Privacy Policy

Updated: 08/08/16

The purpose of this document

Educational Psychology & Specialist Support (EPSS) & Norfolk County Council (the County Council) is committed to protecting the privacy and security of your personal information.  By personal information, we mean information which, by itself or with other data available to the County Council, can be used to identify you.

The General Data Protection Regulations (GDPR) amend the Data Protection Act 1998 as from the 25th May 2018 and this notice has been produced in compliance with the GDPR.

In summary, this privacy notice:

  • Sets out how we promise to look after your personal information
  • Describes how we collect, use and share your personal information, and
  • Tells you about your privacy rights and how the law protects you

This privacy notice covers personal information we collect about:

  • Visitors to our website
  • People who use our services, for example, persons who receive services from us to help remaining at home
  • People who complain about any aspect of a service we provide

Who we are

The County Council is the “data controller” for the personal information held by the County Council.  This means that we are responsible for deciding how we “process” (that is, collect, hold, use and disclose) your personal information.

Our address is Norfolk County Council, County Hall, Martineau Lane, Norwich NR1 2UA.

The County Council’s Data Protection Officer (DPO) is Geoff Connell.

The kind of information we hold about you and who provides it

Personal information can include, but is not limited to, your name, address, telephone number, date of birth, and bank details which can be found within records that the County Council holds which may include electronic records, letters, emails, photographs, audio recordings and video recordings.  It does not include information where the identity has been removed and you cannot be identified by this information and by any other information held by the County Council (anonymous information).

We may also hold more sensitive personal data known as “special categories” of data along with information relating to criminal offences and criminal convictions.  This includes details of ethnic origin, religious beliefs, sexual orientation, trade union membership, health data, and biometric (eg fingerprints, facial recognition) and genetic (e.g. DNA) data and requires a higher level of protection.

We may collect personal information about you from yourself directly or other individuals or organisations.

You can see more detail the kind of information we hold about you in relation to each County Council service and who we receive that information from can be found in our privacy notices for council service areas.

What we use your personal information for

We use your personal information to:

  • Provide County Council services and anything we must do by law
  • Carry out our regulatory, licensing and enforcement roles which we have to do by law
  • Make payments, grants and benefits
  • Act in connection with the prevention, detection and investigation of fraud
  • Assess how much must pay towards your County Council service if a charge is made for the service
  • Listen to your ideas about the County Council’s services
  • Deal with complaints
  • Tell you about the County Council’s services.

In some cases, you may be under a statutory or contractual obligation to provide information to the County Council.  Further detail of where this applies and the consequences of not providing it, together with information about why we use your personal data in relation to each of the County Council’s services can be found in our privacy notices for council service areas.

How the law protects you and the legal basis for processing your information

The GDPR places a legal obligation on us to process your personal information in accordance with the following data protection principles in that your personal data must be:

  • Used lawfully, fairly and in a transparent way
  • Collected only for valid purposes that we have explained to you and not used in any way that is incompatible with those purposes
  • Relevant to the purposes we have told you about and limited only to those purposes
  • Accurate and kept up to date
  • Kept only as long as is necessary for the purposes we have told you about
  • Kept securely

There must also be a lawful basis for processing personal information – a justifiable reason for us to collect, store, use and disclose your personal information.  Our lawful basis for doing so will depend on what services we are providing to you, and what type of information we process about you, for example, an additional basis is required for ‘special category’ data described above.

The basis we process your information will include:

  • To comply with a legal duty or public task.  There are statutory duties placed on and statutory powers provided to the County Council by various pieces of legislation including the Children Act 1989, the Care Act 2014, various education acts and Local Government Acts, the Localism Act 2011 and the Local Audit and Accountability Act 2014.  Further detail about our legal duties and powers in relation to each County Council service can be found in our privacy notices for council service areas.
  • To fulfil a contract we may have with you
  • When you consent/agree to it.  The County Council will tell you if processing some of your personal data is not necessary to comply with a public task or to fulfil a legal duty or to fulfil a contract and is therefore optional.  In these circumstances, we may ask for your consent to process it.  The GDPR sets higher standards in relation to obtaining your consent to process your personal information.  We have an obligation to ensure that when consent is required from you it is done so in a manner which is clear.

We also process special category information and information about convictions.  The grounds for the processing this information differs from the grounds set out above.  We have therefore set out our grounds for processing in relation to each County Council service and this can be found in our privacy notices for council service areas.

Who we share your personal data with

We may share your data with other services within the County Council so that we can keep our information on you as up-to-date as possible and so that we can improve our services to you.  For example, if you tell the Customer Services Team that you have moved, they will update your records and inform other parts of the County Council that may be providing you with a service.  Details of where we will do this can be found by clicking on the following link: Privacy notices for council service areas

We may also share your personal data with, and receive your personal data from, organisations and individuals outside of the County Council. Further detail about data sharing in relation to each County Council service can be found in our privacy notices for council service areas.

Additionally, your personal information can be provided to a third party contracted by the County Council to provide a service to the Council or directly to you.  These service providers are known as data processors and also have a legal obligation under GDPR and to the County Council to look after your personal information and only use it for providing that service.  An example of this is the County Council uses a case management system operated by a data processor for its social care services.

If we transfer your personal information to other countries

Your personal information may be transferred outside of the UK and the European Economic Area.  While some countries have adequate legal protections for personal data, in other countries steps will be necessary to ensure appropriate safeguards apply to the information.  These include imposing contractual obligations to ensure that these safeguards apply.  You can find details of what information the County Council may transfer to countries outside of the European Economic Area and the safeguards that apply in our privacy notices for council service areas.

How long we use your information for

We will only retain your personal information for as long as necessary to fulfil the purposes we collected it for, including for the purposes of satisfying any legal, accounting, or reporting requirements.

To work out the right retention period for personal data, we consider the following matters:

  • The amount, nature, and sensitivity of the personal data
  • The potential risk of harm from unauthorised use or disclosure of your personal data
  • The purposes for which we process your personal data and whether we can achieve those purposes through other means, and
  • Any legal or regulatory requirements.

In some circumstances we may anonymise your personal information so that it can no longer be associated with you, in which case we may use such information without further notice to you.

Once you are no longer require services from us, we will retain and securely destroy your personal information in accordance with our data retention schedule.

Automated decision making

In some areas, to improve the efficiency and effectiveness of services, the County Council uses automated decision-making processes, including profiling.  When an automated decision is made about you that is significant (one that has a legal effect, or otherwise significantly affects you) you will be notified of this, together with your rights to challenge this decision.

Details of where and how the Council carries out automated decisions can be found in our privacy notices for council service areas.

Your responsibility to inform us of changes

It is important that the personal information we hold about you is accurate and current.

Please keep us informed if your personal information changes during your working relationship with us.  You can do to help us with this by:

  • Telling us when any of your details change; and
  • Telling us if any of the information we hold on you is wrong

Your rights under the GDPR

You have the following rights (but note, these rights do not apply in all circumstances):

  • Your right to be informed about the processing of your personal information.  This is the purpose of this notice.
  • Your right to have your personal information corrected if it is inaccurate and to have incomplete personal information completed
  • Your right to object to the processing of your personal data
  • Your right to restrict processing of your personal information
  • Your right to have your personal data erased (“the right to be forgotten”).  As above, please note this right is subject to several restrictions, which we will discuss further with you if you choose to exercise it.
  • The right to move, copy or transfer your personal information (“data portability”) in some circumstances
  • Rights to be notified of, object to and challenge any automated decision made in respect of you, including profiling
  • Your right to request access to your personal information and information about how the County Council processes it
  • Your right to withdraw any consent you have given for the processing of personal data at any time

If you want to exercise any of these rights, please contact the Information Compliance Team by:

  • Emailing the Information Compliance Team on
  • Writing to the Information Compliance Team, Norfolk County Council, County Hall, Martineau Lane, Norwich NR1 2UA

Questions or complaints

If you have any questions about this privacy notice or how we handle your personal information, you can write to the DPO by letter to the DPO, Norfolk County Council, County Hall, Martineau Lane, Norwich NR1 2DH or by email to

You also have the right to make a complaint at any time to the Information Commissioner’s Office (ICO), the UK supervisory authority for data protection issues.  The ICO can be contacted:

  • By writing to the ICO, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF
  • By telephoning 0303 123 1113
  • Online at


We use cookies on this website. A cookie is a text file sent to your browser and stored there. This enables the web server to recognise your computer when you revisit our website.

We use cookies for things like collecting website usage data (via Google Analytics), which help us to improve the website and to display more relevant content to users based on previous sessions spent our website.

Most browsers allow you to refuse to accept cookies. This may, however, have a negative impact upon the usability of many websites, and may prevent you from accessing some services available on this website.

For more detailed information about how we use cookies on this website and how to disable them, click here


What information we collect

If you are a user with general public and anonymous access the Educational Psychology & Specialist Support website does not store or capture personal information, but merely logs the user’s IP address that is automatically recognised by the web server.

We collect information from visitors to the Educational Psychology & Specialist Support website using Google Analytics, which anonymously tracks things like numbers of visits/visitors/pageviews to our website, popular pages, customer journeys, and what browser or device people are using. It does not collect any personal information about the individual user. This enables us to monitor the performance of the website, ensure it can be used by everybody, and to deliver relevant and timely information to users.


Contacting us

You can ask for information or request services in five ways: by requests and questions sent by online forms, email, phone, post or in person. You can make comments and give us your feedback in the same way.

If you send an email or complete a form on the website asking for information or a service, or sending a comment that requires a response, it will be passed to the appropriate department who will respond to you. We do not pass on your details to any third party unless you give us permission or the Council is legally obliged to do so or it is for the prevention or detection of crime or fraud.

After we have replied to you, the Customer Service Centre will keep a record of your message for one year. Any queries which have been forwarded to other departments for a response may be kept for longer, but always in accordance with Educational Psychology & Specialist Support data protection policy.

Content sharing

Content published on our website (including on our Norfolk Directory) is public-facing, and can be shared via email or social networking sites using the functionality provided on the site. This type of content sharing is permitted as the information is being bookmarked or linked, and not adapted or altered.

Customer website feedback

Customers can give us feedback about our website, online information and transactions, using either by contacting us via a web form (see ‘Contacting us’ above), or the online feedback facility.

The information provided is used to build an overall picture of the general locations of people who use the website (ie via postcode) and their experiences so we can make our website usable and useful to all our visitors.

Email alerts and newsletters

After you register your email address, any messages you receive will be relevant to the service you originally signed up for. You have the option to subscribe to additional EPSS newsletters or you can unsubscribe at any time by following the links in each email we send or by logging in to your account and managing your subscriptions.

Sometimes you may be given the option to provide additional information which will allow us to send messages which are more relevant to your interests.

Information is stored on the understanding that personal data are adequately protected in accordance with the eighth principle of the Data Protection Act 1998.

External links

The Educational Psychology & Specialist Support website contains links to other external websites. This privacy policy applies only to our site, so you should always take care when you are moving to another site and read the privacy statement of any site, which collects personal information. Educational Psychology & Specialist Support accepts no responsibility or liability for these sites.

We do not pass on any personal information you have given us to any other site, except in the case of online payments where we transfer your details to HSBC our online payments partner and you enter your credit or debit card details on their secure website.

Access to your information and contacting Educational Psychology & Specialist Support

If you wish to see our records of any correspondence you have sent to us, or if you have a query or complaint about this privacy policy or about the site, you can contact us by email, phone or regular mail:

Phone: 01603 306362

Educational Psychology & Specialist Support

Children’s Services – EPSS

County Hall, Martineau Lane, Norwich NR1 2DH

If this privacy policy changes in any way, we will place an updated version on this page. Regularly reviewing this page ensures you are always aware of what information we collect, how we use it and under what circumstances, if any, we will share it with other parties.

Childrens Services (Education) privacy notice

this document provides information on how Norfolk County Council’s Children’s Services department uses your child’s personal information for educational purposes.  By ‘use’ we mean the various ways it may be processed including storing and sharing the information.

We also provide further details regarding who we are, how long we use your information for, your rights under the GDPR and how to exercise them on our website.  Alternatively, you can ask us for a copy of this information.

We use your personal information primarily to provide suitable education for children and young persons.

This includes the:

  • Securing sufficient school places across Norfolk
  • Securing sufficient early years and childcare places across Norfolk and the providing information, advice and assistance to parents and prospective parents
  • Coordinating school admissions and determining admission applications and the allocation of places through the Fair Access Protocol, and managing the transfer of pupils between schools during an academic year and organise school admission appeals
  • Monitoring and improving school attendance and undertaking, where necessary, prosecutions for non-school attendance and monitoring children missing from education when removed from the school roll
  • Coordinating Independent Review Panels for excluded pupils and ensuring pupils who are permanently excluded from school are provided with a place to continue their learning as quickly as possible
  • Identifying, assessing and securing suitable provision for children with special educational needs and disabilities, including the issuing and reviewing of education, health and care plans, and the provision of advice to schools about specialist school placements for children
  • Assessing the learning, social and emotional needs of Norfolk pupils and young people, including therapeutic work
  • Supporting pupils unable to attend school due to health needs
  • Monitoring children who are being educated at home
  • Providing or arranging for the provision of school transport
  • Processing free school meal and pupil premium eligibility
  • Monitoring and supporting the educational attainment and progress of looked after children, including those who are adopted (from September 2018) or subject to a special guardianship order
  • Supporting the educational progress and engagement of pupils from the Gypsy, Roma and Traveller community, and pupils with English as an additional language
  • Ensuring the provision of post 16 years education and training, youth support services and careers advice
  • Ensuring the provision accredited and non-accredited learning opportunities for adults aged 19+
  • Ensuring the provision of residential and outdoor learning opportunities
  • Submitting school census returns to the Department for Education (DfE)
  • Monitoring young people from Year 9 to age 18 in education, training and employment and identifying those young people who are at most risk of not receiving education or training or being in employment to ensure that they have sufficient support from the County Council and from schools, colleges and training providers
  • Issuing of child employment and performance licences, chaperone licences, child entertainment licences and performance licences for groups of children

We also use this information to assess the quality of our services and evaluate and improve our policies and procedures.

We may also use information in other ways compatible with the above.  Primarily this will include supporting the work of other public bodies providing educational services to children.  We provide more details of these services on our website at

You may not have to provide information to us for some of these services, but if you do not provide information we may not be able to, or it may inhibit our ability to, provide services to your child.

The information we hold includes information you have provided to us.

We also receive information from other public bodies and organisations providing educational services to you or your children particularly schools, sixth form colleges, higher education colleges and other post-16 educational provider schools. The categories of data we may receive from other public bodies and organisations are described further below.

The information we collect and use includes the child’s:

  • Personal details – name, gender, age, address, school, and family details –  including racial and ethnic origin and religious beliefs (see special categories of data below)
  • Contact information –  telephone number and email address
  • Name and contact details of person to be contacted in case of emergency
  • Personal identifiers – unique pupil number, National Insurance number, case management system references
  • Educational details – including attendance and exclusions; assessment information, public exam results, and special education needs information
  • Health information including special educational needs and disabilities (see special categories of data below)
  • Whether the young person aged 16 years and above is in education, training or employment
  • Financial details if relevant
  • Personal history including safeguarding reports, any criminal convictions ((see special categories of data below)) and employment history
  • Educational history including behaviour
  • Family history and social relationships generally
  • Licenses and permits

Special Category data is defined as “information concerning your racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union activity, genetic data, biometric data, health, sex life and sexual orientation”.  We may only collect and use these types of data when it is relevant and such data will be collected as part of the case work records and information we hold.  Information concerning your child’s physical and mental health including special educational needs, racial or ethnic origin, and religious or other beliefs will be relevant.

Information concerning any criminal convictions is afforded a similar special level of protection, and we may collect and use this information where it is relevant, subject to the same safeguards.

For ordinary personal information (that is, all your information which is not special category data) we have legal grounds to process this information because it is necessary to comply with a legal duty or fulfil a public task.

This includes under the:

  • Education Acts 1944 and 1996
  • Children and Young Persons Act 1933 and 1963 and the Children (Performances and Activities) (England) Regulations 2014
  • Children Act 1989 and 2004
  • Childcare Act 2006
  • Education and Inspections Act 2006
  • Young People’s Act 2008
  • Education and Skills Act 2008
  • Education (Information about Individual Pupils) (England) Regulations (2013)
  • Children and Families Act 2014
  • Education and Adoption Act 2016

For special category data, we have legal grounds to process this information where it is in the necessary for reasons in the substantial public interest.  This will include where it is necessary to carry out any of our statutory functions or necessary for protecting individuals at risk.  The law includes safeguards to protect the use of your special category data and any information concerning criminal convictions.

Additionally, and where appropriate, we may seek specific consent to use your information in certain ways.  This will normally be where the use of the data is not necessary for the above purposes but may be very useful or helpful to us to provide services. For example, all marketing and feedback where personal information is obtained alongside, and directed at, individuals, and where personal information, such as photographs/videos, are used for publicity purposes.

We may also share your personal information with other organisations and public bodies, in particular:

  • NHS and other health agencies
  • Education settings – schools, sixth form colleges, higher education colleges and other post 16 educational providers
  • Childcare settings (eg nurseries)
  • Pupil Referral Units
  • Department for Work and Pensions (DWP)
  • Education and Skills Funding Agency
  • Ofsted
  • District councils
  • Police
  • Youth Offending Team
  • Other central government agencies and public authorities
  • School transport operator
  • Qualification awarding bodies
  • DfE for the following purposes
    • The school census: to find out more about the data collection requirements placed on us by the DfE for the school census go to
    • The National Pupil Database (NPD): to find out more about the NPD visit the website
    • In respect of children in need and looked after children to help the DfE develop national policies, manage local authority performance, administer and allocate funding and identify and encourage good practice.  For more information about the data collection requirements placed on us by the DfE go to the looked after children or children in need pages on

We share this information without your specific consent as it is reasonable and necessary to do so to fulfil our public tasks or it is otherwise in the substantial public interest to do so.  The law imposes safeguards to protect your privacy in these circumstances.

We will also share your information, subject to contractual and other legal safeguards, with organisations commissioned to provide services to you and others.  Finally, we may also share your information across different departments of the County Council, where it is necessary for our public tasks or functions to do so.

The information is stored electronically, on the County Council’s records management system. Additionally, information is securely stored in other mediums, including email accounts and in paper files.  We do not process your information outside of the European Economic Area.

We do not make automated decisions about you and your children but if we do in the future we will let you know.

This notice was updated in May 2018