing is necessary for safeguarding a child or vulnerable adult

Legitimate interests

CYP has a legitimate interest in providing post code data for children’s homes and supported accommodation to the borough and district councils for the purpose of assessing planning applications. CYP only relies on legitimate interests when processing personal data is necessary to achieve that interest, and where it does not override your rights. In this instance, it is unlikely that this processing will have any impact on individuals.

CYP does share information with the following recipients in situations where information is requested by other organisations in order to provide you with the correct service:

• The Department for Education (DfE) on a statutory basis under the Education Regulations 2013
• Public agencies such as the NHS (e.g. GPs), health organisations, the police
• HM Courts and Tribunals Services (HMCTS)
• Other government departments such as the Home Office and the Department for Work and Pensions
• Services we commission (such as health, care, and specialist services)
• Education providers (such as maintained schools, academies, and free schools)
• Organisations seeking to prevent the radicalisation of young people (such as Channel, and Prevent)
• Information gained from a third-party organisation (such as a voluntary organisation or the police) for safeguarding and wellbeing purposes
• Information where there are risks around Criminal Sexual Exploitation (CSE)
• Organisations seeking to prevent crime (such as the police, and the National Crime Agency)
• The Children and Family Court Advisory and Support Service (CAFCASS)
• Information shared with commissioned accommodation providers for 16+ accommodation when placing a care leaver with them
• Information shared with providers of residential care settings when placing children in care
• Share school level data with other education providers to allow benchmarking and discussions on the improvement of educational standards for all children and young people in Suffolk

We do not transfer any personal data to any countries or international organisations outside of the EU, the EEA (European Economic Area), or any other country that does not have an equivalent level of data protection to the UK.

Data is only held for the minimum period required by CYP to undertake its legal responsibilities. Often, these retention periods are set out by law.

At the end of its retention period, data is reviewed, leading to one of the following outcomes:

• secure destruction – the data is no longer required
• review/keep – the data is required for a further period, and this period is documented
• archive – some or all of the data may be retained by the Suffolk Archives for archiving, research, or historical purposes

Retention periods follow nationally agreed standards, but some retention periods have been amended locally to enable the Council to comply with obligations under law.

Further details regarding retention period can be obtained by contacting cyp.dataprotection@suffolk.gov.uk

Automated decision-making is when a computer makes a decision about you automatically, without a person being involved. Profiling is when a computer uses your information to predict things about you, such as your needs, interests, or behaviours.

An example of each includes:

• Automated decision-making - a computer system deciding if you are eligible for a service based only on information that you have entered online
• Profiling - using your past service use to predict what you might need in the future

CYP does not use automated decision-making processes or profiling in respect of your information.

Under data protection law, you have the right to request access to the information that we hold about you.  If you would like to make a request to access your personal information, please contact data.protection@suffolk.gov.uk.

You also have other rights regarding your personal data.  You can find out more information about these rights by looking at the council’s corporate privacy notice.

Under the Data Use and Access Act 2025 (DUAA), you have the right to complain to the council about how your personal data has been used.

You can make a data protection complaint if you are concerned about how the council has handled your personal data. For example, you may be worried about:

• How we have responded to your request to access your personal data
• How your personal data has been collected or used (for example, if it is incorrect)
• Whether your personal data has been kept secure

You can get more details about the data protection complaint process by looking at the council’s corporate privacy notice.

If you would like independent advice on this privacy notice or other matters about how Suffolk County Council processes your personal data, including how to make a complaint, you can contact the Information Commissioner's Office at:

Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF

Telephone: 0303 123 1113

Email: casework@ico.org.uk